Ransomware Defense and Restoration Solutions Charleston

Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become an escalating cyberplague that poses an enterprise-level threat for businesses unprepared for an assault. Different iterations of ransomware such as Reveton, WannaCry, Locky, SamSam and MongoLock cryptoworms have been replicating for a long time and still cause destruction. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as more as yet unnamed viruses, not only do encryption of on-line information but also infect all accessible system backups. Files synchronized to off-site disaster recovery sites can also be encrypted. In a poorly designed system, this can render automatic restore operations impossible and basically sets the network back to square one.

Recovering services and data after a ransomware event becomes a race against the clock as the victim tries its best to stop lateral movement and eradicate the crypto-ransomware and to resume mission-critical operations. Due to the fact that ransomware requires time to replicate, penetrations are frequently launched on weekends and holidays, when successful attacks are likely to take longer to uncover. This compounds the difficulty of promptly mobilizing and coordinating a capable mitigation team.

Progent offers an assortment of help services for protecting Charleston enterprises from ransomware events. These include team member training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of next-generation security appliances with AI capabilities to automatically detect and disable day-zero cyber threats. Progent in addition offers the assistance of expert ransomware recovery professionals with the skills and commitment to re-deploy a breached network as soon as possible.

Progent's Ransomware Recovery Support Services
After a ransomware event, sending the ransom in cryptocurrency does not ensure that cyber hackers will respond with the needed keys to unencrypt any or all of your information. Kaspersky estimated that 17% of ransomware victims never restored their information after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is greatly above the average crypto-ransomware demands, which ZDNET determined to be around $13,000 for small organizations. The fallback is to setup from scratch the key elements of your Information Technology environment. Absent access to complete data backups, this calls for a broad range of skill sets, top notch team management, and the capability to work 24x7 until the recovery project is done.

For decades, Progent has provided expert IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have earned advanced industry certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, and GIAC. (See Progent's certifications). Progent also has expertise in financial management and ERP applications. This breadth of experience affords Progent the capability to quickly identify important systems and re-organize the surviving pieces of your computer network environment after a ransomware penetration and configure them into an operational system.

Progent's recovery team has state-of-the-art project management applications to orchestrate the sophisticated restoration process. Progent knows the urgency of working swiftly and together with a client's management and IT staff to assign priority to tasks and to get the most important systems back on line as soon as possible.

Customer Story: A Successful Ransomware Intrusion Response
A small business escalated to Progent after their network was taken over by the Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored criminal gangs, suspected of using algorithms exposed from the U.S. NSA organization. Ryuk targets specific companies with little or no tolerance for disruption and is among the most lucrative incarnations of ransomware viruses. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in the Chicago metro area with around 500 employees. The Ryuk penetration had disabled all company operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the time of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (more than $200,000) and praying for good luck, but ultimately brought in Progent.

Progent worked with the client to quickly get our arms around and assign priority to the essential systems that had to be addressed to make it possible to continue business functions:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

In less than two days, Progent was able to rebuild Active Directory to its pre-attack state. Progent then assisted with reinstallations and hard drive recovery on critical servers. All Exchange schema and attributes were intact, which accelerated the restore of Exchange. Progent was able to collect intact OST files (Outlook Email Offline Data Files) on team desktop computers and laptops in order to recover email information. A not too old offline backup of the businesses accounting software made it possible to return these essential services back servicing users. Although a large amount of work needed to be completed to recover completely from the Ryuk event, the most important services were returned to operations quickly:

During the following few weeks important milestones in the restoration project were accomplished in close cooperation between Progent engineers and the customer:

• Internal web sites were returned to operation without losing any data.
• The MailStore Server containing more than 4 million archived messages was brought online and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/AR/Inventory functions were 100 percent functional.
• A new Palo Alto 850 security appliance was brought on-line.
• 90% of the desktop computers were back into operation.

Conclusion
A likely business catastrophe was dodged due to top-tier experts, a wide range of IT skills, and close teamwork. Although in hindsight the ransomware virus incident detailed here should have been identified and disabled with up-to-date security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and properly executed incident response procedures for data backup and keeping systems up to date with security patches, the fact remains that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware incident, remember that Progent's team of professionals has substantial experience in ransomware virus blocking, mitigation, and information systems restoration.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

File body_ransomware_recovery_contact_city.asp does not exist