Ransomware Filtering and Cleanup Services Belo Horizonte

Crypto-Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become a too-frequent cyberplague that represents an enterprise-level threat for organizations unprepared for an attack. Multiple generations of ransomware such as CrySIS, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for years and continue to inflict havoc. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus additional unnamed viruses, not only perform encryption of on-line data but also infiltrate any available system protection. Files synchronized to off-premises disaster recovery sites can also be rendered useless. In a poorly architected data protection solution, it can render automatic restoration useless and effectively sets the datacenter back to zero.

Retrieving services and data following a crypto-ransomware attack becomes a race against the clock as the victim fights to stop lateral movement, cleanup the crypto-ransomware, and restore enterprise-critical operations. Due to the fact that ransomware takes time to spread across a targeted network, assaults are often sprung at night, when attacks are likely to take more time to discover. This compounds the difficulty of rapidly assembling and orchestrating an experienced response team.

Progent provides a range of solutions for securing Belo Horizonte enterprises from crypto-ransomware events. Among these are user training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to discover and extinguish day-zero malware assaults. Progent also provides the assistance of seasoned ransomware recovery consultants with the skills and perseverance to reconstruct a compromised environment as urgently as possible.

Progent's Ransomware Recovery Services
Following a ransomware invasion, paying the ransom demands in cryptocurrency does not ensure that cyber hackers will respond with the keys to decipher any of your information. Kaspersky Labs ascertained that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The fallback is to piece back together the essential components of your IT environment. Absent the availability of essential information backups, this calls for a wide range of skills, top notch team management, and the capability to work 24x7 until the task is completed.

For decades, Progent has provided certified expert Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have earned high-level certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial systems and ERP applications. This breadth of experience gives Progent the capability to rapidly understand important systems and organize the surviving parts of your computer network system after a ransomware attack and configure them into an operational system.

Progent's security team uses best of breed project management applications to orchestrate the sophisticated recovery process. Progent appreciates the importance of working swiftly and in unison with a client's management and IT team members to prioritize tasks and to put essential applications back online as fast as humanly possible.

Customer Story: A Successful Ransomware Penetration Recovery
A customer engaged Progent after their network system was brought down by the Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean state sponsored cybercriminals, possibly adopting strategies exposed from the United States NSA organization. Ryuk targets specific companies with little room for operational disruption and is among the most lucrative iterations of crypto-ransomware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing business located in Chicago and has about 500 staff members. The Ryuk attack had brought down all company operations and manufacturing processes. The majority of the client's data protection had been directly accessible at the start of the attack and were encrypted. The client considered paying the ransom (in excess of two hundred thousand dollars) and hoping for the best, but ultimately brought in Progent.

Progent worked with the customer to rapidly identify and assign priority to the critical elements that had to be addressed to make it possible to restart business operations:

• Windows Active Directory
• Email
• Accounting and Manufacturing Software

Within two days, Progent was able to re-build Windows Active Directory to its pre-intrusion state. Progent then initiated reinstallations and storage recovery on mission critical servers. All Exchange schema and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to assemble local OST files (Outlook Off-Line Folder Files) on user workstations and laptops to recover email data. A recent off-line backup of the customer's accounting systems made it possible to restore these required programs back online for users. Although major work still had to be done to recover completely from the Ryuk attack, core services were restored rapidly:

Throughout the following month important milestones in the restoration project were achieved through close collaboration between Progent team members and the customer:

• Internal web sites were brought back up without losing any data.
• The MailStore Server containing more than 4 million historical emails was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory modules were 100% recovered.
• A new Palo Alto 850 security appliance was deployed.
• Most of the user PCs were being used by staff.

Conclusion
A likely business disaster was evaded due to hard-working professionals, a wide spectrum of technical expertise, and close collaboration. Although in hindsight the ransomware incident detailed here would have been disabled with advanced cyber security technology solutions and NIST Cybersecurity Framework best practices, team training, and well designed security procedures for information backup and proper patching controls, the fact is that state-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's team of experts has proven experience in crypto-ransomware virus blocking, removal, and information systems disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Belo Horizonte
For ransomware recovery expertise in the Belo Horizonte area, call Progent at 800-462-8800 or visit Contact Progent.