Ransomware Prevention and Cleanup Expertise Broomfield

Ransomware : Your Worst Information Technology Disaster
Ransomware has become a modern cyberplague that presents an extinction-level threat for organizations poorly prepared for an attack. Multiple generations of ransomware such as CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for years and still cause damage. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, as well as additional as yet unnamed malware, not only encrypt online data but also infiltrate many available system backup. Files synched to off-premises disaster recovery sites can also be corrupted. In a poorly architected environment, it can render automatic recovery useless and effectively sets the entire system back to zero.

Restoring programs and data following a ransomware intrusion becomes a race against time as the targeted business fights to stop lateral movement, eradicate the ransomware, and resume mission-critical operations. Because crypto-ransomware requires time to move laterally across a targeted network, penetrations are usually launched on weekends, when penetrations may take more time to discover. This multiplies the difficulty of rapidly mobilizing and organizing a capable mitigation team.

Progent has an assortment of services for securing Broomfield organizations from ransomware attacks. These include staff education to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to detect and disable day-zero modern malware assaults. Progent in addition can provide the services of seasoned ransomware recovery engineers with the track record and commitment to reconstruct a compromised environment as rapidly as possible.

Progent's Crypto-Ransomware Recovery Services
After a ransomware event, sending the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the needed keys to unencrypt any or all of your information. Kaspersky estimated that seventeen percent of crypto-ransomware victims never restored their information after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The other path is to piece back together the mission-critical elements of your Information Technology environment. Absent access to full information backups, this requires a wide complement of IT skills, top notch project management, and the willingness to work non-stop until the recovery project is complete.

For two decades, Progent has made available professional Information Technology services for businesses across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in accounting and ERP application software. This breadth of expertise affords Progent the capability to knowledgably identify important systems and re-organize the surviving parts of your IT system following a ransomware attack and configure them into an operational network.

Progent's recovery team of experts has state-of-the-art project management applications to coordinate the complex restoration process. Progent understands the urgency of working rapidly and together with a client's management and IT staff to assign priority to tasks and to get key applications back on line as fast as humanly possible.

Client Case Study: A Successful Ransomware Penetration Restoration
A client contacted Progent after their company was brought down by Ryuk crypto-ransomware. Ryuk is generally considered to have been launched by North Korean state sponsored criminal gangs, suspected of adopting strategies leaked from America's NSA organization. Ryuk targets specific companies with little room for operational disruption and is one of the most lucrative versions of ransomware malware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company based in Chicago and has around 500 workers. The Ryuk intrusion had disabled all business operations and manufacturing capabilities. Most of the client's backups had been online at the time of the intrusion and were damaged. The client was pursuing financing for paying the ransom demand (exceeding $200K) and hoping for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the customer to rapidly assess and prioritize the key areas that had to be recovered to make it possible to resume company functions:

• Active Directory
• Electronic Messaging
• Accounting/MRP

In less than 48 hours, Progent was able to restore Active Directory services to its pre-penetration state. Progent then charged ahead with setup and hard drive recovery on essential systems. All Microsoft Exchange Server schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to assemble local OST data files (Outlook Offline Folder Files) on various PCs in order to recover mail data. A not too old offline backup of the businesses accounting software made it possible to recover these vital applications back servicing users. Although major work still had to be done to recover completely from the Ryuk attack, essential services were restored quickly:

Over the following couple of weeks key milestones in the restoration process were accomplished through tight cooperation between Progent engineers and the client:

• In-house web sites were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server exceeding 4 million archived messages was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory capabilities were 100 percent recovered.
• A new Palo Alto Networks 850 firewall was brought online.
• Ninety percent of the user PCs were functioning as before the incident.

Conclusion
A potential business extinction disaster was avoided due to dedicated professionals, a broad range of IT skills, and close collaboration. Although in post mortem the ransomware penetration described here should have been identified and disabled with up-to-date security systems and security best practices, user and IT administrator training, and properly executed incident response procedures for information protection and proper patching controls, the reality remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware attack, feel confident that Progent's team of professionals has a proven track record in crypto-ransomware virus defense, removal, and data restoration.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Broomfield
For ransomware cleanup consulting services in the Broomfield area, call Progent at 800-462-8800 or go to Contact Progent.