Ransomware Prevention and Removal Solutions Chesapeake

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that presents an enterprise-level threat for businesses poorly prepared for an assault. Versions of crypto-ransomware like the CryptoLocker, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been around for years and continue to inflict harm. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with frequent as yet unnamed malware, not only do encryption of on-line critical data but also infect all accessible system protection mechanisms. Data synchronized to cloud environments can also be ransomed. In a vulnerable data protection solution, this can render automatic restoration hopeless and basically knocks the network back to zero.

Getting back online programs and data following a ransomware outage becomes a sprint against the clock as the targeted business struggles to contain and remove the ransomware and to resume enterprise-critical activity. Because ransomware takes time to replicate, attacks are often sprung on weekends, when successful attacks may take longer to notice. This compounds the difficulty of rapidly mobilizing and organizing an experienced response team.

Progent provides a range of solutions for securing Chesapeake businesses from crypto-ransomware events. Among these are user education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to detect and extinguish zero-day modern malware assaults. Progent in addition offers the services of seasoned ransomware recovery engineers with the talent and commitment to rebuild a breached system as quickly as possible.

Progent's Ransomware Recovery Help
Subsequent to a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not guarantee that merciless criminals will respond with the codes to unencrypt any or all of your information. Kaspersky determined that seventeen percent of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is well above the average ransomware demands, which ZDNET determined to be in the range of $13,000 for smaller businesses. The alternative is to piece back together the key parts of your Information Technology environment. Without access to full data backups, this calls for a broad complement of IT skills, well-coordinated project management, and the willingness to work non-stop until the task is done.

For twenty years, Progent has offered professional IT services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, and SANS GIAC. (See Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of experience gives Progent the skills to rapidly determine critical systems and consolidate the remaining components of your computer network system after a ransomware event and configure them into an operational system.

Progent's recovery group uses top notch project management applications to coordinate the sophisticated recovery process. Progent appreciates the urgency of working quickly and together with a client's management and IT team members to prioritize tasks and to put critical services back on line as soon as humanly possible.

Case Study: A Successful Ransomware Intrusion Response
A business engaged Progent after their network was taken over by the Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by Northern Korean government sponsored hackers, suspected of using algorithms exposed from the United States National Security Agency. Ryuk attacks specific organizations with little room for operational disruption and is among the most lucrative versions of ransomware viruses. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in Chicago with around 500 workers. The Ryuk penetration had brought down all essential operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the beginning of the intrusion and were damaged. The client was evaluating paying the ransom demand (more than $200,000) and hoping for the best, but ultimately brought in Progent.

Progent worked hand in hand the customer to rapidly get our arms around and assign priority to the mission critical services that needed to be restored in order to resume departmental operations:

• Active Directory (AD)
• Microsoft Exchange
• Financials/MRP

In less than 2 days, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then completed reinstallations and hard drive recovery of the most important systems. All Microsoft Exchange Server data and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to locate non-encrypted OST files (Microsoft Outlook Off-Line Folder Files) on staff desktop computers to recover email data. A not too old off-line backup of the customer's financials/MRP systems made it possible to recover these vital programs back online. Although major work still had to be done to recover fully from the Ryuk damage, critical services were recovered quickly:

During the next couple of weeks critical milestones in the restoration process were accomplished in tight cooperation between Progent consultants and the customer:

• Internal web applications were restored without losing any data.
• The MailStore Microsoft Exchange Server exceeding 4 million historical emails was spun up and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory capabilities were completely recovered.
• A new Palo Alto 850 firewall was installed.
• Nearly all of the user workstations were functioning as before the incident.

Conclusion
A probable business catastrophe was evaded by top-tier experts, a wide range of technical expertise, and tight collaboration. Although upon completion of forensics the ransomware virus attack detailed here would have been shut down with modern security systems and security best practices, team training, and well thought out incident response procedures for information backup and applying software patches, the reality is that government-sponsored hackers from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, removal, and data restoration.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Chesapeake
For ransomware cleanup consulting services in the Chesapeake metro area, phone Progent at 800-462-8800 or go to Contact Progent.