Ransomware Filtering and Remediation Services Cabo Frio

Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware has become a modern cyber pandemic that represents an enterprise-level danger for organizations unprepared for an assault. Different iterations of ransomware such as CryptoLocker, Fusob, Locky, Syskey and MongoLock cryptoworms have been out in the wild for years and continue to inflict harm. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as more as yet unnamed malware, not only do encryption of on-line files but also infiltrate all available system protection. Data replicated to cloud environments can also be encrypted. In a poorly designed system, this can make automated restore operations useless and effectively knocks the network back to square one.

Getting back applications and data after a ransomware outage becomes a sprint against time as the victim tries its best to stop lateral movement and cleanup the ransomware and to resume mission-critical activity. Since crypto-ransomware requires time to replicate, assaults are frequently sprung during nights and weekends, when penetrations may take more time to recognize. This compounds the difficulty of quickly mobilizing and organizing a capable response team.

Progent has a variety of solutions for securing Cabo Frio enterprises from crypto-ransomware penetrations. These include team member education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based threat protection to identify and suppress day-zero modern malware assaults. Progent in addition offers the assistance of veteran ransomware recovery consultants with the talent and commitment to rebuild a breached network as soon as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a crypto-ransomware event, sending the ransom in Bitcoin cryptocurrency does not ensure that merciless criminals will provide the needed codes to decrypt all your data. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their information after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is significantly higher than the typical crypto-ransomware demands, which ZDNET determined to be around $13,000 for smaller organizations. The other path is to piece back together the key parts of your IT environment. Absent access to essential system backups, this requires a broad range of skill sets, top notch team management, and the ability to work non-stop until the recovery project is complete.

For decades, Progent has offered professional IT services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have attained advanced industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-recognized certifications including CISM, CISSP, CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of expertise gives Progent the ability to rapidly determine critical systems and re-organize the remaining pieces of your network environment following a ransomware attack and assemble them into a functioning system.

Progent's ransomware team deploys top notch project management systems to orchestrate the sophisticated restoration process. Progent understands the urgency of acting quickly and together with a customer's management and IT team members to assign priority to tasks and to get critical applications back on line as fast as possible.

Case Study: A Successful Ransomware Virus Response
A client engaged Progent after their organization was taken over by the Ryuk ransomware virus. Ryuk is thought to have been created by Northern Korean state sponsored hackers, possibly adopting strategies leaked from the U.S. National Security Agency. Ryuk goes after specific businesses with little or no room for disruption and is one of the most profitable examples of ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing company based in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing processes. Most of the client's information backups had been online at the beginning of the attack and were damaged. The client was evaluating paying the ransom demand (exceeding $200,000) and hoping for the best, but ultimately brought in Progent.

Progent worked hand in hand the customer to quickly get our arms around and prioritize the mission critical services that had to be restored in order to continue departmental functions:

• Microsoft Active Directory
• Electronic Mail
• Financials/MRP

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then accomplished setup and storage recovery of critical servers. All Microsoft Exchange Server ties and attributes were intact, which greatly helped the restore of Exchange. Progent was able to assemble local OST data files (Outlook Email Off-Line Folder Files) on team PCs and laptops in order to recover mail data. A recent off-line backup of the client's financials/ERP software made it possible to restore these required applications back available to users. Although a large amount of work still had to be done to recover totally from the Ryuk virus, essential services were restored quickly:

Over the following few weeks critical milestones in the restoration process were made through close cooperation between Progent consultants and the customer:

• Internal web applications were restored with no loss of data.
• The MailStore Server containing more than four million historical emails was spun up and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control functions were 100 percent restored.
• A new Palo Alto Networks 850 firewall was brought online.
• Ninety percent of the user PCs were back into operation.

Conclusion
A likely business-ending catastrophe was evaded due to results-oriented experts, a wide range of knowledge, and tight collaboration. Although in post mortem the crypto-ransomware penetration described here should have been shut down with current cyber security solutions and NIST Cybersecurity Framework best practices, staff training, and well designed security procedures for data backup and applying software patches, the reality remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware incident, feel confident that Progent's roster of professionals has proven experience in crypto-ransomware virus blocking, cleanup, and file restoration.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Cabo Frio
For ransomware recovery consulting services in the Cabo Frio metro area, phone Progent at 800-462-8800 or go to Contact Progent.