Ransomware Filtering and Recovery Expertise Charleston

Ransomware : Your Feared IT Nightmare
Ransomware has become a modern cyber pandemic that presents an enterprise-level danger for businesses vulnerable to an assault. Multiple generations of crypto-ransomware such as CrySIS, WannaCry, Locky, Syskey and MongoLock cryptoworms have been out in the wild for years and still inflict havoc. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, along with daily as yet unnamed viruses, not only encrypt on-line data but also infiltrate most configured system protection mechanisms. Files synched to off-premises disaster recovery sites can also be encrypted. In a vulnerable environment, this can make automatic recovery impossible and basically knocks the entire system back to zero.

Restoring programs and information after a ransomware intrusion becomes a sprint against the clock as the victim tries its best to contain, remove the crypto-ransomware, and restore enterprise-critical activity. Due to the fact that crypto-ransomware needs time to replicate throughout a network, assaults are often sprung during weekends and nights, when successful penetrations may take more time to uncover. This compounds the difficulty of promptly marshalling and organizing an experienced response team.

Progent has an assortment of help services for protecting Charleston businesses from ransomware attacks. Among these are staff education to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based threat protection to detect and suppress zero-day malware assaults. Progent also provides the assistance of expert ransomware recovery professionals with the skills and commitment to re-deploy a breached environment as soon as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware event, paying the ransom demands in cryptocurrency does not guarantee that merciless criminals will return the codes to decrypt any of your data. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The fallback is to setup from scratch the critical parts of your Information Technology environment. Absent access to essential system backups, this calls for a wide complement of IT skills, professional team management, and the ability to work non-stop until the task is finished.

For decades, Progent has offered professional Information Technology services for companies across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned top industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP applications. This breadth of experience affords Progent the capability to knowledgably understand necessary systems and integrate the remaining pieces of your Information Technology system following a ransomware penetration and rebuild them into a functioning system.

Progent's recovery group uses powerful project management systems to orchestrate the complex recovery process. Progent understands the importance of working rapidly and in unison with a client's management and IT staff to prioritize tasks and to get key services back on line as fast as possible.

Customer Case Study: A Successful Ransomware Penetration Recovery
A customer sought out Progent after their network was attacked by Ryuk ransomware. Ryuk is thought to have been launched by North Korean government sponsored cybercriminals, possibly adopting strategies exposed from the U.S. National Security Agency. Ryuk targets specific businesses with little room for disruption and is among the most profitable incarnations of ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in Chicago with about 500 employees. The Ryuk intrusion had brought down all business operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the time of the intrusion and were encrypted. The client was evaluating paying the ransom demand (exceeding $200K) and wishfully thinking for good luck, but in the end made the decision to use Progent.

Progent worked hand in hand the customer to quickly identify and prioritize the most important elements that needed to be restored in order to continue business functions:

• Windows Active Directory
• Electronic Mail
• Accounting/MRP

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then completed rebuilding and storage recovery of key applications. All Exchange schema and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Email Off-Line Folder Files) on team PCs and laptops in order to recover email information. A not too old offline backup of the customer's financials/ERP systems made them able to recover these vital applications back available to users. Although major work needed to be completed to recover completely from the Ryuk damage, core systems were restored rapidly:

During the following month key milestones in the recovery process were made in tight cooperation between Progent engineers and the customer:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Server containing more than 4 million archived messages was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory Control functions were fully restored.
• A new Palo Alto 850 firewall was brought online.
• 90% of the user workstations were being used by staff.

Conclusion
A likely company-ending catastrophe was averted due to dedicated professionals, a broad spectrum of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the crypto-ransomware attack described here could have been identified and stopped with modern security technology solutions and ISO/IEC 27001 best practices, user and IT administrator training, and properly executed incident response procedures for data protection and proper patching controls, the reality is that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are not going away. If you do fall victim to a ransomware virus, feel confident that Progent's team of professionals has substantial experience in ransomware virus blocking, remediation, and file disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Charleston
For ransomware cleanup consulting in the Charleston area, call Progent at 800-462-8800 or visit Contact Progent.