Ransomware Defense and Removal Expertise Belo Horizonte

Ransomware : Your Worst IT Nightmare
Crypto-Ransomware has become a modern cyberplague that presents an existential threat for organizations unprepared for an attack. Multiple generations of crypto-ransomware such as CrySIS, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for years and still cause havoc. More recent variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, along with more unnamed newcomers, not only perform encryption of on-line information but also infiltrate most available system restores and backups. Information replicated to cloud environments can also be ransomed. In a poorly designed environment, it can make any recovery useless and effectively knocks the network back to square one.

Retrieving programs and information following a crypto-ransomware intrusion becomes a race against the clock as the targeted organization struggles to stop lateral movement, clear the crypto-ransomware, and restore business-critical operations. Since crypto-ransomware needs time to spread throughout a targeted network, penetrations are usually sprung during nights and weekends, when attacks are likely to take longer to detect. This multiplies the difficulty of rapidly mobilizing and orchestrating an experienced mitigation team.

Progent offers a range of support services for protecting Belo Horizonte businesses from crypto-ransomware attacks. Among these are team education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to detect and disable day-zero malware attacks. Progent also offers the services of experienced ransomware recovery consultants with the track record and perseverance to reconstruct a breached environment as urgently as possible.

Progent's Ransomware Restoration Services
After a ransomware invasion, paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will provide the needed codes to decrypt any or all of your files. Kaspersky determined that 17% of ransomware victims never restored their data after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to piece back together the key elements of your Information Technology environment. Absent access to complete system backups, this calls for a broad complement of skill sets, top notch project management, and the ability to work non-stop until the task is complete.

For two decades, Progent has offered expert Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned advanced industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of expertise provides Progent the skills to quickly determine critical systems and integrate the surviving pieces of your network system following a ransomware attack and assemble them into an operational network.

Progent's security team of experts uses powerful project management applications to orchestrate the complicated restoration process. Progent appreciates the importance of acting quickly and together with a customer's management and Information Technology team members to prioritize tasks and to put the most important applications back online as fast as humanly possible.

Case Study: A Successful Ransomware Intrusion Restoration
A client sought out Progent after their organization was taken over by Ryuk ransomware. Ryuk is thought to have been created by North Korean government sponsored hackers, suspected of using techniques exposed from the United States National Security Agency. Ryuk goes after specific organizations with limited ability to sustain operational disruption and is among the most profitable incarnations of ransomware viruses. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company based in the Chicago metro area and has about 500 workers. The Ryuk event had frozen all company operations and manufacturing processes. The majority of the client's backups had been online at the beginning of the attack and were encrypted. The client considered paying the ransom demand (exceeding $200,000) and praying for the best, but in the end brought in Progent.

Progent worked hand in hand the client to quickly understand and assign priority to the key areas that needed to be addressed in order to restart departmental functions:

• Active Directory
• Microsoft Exchange Email
• Accounting and Manufacturing Software

Within two days, Progent was able to restore Active Directory services to its pre-attack state. Progent then charged ahead with reinstallations and hard drive recovery of mission critical systems. All Microsoft Exchange Server data and attributes were usable, which facilitated the restore of Exchange. Progent was also able to collect intact OST files (Outlook Email Off-Line Data Files) on staff PCs to recover email data. A not too old offline backup of the client's financials/ERP systems made it possible to return these required applications back online. Although a lot of work remained to recover totally from the Ryuk event, essential systems were recovered rapidly:

Throughout the next few weeks important milestones in the recovery process were completed through tight cooperation between Progent engineers and the customer:

• Self-hosted web applications were returned to operation with no loss of information.
• The MailStore Exchange Server exceeding four million historical emails was brought online and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory functions were completely operational.
• A new Palo Alto 850 security appliance was installed.
• Ninety percent of the user workstations were fully operational.

Conclusion
A possible business disaster was evaded due to dedicated professionals, a wide range of knowledge, and tight teamwork. Although in retrospect the ransomware attack detailed here could have been identified and prevented with modern cyber security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and well designed incident response procedures for information backup and keeping systems up to date with security patches, the reality is that government-sponsored cyber criminals from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's roster of professionals has proven experience in crypto-ransomware virus defense, removal, and information systems disaster recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Belo Horizonte
For ransomware system recovery services in the Belo Horizonte metro area, phone Progent at 800-462-8800 or go to Contact Progent.