Ransomware Protection and Removal Solutions Broomfield

Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become an escalating cyberplague that poses an existential danger for organizations unprepared for an assault. Different iterations of crypto-ransomware like the Reveton, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for many years and still inflict havoc. Newer strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus more as yet unnamed malware, not only encrypt on-line data but also infiltrate many available system backups. Data synchronized to cloud environments can also be corrupted. In a vulnerable system, it can make automatic restoration useless and effectively knocks the entire system back to zero.

Getting back online programs and information after a ransomware outage becomes a race against time as the victim tries its best to contain the damage and clear the virus and to restore business-critical activity. Since crypto-ransomware requires time to spread, assaults are usually launched on weekends, when penetrations are likely to take longer to detect. This multiplies the difficulty of promptly mobilizing and organizing a qualified mitigation team.

Progent offers a variety of services for securing Broomfield organizations from ransomware attacks. These include user education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based cyberthreat defense to identify and quarantine day-zero malware attacks. Progent also can provide the assistance of experienced crypto-ransomware recovery engineers with the talent and perseverance to re-deploy a breached environment as quickly as possible.

Progent's Ransomware Restoration Help
Following a ransomware attack, paying the ransom in Bitcoin cryptocurrency does not ensure that distant criminals will provide the needed keys to decrypt any of your information. Kaspersky Labs estimated that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is well above the typical crypto-ransomware demands, which ZDNET determined to be in the range of $13,000 for small organizations. The alternative is to setup from scratch the essential components of your IT environment. Absent the availability of complete data backups, this requires a wide range of IT skills, well-coordinated project management, and the ability to work continuously until the task is finished.

For two decades, Progent has provided professional IT services for businesses throughout the United States and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded top industry certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, and SANS GIAC. (See Progent's certifications). Progent in addition has expertise in financial management and ERP application software. This breadth of expertise provides Progent the skills to rapidly determine important systems and integrate the surviving pieces of your computer network environment after a ransomware event and assemble them into an operational network.

Progent's ransomware team of experts utilizes powerful project management applications to orchestrate the sophisticated recovery process. Progent knows the urgency of working quickly and in concert with a client's management and IT resources to prioritize tasks and to put key systems back on-line as soon as possible.

Client Case Study: A Successful Crypto-Ransomware Virus Recovery
A business sought out Progent after their network was crashed by the Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state cybercriminals, possibly adopting technology leaked from the U.S. NSA organization. Ryuk goes after specific companies with limited room for disruption and is among the most profitable iterations of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in Chicago and has around 500 workers. The Ryuk event had disabled all company operations and manufacturing processes. Most of the client's data protection had been online at the time of the intrusion and were damaged. The client was taking steps for paying the ransom (more than $200,000) and hoping for the best, but ultimately called Progent.

Progent worked with the customer to rapidly identify and assign priority to the mission critical systems that had to be recovered to make it possible to resume company functions:

• Active Directory
• Electronic Mail
• Financials/MRP

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then completed rebuilding and storage recovery on the most important applications. All Microsoft Exchange Server ties and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to find non-encrypted OST files (Microsoft Outlook Offline Data Files) on staff PCs to recover email data. A recent off-line backup of the client's financials/ERP software made them able to recover these vital services back online for users. Although a large amount of work still had to be done to recover totally from the Ryuk event, essential systems were recovered rapidly:

Throughout the next couple of weeks important milestones in the recovery project were made in close cooperation between Progent engineers and the client:

• Internal web applications were restored without losing any data.
• The MailStore Microsoft Exchange Server exceeding 4 million archived emails was brought online and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables/Inventory Control modules were fully functional.
• A new Palo Alto 850 firewall was installed.
• 90% of the desktop computers were functioning as before the incident.

Conclusion
A likely enterprise-killing catastrophe was dodged by dedicated professionals, a broad spectrum of technical expertise, and close teamwork. Although in hindsight the ransomware virus penetration described here should have been disabled with current security systems and NIST Cybersecurity Framework best practices, staff training, and well thought out security procedures for information backup and proper patching controls, the fact is that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware virus, feel confident that Progent's roster of experts has substantial experience in ransomware virus defense, mitigation, and data recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Broomfield
For ransomware system recovery consulting in the Broomfield area, phone Progent at 800-462-8800 or go to Contact Progent.