Ransomware Protection and Recovery Services Birmingham

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a modern cyber pandemic that presents an existential threat for businesses poorly prepared for an attack. Different versions of ransomware such as Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been around for years and still inflict destruction. More recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with more unnamed viruses, not only perform encryption of online critical data but also infect many configured system restores and backups. Data synched to cloud environments can also be rendered useless. In a poorly architected environment, it can render any restore operations useless and basically knocks the network back to zero.

Recovering services and information after a ransomware intrusion becomes a sprint against time as the targeted organization fights to stop lateral movement, clear the ransomware, and resume enterprise-critical activity. Due to the fact that crypto-ransomware needs time to replicate throughout a targeted network, penetrations are often launched at night, when penetrations tend to take longer to identify. This compounds the difficulty of promptly assembling and orchestrating a qualified mitigation team.

Progent provides a variety of help services for securing Birmingham organizations from ransomware penetrations. Among these are team member training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to detect and disable day-zero malware attacks. Progent also can provide the services of experienced crypto-ransomware recovery consultants with the skills and commitment to restore a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Soon after a ransomware attack, sending the ransom in cryptocurrency does not guarantee that cyber criminals will return the needed codes to decipher all your data. Kaspersky Labs determined that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to re-install the mission-critical components of your Information Technology environment. Without access to full data backups, this calls for a broad complement of IT skills, top notch project management, and the capability to work continuously until the recovery project is finished.

For twenty years, Progent has made available certified expert Information Technology services for companies across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have attained top industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with accounting and ERP applications. This breadth of experience affords Progent the ability to knowledgably identify critical systems and re-organize the surviving pieces of your IT environment after a ransomware attack and configure them into a functioning system.

Progent's recovery team uses best of breed project management tools to coordinate the complicated recovery process. Progent knows the importance of acting rapidly and in unison with a customer's management and Information Technology resources to assign priority to tasks and to put the most important applications back online as soon as humanly possible.

Customer Case Study: A Successful Ransomware Intrusion Response
A client sought out Progent after their network was taken over by Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored criminal gangs, suspected of using technology leaked from the United States NSA organization. Ryuk seeks specific organizations with little or no tolerance for disruption and is one of the most lucrative iterations of ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in the Chicago metro area with around 500 workers. The Ryuk penetration had frozen all essential operations and manufacturing capabilities. Most of the client's information backups had been online at the start of the attack and were damaged. The client was evaluating paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but in the end engaged Progent.

Progent worked hand in hand the client to quickly assess and prioritize the mission critical systems that had to be recovered in order to restart business functions:

• Active Directory
• Electronic Mail
• Accounting/MRP

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-intrusion state. Progent then performed reinstallations and hard drive recovery on critical applications. All Exchange Server data and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to find intact OST files (Outlook Offline Folder Files) on team workstations and laptops in order to recover mail messages. A recent off-line backup of the customer's manufacturing systems made them able to return these essential services back available to users. Although a lot of work still had to be done to recover fully from the Ryuk event, critical systems were returned to operations rapidly:

Throughout the following month key milestones in the recovery process were achieved through tight collaboration between Progent team members and the client:

• In-house web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was brought online and available for users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory capabilities were 100 percent functional.
• A new Palo Alto Networks 850 firewall was set up.
• Nearly all of the desktops and laptops were fully operational.

Conclusion
A possible business catastrophe was dodged due to hard-working professionals, a broad spectrum of IT skills, and close collaboration. Although in hindsight the crypto-ransomware virus penetration described here would have been prevented with up-to-date security technology and best practices, team training, and well thought out incident response procedures for data backup and applying software patches, the reality remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware virus, remember that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and file restoration.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Birmingham
For ransomware system restoration expertise in the Birmingham metro area, call Progent at 800-462-8800 or go to Contact Progent.