Ransomware Defense and Recovery Expertise Bristol

Ransomware : Your Worst Information Technology Disaster
Ransomware has become an escalating cyberplague that represents an enterprise-level threat for organizations unprepared for an assault. Versions of ransomware such as Dharma, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for years and continue to cause damage. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as more unnamed viruses, not only perform encryption of online files but also infect most available system restores and backups. Information synched to cloud environments can also be ransomed. In a poorly architected system, it can render automated recovery hopeless and effectively sets the network back to square one.

Retrieving services and information after a ransomware attack becomes a race against time as the targeted organization tries its best to stop lateral movement, remove the ransomware, and resume business-critical operations. Due to the fact that ransomware needs time to move laterally throughout a network, penetrations are often launched on weekends, when successful attacks are likely to take more time to detect. This multiplies the difficulty of rapidly assembling and coordinating a capable mitigation team.

Progent has an assortment of services for protecting Bristol businesses from ransomware events. These include staff training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based threat protection to identify and extinguish zero-day modern malware attacks. Progent in addition provides the services of experienced crypto-ransomware recovery consultants with the track record and perseverance to re-deploy a compromised environment as rapidly as possible.

Progent's Ransomware Recovery Services
Subsequent to a ransomware penetration, paying the ransom demands in cryptocurrency does not ensure that merciless criminals will respond with the codes to unencrypt any or all of your information. Kaspersky Labs determined that 17% of ransomware victims never restored their data after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The fallback is to piece back together the key elements of your Information Technology environment. Absent the availability of complete system backups, this requires a broad complement of IT skills, professional project management, and the willingness to work 24x7 until the job is over.

For twenty years, Progent has provided certified expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have earned internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial systems and ERP application software. This breadth of expertise affords Progent the ability to efficiently determine critical systems and re-organize the surviving components of your network environment after a crypto-ransomware penetration and configure them into a functioning system.

Progent's security team has top notch project management systems to coordinate the sophisticated restoration process. Progent appreciates the urgency of acting quickly and in concert with a client's management and IT team members to prioritize tasks and to get critical services back online as fast as possible.

Customer Story: A Successful Ransomware Attack Response
A customer escalated to Progent after their organization was taken over by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state sponsored hackers, suspected of using algorithms exposed from the U.S. NSA organization. Ryuk targets specific businesses with limited room for disruption and is among the most profitable instances of ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturer based in Chicago and has around 500 workers. The Ryuk attack had brought down all company operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the beginning of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (in excess of $200,000) and hoping for the best, but in the end called Progent.

Progent worked with the client to quickly get our arms around and prioritize the most important services that had to be addressed to make it possible to resume business functions:

• Active Directory
• Microsoft Exchange Server
• MRP System

Within 48 hours, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then helped perform setup and storage recovery of the most important systems. All Microsoft Exchange Server ties and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to find non-encrypted OST files (Outlook Off-Line Folder Files) on user workstations to recover email messages. A not too old offline backup of the customer's accounting/ERP software made it possible to return these vital applications back online. Although a large amount of work remained to recover fully from the Ryuk attack, critical services were recovered quickly:

During the next month key milestones in the restoration process were made in tight cooperation between Progent consultants and the client:

• Self-hosted web sites were returned to operation without losing any data.
• The MailStore Exchange Server with over 4 million historical messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoicing/AP/Accounts Receivables/Inventory modules were 100 percent restored.
• A new Palo Alto 850 security appliance was set up and programmed.
• Most of the desktop computers were operational.

Conclusion
A possible business-ending catastrophe was averted through the efforts of results-oriented professionals, a wide range of IT skills, and close collaboration. Although in hindsight the ransomware virus penetration described here should have been disabled with modern security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and appropriate security procedures for backup and applying software patches, the fact is that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware virus, remember that Progent's team of experts has proven experience in ransomware virus defense, mitigation, and file restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Bristol
For ransomware cleanup consulting in the Bristol area, phone Progent at 800-462-8800 or see Contact Progent.