Ransomware Protection and Restoration Services Brooklyn

Ransomware : Your Worst IT Nightmare
Ransomware has become an escalating cyber pandemic that represents an existential danger for businesses of all sizes unprepared for an attack. Different iterations of ransomware like the CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for a long time and still cause havoc. Newer variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Lockbit and Egregor, along with frequent unnamed malware, not only do encryption of online information but also infect all accessible system restores and backups. Information synched to the cloud can also be ransomed. In a poorly architected data protection solution, it can make any restoration hopeless and basically sets the datacenter back to zero.

Getting back on-line applications and data following a ransomware intrusion becomes a sprint against the clock as the targeted organization struggles to stop the spread and clear the ransomware and to resume enterprise-critical activity. Since crypto-ransomware requires time to replicate, attacks are often sprung at night, when attacks in many cases take longer to discover. This multiplies the difficulty of rapidly mobilizing and orchestrating an experienced response team.

Progent offers a variety of support services for securing Brooklyn enterprises from ransomware events. These include staff education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of next-generation security gateways with artificial intelligence technology to rapidly detect and disable zero-day cyber threats. Progent also offers the services of seasoned ransomware recovery consultants with the skills and perseverance to re-deploy a compromised system as quickly as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware attack, paying the ransom in Bitcoin cryptocurrency does not guarantee that distant criminals will provide the codes to decrypt any of your files. Kaspersky ascertained that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is well higher than the average crypto-ransomware demands, which ZDNET determined to be around $13,000 for smaller businesses. The fallback is to setup from scratch the essential elements of your Information Technology environment. Absent access to complete data backups, this requires a broad range of skill sets, well-coordinated team management, and the ability to work 24x7 until the recovery project is complete.

For two decades, Progent has offered professional IT services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned advanced industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, and SANS GIAC. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of experience provides Progent the ability to knowledgably understand necessary systems and re-organize the surviving components of your IT environment following a crypto-ransomware penetration and assemble them into an operational system.

Progent's ransomware team deploys state-of-the-art project management applications to coordinate the complicated restoration process. Progent understands the urgency of acting quickly and together with a client's management and Information Technology team members to assign priority to tasks and to get essential applications back on-line as fast as possible.

Case Study: A Successful Ransomware Penetration Recovery
A business hired Progent after their company was penetrated by the Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state criminal gangs, possibly adopting strategies leaked from the United States National Security Agency. Ryuk seeks specific businesses with little or no room for operational disruption and is one of the most lucrative versions of ransomware malware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company based in Chicago and has about 500 employees. The Ryuk intrusion had disabled all essential operations and manufacturing processes. Most of the client's data backups had been on-line at the beginning of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom (in excess of $200,000) and wishfully thinking for the best, but in the end reached out to Progent.

Progent worked together with the client to rapidly assess and assign priority to the critical applications that needed to be addressed to make it possible to restart business functions:

• Active Directory
• E-Mail
• Accounting/MRP

Within 2 days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then initiated setup and storage recovery of critical systems. All Microsoft Exchange Server schema and configuration information were intact, which greatly helped the restore of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Email Off-Line Data Files) on team PCs and laptops to recover mail data. A recent offline backup of the businesses accounting/ERP systems made them able to recover these vital services back available to users. Although major work still had to be done to recover completely from the Ryuk virus, critical services were returned to operations quickly:

Over the next few weeks key milestones in the recovery process were made in tight collaboration between Progent team members and the client:

• Self-hosted web applications were returned to operation without losing any information.
• The MailStore Exchange Server containing more than 4 million historical messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory capabilities were 100% recovered.
• A new Palo Alto Networks 850 security appliance was installed.
• Most of the desktop computers were fully operational.

Conclusion
A probable business catastrophe was evaded due to top-tier experts, a broad spectrum of IT skills, and close teamwork. Although in analyzing the event afterwards the ransomware penetration described here could have been blocked with up-to-date security technology solutions and recognized best practices, user and IT administrator training, and well designed security procedures for information backup and proper patching controls, the fact remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, cleanup, and data disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

File body_ransomware_recovery_contact_city.asp does not exist