Ransomware : Your Worst IT Nightmare
Ransomware  Remediation ExpertsRansomware has become an escalating cyber pandemic that represents an existential danger for businesses of all sizes unprepared for an attack. Different iterations of ransomware like the CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for a long time and still cause havoc. Newer variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Lockbit and Egregor, along with frequent unnamed malware, not only do encryption of online information but also infect all accessible system restores and backups. Information synched to the cloud can also be ransomed. In a poorly architected data protection solution, it can make any restoration hopeless and basically sets the datacenter back to zero.

Getting back on-line applications and data following a ransomware intrusion becomes a sprint against the clock as the targeted organization struggles to stop the spread and clear the ransomware and to resume enterprise-critical activity. Since crypto-ransomware requires time to replicate, attacks are often sprung at night, when attacks in many cases take longer to discover. This multiplies the difficulty of rapidly mobilizing and orchestrating an experienced response team.

Progent offers a variety of support services for securing Brooklyn enterprises from ransomware events. These include staff education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of next-generation security gateways with artificial intelligence technology to rapidly detect and disable zero-day cyber threats. Progent also offers the services of seasoned ransomware recovery consultants with the skills and perseverance to re-deploy a compromised system as quickly as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware attack, paying the ransom in Bitcoin cryptocurrency does not guarantee that distant criminals will provide the codes to decrypt any of your files. Kaspersky ascertained that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is well higher than the average crypto-ransomware demands, which ZDNET determined to be around $13,000 for smaller businesses. The fallback is to setup from scratch the essential elements of your Information Technology environment. Absent access to complete data backups, this requires a broad range of skill sets, well-coordinated team management, and the ability to work 24x7 until the recovery project is complete.

For two decades, Progent has offered professional IT services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned advanced industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, and SANS GIAC. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of experience provides Progent the ability to knowledgably understand necessary systems and re-organize the surviving components of your IT environment following a crypto-ransomware penetration and assemble them into an operational system.

Progent's ransomware team deploys state-of-the-art project management applications to coordinate the complicated restoration process. Progent understands the urgency of acting quickly and together with a client's management and Information Technology team members to assign priority to tasks and to get essential applications back on-line as fast as possible.

Case Study: A Successful Ransomware Penetration Recovery
A business hired Progent after their company was penetrated by the Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state criminal gangs, possibly adopting strategies leaked from the United States National Security Agency. Ryuk seeks specific businesses with little or no room for operational disruption and is one of the most lucrative versions of ransomware malware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company based in Chicago and has about 500 employees. The Ryuk intrusion had disabled all essential operations and manufacturing processes. Most of the client's data backups had been on-line at the beginning of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom (in excess of $200,000) and wishfully thinking for the best, but in the end reached out to Progent.


"I canít say enough about the support Progent gave us during the most stressful time of (our) companyís life. We may have had to pay the cybercriminals if not for the confidence the Progent experts gave us. That you could get our messaging and production servers back into operation in less than five days was earth shattering. Every single staff member I got help from or e-mailed at Progent was amazingly focused on getting our company operational and was working 24/7 on our behalf."

Progent worked together with the client to rapidly assess and assign priority to the critical applications that needed to be addressed to make it possible to restart business functions:

  • Active Directory
  • E-Mail
  • Accounting/MRP
To start, Progent followed AV/Malware Processes incident response best practices by stopping the spread and clearing up compromised systems. Progent then initiated the task of bringing back online Microsoft Active Directory, the key technology of enterprise environments built upon Microsoft Windows Server technology. Microsoft Exchange Server email will not function without Windows AD, and the customerís MRP system used Microsoft SQL, which requires Active Directory for authentication to the databases.

Within 2 days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then initiated setup and storage recovery of critical systems. All Microsoft Exchange Server schema and configuration information were intact, which greatly helped the restore of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Email Off-Line Data Files) on team PCs and laptops to recover mail data. A recent offline backup of the businesses accounting/ERP systems made them able to recover these vital services back available to users. Although major work still had to be done to recover completely from the Ryuk virus, critical services were returned to operations quickly:


"For the most part, the assembly line operation was never shut down and we did not miss any customer shipments."

Over the next few weeks key milestones in the recovery process were made in tight collaboration between Progent team members and the client:

  • Self-hosted web applications were returned to operation without losing any information.
  • The MailStore Exchange Server containing more than 4 million historical messages was restored to operations and accessible to users.
  • CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory capabilities were 100% recovered.
  • A new Palo Alto Networks 850 security appliance was installed.
  • Most of the desktop computers were fully operational.

"A lot of what was accomplished during the initial response is mostly a blur for me, but we will not forget the urgency each and every one of you accomplished to help get our business back. Iíve been working with Progent for at least 10 years, possibly more, and every time I needed help Progent has come through and delivered. This time was a Herculean accomplishment."

Conclusion
A probable business catastrophe was evaded due to top-tier experts, a broad spectrum of IT skills, and close teamwork. Although in analyzing the event afterwards the ransomware penetration described here could have been blocked with up-to-date security technology solutions and recognized best practices, user and IT administrator training, and well designed security procedures for information backup and proper patching controls, the fact remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, cleanup, and data disaster recovery.


"So, to Darrin, Matt, Aaron, Dan, Jesse, Arnaud, Allen, Tony and Chris (and any others that were contributing), thank you for making it so I could get rested after we made it over the initial fire. Everyone did an impressive job, and if any of your guys is in the Chicago area, a great meal is my treat!"

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

File body_ransomware_recovery_contact_city.asp does not exist



An index of content::

  • 24-Hour BlackBerry Professional Software Network Consult Brooklyn Brooklyn, United States BlackBerry Outsourcing Firm
  • After Hours ASA with Firepower Consultants Cisco Firesight Remote Troubleshooting
  • Brooklyn Maze Crypto-Ransomware Mitigation Brooklyn, U.S.A.
  • At Home Workers Brooklyn Consultants - Security Solutions Expertise Brooklyn Immediate Brooklyn Work from Home Employees Security Solutions Assistance Brooklyn
  • At Home Workforce Brooklyn Guidance - Connectivity Guidance Brooklyn Offsite Workforce Consultants near Brooklyn - Connectivity Solutions Consulting Experts Brooklyn
  • Brooklyn At Home Workers Cloud Integration Solutions Expertise Brooklyn New York Telecommuters Brooklyn Expertise - Cloud Technology Consulting Experts Brooklyn
  • Brooklyn IT Staffing Services Brooklyn, America Short-Term IT Support Staffing Services Consulting Experts Brooklyn New York
  • Brooklyn Microsoft Dynamics GP Upgrade Experts Brooklyn, New York Brooklyn Microsoft Dynamics GP-Software Upgrade Support
  • Brooklyn NY, America SharePoint 2010 Setup and Support Microsoft SharePoint Server 2007 Online Support Brooklyn
  • Brooklyn New York Brooklyn Work at Home Employees Conferencing Technology Consulting Brooklyn Work at Home Employees Voice/Video Conferencing Technology Consulting Experts Brooklyn
  • Brooklyn Telecommuters Expertise - Brooklyn - Backup/Recovery Systems Assistance Brooklyn At Home Workers Data Protection Solutions Guidance Brooklyn
  • Brooklyn Work at Home Employees Consulting in Brooklyn - Collaboration Systems Consultants Brooklyn Telecommuters Collaboration Solutions Assistance Brooklyn NY
  • CISSP Firewall Configure Brooklyn, America CISSP Network Security Evaluation
  • Computer Network Consultant Cisco Brooklyn New York Cisco Computer Consulting Brooklyn, NY
  • Computer Support For Small Offices Brooklyn Integration Company New York, NY
  • Crypto Recovery Services Brooklyn, New York, US Brooklyn MongoLock Crypto-Ransomware Removal Brooklyn
  • Emergency Specialists for IT Support Providers near Brooklyn - Temporary Support Staff Augmentation Brooklyn, New York Brooklyn Specialists for Network Support Organizations Brooklyn

  • Computer Consulting Aironet
    Wireless IT Consulting

    Progent's Cisco-certified wireless integration consulting experts can assist organizations to deploy, manage, and troubleshoot Cisco wireless products such as Cisco's Aironet and Meraki Wave 2 Wi-Fi access points plus Cisco's Wireless Network Controllers.

  • Exchange Server 2019 Consultancy Brooklyn, New York Exchange 2019 Design Firm Brooklyn
  • Brooklyn Ryuk Ransomware Virus Cleanup Brooklyn
  • Immediate Azure and iPhone integration Consult Microsoft Azure Active Directory Integration
  • Independent Cisco Consultant Career Contract Cisco CCNA Job Opportunities
  • Juniper SRX650 Router Intrusion Detection Juniper SRX Firewall Firewall Configuration

  • Microsoft Certified SQL Server 2019 Reporting Services Setup and Support
    SQL Server 2019 on Linux Online Technical Support

    Progent's Microsoft-certified SQL Server 2019 experts can assist you to assess the business case for migrating to SQL Server 2019 and can provide rapid online or on-premises access to consulting experts in system planning and deployment, software development, SQL Server management, and cybersecurity.

  • Microsoft Dynamics 365 Business Central Technical Support Services Microsoft Dynamics 365 Business Central Help and Support
  • Microsoft ISA 2004 Server Technical Consultant Internet Security and Acceleration Server Online Support Services

  • ISA 2004 Server Professionals
    Microsoft ISA Server Computer Consultants

    Progentís Microsoft certified consultants provide small and midsize businesses consulting services for Microsoft Forefront TMG and ISA Servers. Microsoft's Forefront TMG and ISA Servers contain a full featured application-layer aware firewall that can secure your IT system from attack by outside and internal threats. Forefront TMG and ISA Server perform deep examination of Internet protocols such as HTTP, which enables these products to detect many threats that can elude ordinary firewalls. The combined firewall and VPN structure of Forefront Threat Management Gateway and ISA Server support stateful filtering and inspection of all VPN streams. ISA Servers are the mainstay of Microsoft's system security initiative, and Progent's Microsoft-certified engineers and CISSP, CISA and CISM certified security professionals can help you strengthen your network security through experienced planning and integration of Forefront TMG and Microsoft ISA Servers. Progent's Microsoft-certified engineers can help your company to deploy Microsoft Forefront TMG 2010, maintain any version of ISA Server, or migrate smoothly from ISA Server environments to Microsoft Forefront TMG.

  • Microsoft SQL Server 2016 Network Management Services Brooklyn New York Brooklyn, New York SQL Server 2019 Technician
  • Network Consultant Windows Server 2012R2 Private Cloud Microsoft Windows Server 2012 R2 Support and Help

  • Wireless Security Scan Consulting
    External Cybersecurity Scan Consultants

    Progent has put together two low-cost service bundles intended to allow small companies to get an objective network security assessment from a certified security engineer. With Progent's External Network Security Inventory Checkup, an engineer administers a comprehensive test of your IT infrastructure from outside your firewalled perimeter to determine potential risks in the security profile you present to the outside world. With Progent's Internal Security Inventory Scan, a certified security professional runs a system scan from an authorized machine inside your firewall to evaluate your exposure to internal threats. The two security inventory packages are configured and run from a protected external site.

  • New York City IT Outsourcing Companies Brooklyn Software Recovery
  • Brooklyn Locky Crypto-Ransomware Restoration
  • Open Now At Home Workforce Brooklyn Consulting Services - VoIP Solutions Guidance Brooklyn, U.S.A. At Home Workers Brooklyn Consulting Services - IP Voice Technology Assistance Brooklyn, United States
  • Operations Manager Help and Support Microsoft System Center Operations Manager IT Consultant
  • Remote Workers Brooklyn Consulting Experts - Help Desk Call Center Augmentation Consulting Experts Brooklyn, United States Telecommuters Consulting near Brooklyn - Help Desk Solutions Consulting Brooklyn, United States
  • SIP Trunk Migration Network Engineer Network Consultant SIP Migration
  • SonicWall NSA 2650 Firewall Security Consultancies Immediate Security Companies SonicWall VPN
  • Telecommuters Brooklyn Consulting Services - Infrastructure Consulting and Support Services Brooklyn Offsite Workforce Brooklyn Consulting Services - Setup Expertise Brooklyn
  • Teleworkers Consulting Experts nearby Brooklyn - Endpoint Management Tools Consulting Experts Brooklyn At Home Workers Consulting and Support Services near me in Brooklyn - Management Tools Expertise Brooklyn
  • Ubuntu Linux, Solaris, UNIX Onsite Technical Support Brooklyn Gentoo Linux, Sun Solaris, UNIX IT Consultants Brooklyn, New York
  • Virtual Call Desk Network Consultant After Hours Help Desk Sharing Specialists
  • Windows 2008 Server Network Consulting Organization Brooklyn Windows 2019 Server Information Technology Outsource Brooklyn

  • Work at Home VoIP Support and Setup
    Telecommuter VoIP Technical Support Services

    Progent can assist small and medium-size companies to deploy IP voice solutions to give their at-home workforce the advantage of virtual extensions of the corporate phone system.


    © 2002-2021 Progent Corporation. All rights reserved.