Ransomware Protection and Remediation Solutions Belo Horizonte

Ransomware : Your Worst Information Technology Disaster
Ransomware has become a too-frequent cyberplague that presents an enterprise-level danger for businesses of all sizes unprepared for an assault. Multiple generations of crypto-ransomware like the Dharma, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for a long time and still inflict destruction. More recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as more as yet unnamed newcomers, not only encrypt on-line data files but also infect any configured system protection mechanisms. Data synched to the cloud can also be encrypted. In a poorly designed system, this can render any restoration impossible and effectively knocks the network back to zero.

Getting back services and data after a crypto-ransomware outage becomes a race against time as the targeted organization struggles to stop lateral movement and remove the ransomware and to resume enterprise-critical operations. Because ransomware takes time to move laterally, attacks are frequently sprung at night, when successful penetrations in many cases take more time to notice. This compounds the difficulty of rapidly marshalling and orchestrating a capable mitigation team.

Progent provides an assortment of solutions for securing Belo Horizonte enterprises from crypto-ransomware attacks. Among these are user training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to detect and extinguish day-zero modern malware attacks. Progent also can provide the services of seasoned crypto-ransomware recovery consultants with the skills and commitment to reconstruct a breached environment as soon as possible.

Progent's Ransomware Recovery Help
Following a ransomware attack, paying the ransom demands in Bitcoin cryptocurrency does not ensure that distant criminals will return the keys to unencrypt any or all of your information. Kaspersky determined that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is well higher than the usual ransomware demands, which ZDNET determined to be around $13,000 for small businesses. The alternative is to piece back together the key elements of your Information Technology environment. Without access to complete data backups, this calls for a wide range of skill sets, well-coordinated team management, and the willingness to work 24x7 until the job is over.

For decades, Progent has made available professional IT services for companies throughout the United States and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded top certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have earned internationally-renowned certifications including CISM, CISSP, CRISC, and GIAC. (Refer to Progent's certifications). Progent in addition has expertise with financial management and ERP software solutions. This breadth of expertise affords Progent the capability to quickly determine important systems and integrate the surviving parts of your computer network environment following a ransomware penetration and rebuild them into a functioning network.

Progent's ransomware group has state-of-the-art project management systems to orchestrate the complicated restoration process. Progent understands the urgency of acting quickly and in concert with a client's management and Information Technology team members to assign priority to tasks and to get the most important applications back online as soon as humanly possible.

Business Case Study: A Successful Ransomware Attack Response
A customer escalated to Progent after their company was crashed by the Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state sponsored criminal gangs, possibly adopting technology exposed from the United States National Security Agency. Ryuk targets specific organizations with little tolerance for operational disruption and is among the most profitable versions of ransomware viruses. Headline targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company located in Chicago with about 500 employees. The Ryuk attack had shut down all company operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the time of the attack and were destroyed. The client was actively seeking loans for paying the ransom demand (in excess of $200,000) and wishfully thinking for the best, but ultimately called Progent.

Progent worked with the customer to quickly determine and prioritize the critical systems that needed to be addressed in order to resume business functions:

• Active Directory (AD)
• Electronic Messaging
• Financials/MRP

Within 2 days, Progent was able to recover Active Directory to its pre-intrusion state. Progent then completed reinstallations and storage recovery of essential systems. All Exchange Server schema and configuration information were intact, which facilitated the restore of Exchange. Progent was able to locate non-encrypted OST files (Microsoft Outlook Offline Folder Files) on staff PCs to recover email data. A recent off-line backup of the client's accounting/ERP systems made it possible to recover these vital services back available to users. Although major work still had to be done to recover fully from the Ryuk attack, core systems were restored quickly:

Throughout the following couple of weeks critical milestones in the restoration process were completed through tight cooperation between Progent consultants and the customer:

• In-house web sites were returned to operation with no loss of information.
• The MailStore Exchange Server containing more than four million archived messages was spun up and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were 100% functional.
• A new Palo Alto Networks 850 security appliance was brought online.
• Ninety percent of the user workstations were being used by staff.

Conclusion
A probable business-killing disaster was avoided through the efforts of results-oriented experts, a wide array of knowledge, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware incident described here should have been identified and disabled with modern security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and well designed security procedures for data protection and applying software patches, the reality is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, mitigation, and data restoration.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Belo Horizonte
For ransomware recovery consulting in the Belo Horizonte metro area, phone Progent at 800-462-8800 or visit Contact Progent.