Ransomware Filtering and Remediation Services Chatsworth

Ransomware : Your Crippling IT Disaster
Ransomware has become an escalating cyber pandemic that represents an enterprise-level danger for businesses vulnerable to an assault. Different iterations of ransomware such as CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for years and continue to cause havoc. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as additional unnamed malware, not only do encryption of online data but also infect most configured system protection mechanisms. Data synched to off-site disaster recovery sites can also be encrypted. In a vulnerable data protection solution, this can render automatic restore operations hopeless and effectively knocks the entire system back to zero.

Retrieving programs and information after a crypto-ransomware outage becomes a race against time as the targeted business fights to stop the spread and remove the virus and to restore enterprise-critical operations. Since ransomware takes time to spread, assaults are usually launched at night, when successful penetrations tend to take longer to recognize. This compounds the difficulty of quickly marshalling and coordinating an experienced response team.

Progent has a variety of support services for protecting Chatsworth enterprises from crypto-ransomware penetrations. Among these are user education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with installation of the latest generation security solutions with artificial intelligence technology to rapidly detect and extinguish zero-day threats. Progent also offers the services of expert ransomware recovery professionals with the track record and commitment to reconstruct a breached network as quickly as possible.

Progent's Ransomware Recovery Help
Soon after a ransomware event, even paying the ransom demands in Bitcoin cryptocurrency does not provide any assurance that cyber hackers will respond with the needed codes to decrypt all your files. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is significantly higher than the usual crypto-ransomware demands, which ZDNET estimated to be in the range of $13,000 for small organizations. The other path is to piece back together the essential parts of your IT environment. Absent the availability of essential data backups, this calls for a wide complement of skill sets, professional team management, and the capability to work 24x7 until the task is finished.

For two decades, Progent has made available certified expert IT services for companies across the US and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, and SANS GIAC. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP applications. This breadth of experience provides Progent the ability to quickly identify critical systems and re-organize the surviving pieces of your computer network system after a ransomware penetration and configure them into an operational system.

Progent's security group uses best of breed project management tools to coordinate the sophisticated recovery process. Progent understands the importance of acting quickly and in concert with a client's management and IT staff to assign priority to tasks and to put critical systems back on-line as fast as humanly possible.

Case Study: A Successful Crypto-Ransomware Incident Recovery
A customer contacted Progent after their network system was penetrated by Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state sponsored hackers, possibly adopting approaches leaked from the United States NSA organization. Ryuk seeks specific companies with little or no tolerance for disruption and is among the most profitable instances of ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in the Chicago metro area and has around 500 employees. The Ryuk event had brought down all business operations and manufacturing processes. Most of the client's data backups had been online at the beginning of the attack and were destroyed. The client was evaluating paying the ransom demand (exceeding $200,000) and praying for the best, but in the end made the decision to use Progent.

Progent worked hand in hand the client to rapidly determine and prioritize the critical services that had to be recovered in order to restart company operations:

• Active Directory
• Electronic Mail
• Financials/MRP

In less than 2 days, Progent was able to restore Active Directory services to its pre-virus state. Progent then helped perform rebuilding and storage recovery of essential applications. All Microsoft Exchange Server schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was also able to assemble intact OST files (Outlook Email Offline Data Files) on various workstations and laptops to recover mail messages. A recent off-line backup of the businesses financials/MRP systems made them able to restore these vital programs back online. Although a large amount of work needed to be completed to recover fully from the Ryuk event, the most important services were returned to operations quickly:

Over the following few weeks important milestones in the restoration project were made through close cooperation between Progent consultants and the client:

• Internal web sites were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server with over four million archived emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were fully functional.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Most of the user desktops and notebooks were being used by staff.

Conclusion
A likely business-killing disaster was dodged by hard-working experts, a broad range of technical expertise, and tight collaboration. Although in analyzing the event afterwards the crypto-ransomware incident detailed here could have been disabled with up-to-date security technology solutions and NIST Cybersecurity Framework best practices, user and IT administrator training, and properly executed security procedures for data protection and proper patching controls, the fact remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are not going away. If you do get hit by a ransomware incursion, feel confident that Progent's team of experts has extensive experience in ransomware virus defense, cleanup, and data restoration.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Chatsworth
For ransomware cleanup consulting in the Chatsworth metro area, phone Progent at 800-462-8800 or visit Contact Progent.