Ransomware Filtering and Restoration Consulting Broomfield

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level threat for businesses vulnerable to an attack. Versions of ransomware such as CrySIS, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for a long time and continue to inflict harm. More recent strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as more as yet unnamed viruses, not only encrypt online files but also infiltrate most configured system backup. Information synchronized to cloud environments can also be ransomed. In a vulnerable environment, it can render automated restoration hopeless and basically sets the network back to square one.

Getting back online applications and data after a crypto-ransomware outage becomes a sprint against the clock as the victim struggles to stop the spread and clear the ransomware and to resume business-critical operations. Since ransomware needs time to move laterally, attacks are frequently sprung at night, when successful attacks may take more time to recognize. This compounds the difficulty of quickly marshalling and orchestrating an experienced response team.

Progent offers an assortment of support services for protecting Broomfield businesses from ransomware events. Among these are staff training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat protection to detect and extinguish zero-day malware attacks. Progent also provides the services of seasoned ransomware recovery consultants with the track record and commitment to reconstruct a breached environment as urgently as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a ransomware penetration, even paying the ransom demands in Bitcoin cryptocurrency does not guarantee that merciless criminals will respond with the codes to decipher any or all of your files. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their information even after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is significantly above the average ransomware demands, which ZDNET estimated to be approximately $13,000 for smaller organizations. The alternative is to re-install the mission-critical parts of your Information Technology environment. Absent the availability of full information backups, this requires a wide complement of IT skills, well-coordinated team management, and the ability to work continuously until the job is completed.

For decades, Progent has made available professional IT services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned high-level certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, and SANS GIAC. (See Progent's certifications). Progent also has experience in financial management and ERP applications. This breadth of experience provides Progent the ability to quickly identify important systems and re-organize the remaining parts of your computer network system following a ransomware attack and assemble them into a functioning system.

Progent's ransomware team has state-of-the-art project management systems to coordinate the sophisticated recovery process. Progent understands the importance of working quickly and in concert with a customer's management and IT staff to assign priority to tasks and to put essential systems back on line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Attack Recovery
A client engaged Progent after their network system was brought down by the Ryuk ransomware virus. Ryuk is believed to have been deployed by Northern Korean government sponsored cybercriminals, suspected of using algorithms leaked from the U.S. National Security Agency. Ryuk goes after specific organizations with little or no room for operational disruption and is among the most profitable incarnations of ransomware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in the Chicago metro area and has around 500 employees. The Ryuk attack had disabled all essential operations and manufacturing processes. Most of the client's data backups had been directly accessible at the time of the intrusion and were eventually encrypted. The client was evaluating paying the ransom (exceeding $200K) and praying for the best, but ultimately engaged Progent.

Progent worked with the customer to quickly assess and prioritize the mission critical services that needed to be addressed to make it possible to resume business operations:

• Active Directory
• Email
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then completed reinstallations and hard drive recovery of mission critical systems. All Microsoft Exchange Server ties and attributes were usable, which accelerated the restore of Exchange. Progent was able to collect non-encrypted OST data files (Outlook Off-Line Data Files) on user PCs and laptops to recover mail data. A not too old off-line backup of the client's manufacturing software made them able to return these vital programs back online. Although a lot of work was left to recover fully from the Ryuk virus, core services were restored rapidly:

Over the next few weeks important milestones in the recovery project were completed through close collaboration between Progent engineers and the customer:

• Self-hosted web sites were brought back up without losing any information.
• The MailStore Server with over 4 million archived messages was brought online and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory Control functions were completely restored.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the desktops and laptops were functioning as before the incident.

Conclusion
A likely business-killing disaster was avoided by top-tier professionals, a wide array of technical expertise, and close teamwork. Although in hindsight the ransomware incident described here would have been identified and prevented with modern cyber security solutions and recognized best practices, staff education, and well thought out security procedures for information protection and keeping systems up to date with security patches, the reality remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's roster of experts has extensive experience in ransomware virus defense, cleanup, and file disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Broomfield
For ransomware cleanup consulting in the Broomfield area, phone Progent at 800-462-8800 or see Contact Progent.