Ransomware Filtering and Cleanup Services Chesapeake

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a modern cyber pandemic that represents an extinction-level threat for businesses of all sizes vulnerable to an attack. Different versions of ransomware such as CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for many years and still inflict destruction. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with additional as yet unnamed viruses, not only encrypt online files but also infect most available system backups. Files replicated to off-premises disaster recovery sites can also be encrypted. In a poorly designed system, it can make any restoration impossible and basically knocks the datacenter back to zero.

Restoring services and information following a ransomware intrusion becomes a sprint against time as the targeted business fights to contain the damage, eradicate the virus, and resume business-critical activity. Due to the fact that crypto-ransomware needs time to replicate across a network, assaults are frequently launched at night, when penetrations tend to take longer to recognize. This multiplies the difficulty of promptly marshalling and organizing an experienced mitigation team.

Progent makes available an assortment of support services for protecting Chesapeake businesses from ransomware events. Among these are user training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based threat protection to detect and disable day-zero malware assaults. Progent in addition can provide the services of expert ransomware recovery consultants with the skills and perseverance to restore a compromised network as quickly as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware event, paying the ransom in cryptocurrency does not guarantee that cyber criminals will return the codes to decipher any or all of your files. Kaspersky estimated that seventeen percent of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to setup from scratch the vital elements of your IT environment. Absent access to essential system backups, this requires a broad range of skills, well-coordinated project management, and the capability to work continuously until the task is complete.

For decades, Progent has made available professional IT services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained advanced certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial management and ERP application software. This breadth of expertise gives Progent the ability to rapidly identify critical systems and consolidate the surviving pieces of your computer network system after a ransomware penetration and assemble them into a functioning network.

Progent's recovery team utilizes best of breed project management tools to orchestrate the complex restoration process. Progent understands the importance of working swiftly and in concert with a customer's management and IT resources to prioritize tasks and to put essential systems back on-line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Attack Response
A business hired Progent after their organization was crashed by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean state criminal gangs, suspected of using technology exposed from the U.S. NSA organization. Ryuk targets specific organizations with little ability to sustain disruption and is one of the most profitable versions of crypto-ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer located in the Chicago metro area with around 500 workers. The Ryuk penetration had shut down all essential operations and manufacturing processes. Most of the client's information backups had been on-line at the start of the attack and were eventually encrypted. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but ultimately called Progent.

Progent worked hand in hand the client to quickly identify and prioritize the essential elements that needed to be addressed to make it possible to restart company operations:

• Microsoft Active Directory
• E-Mail
• MRP System

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then accomplished rebuilding and storage recovery on essential servers. All Exchange schema and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to assemble local OST files (Outlook Email Off-Line Data Files) on user desktop computers to recover mail data. A not too old offline backup of the businesses accounting/MRP systems made it possible to return these vital services back on-line. Although significant work remained to recover fully from the Ryuk event, essential systems were returned to operations quickly:

Over the following few weeks critical milestones in the recovery process were accomplished in close collaboration between Progent consultants and the client:

• Self-hosted web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than 4 million archived messages was restored to operations and available for users.
• CRM/Customer Orders/Invoicing/AP/AR/Inventory modules were completely functional.
• A new Palo Alto 850 security appliance was set up and programmed.
• Most of the desktops and laptops were operational.

Conclusion
A possible business-ending disaster was averted due to results-oriented experts, a wide array of IT skills, and close collaboration. Although in retrospect the ransomware incident detailed here could have been prevented with current security systems and ISO/IEC 27001 best practices, team training, and well thought out security procedures for information backup and keeping systems up to date with security patches, the fact remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware virus, remember that Progent's team of professionals has extensive experience in crypto-ransomware virus defense, remediation, and information systems disaster recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Chesapeake
For ransomware cleanup services in the Chesapeake area, call Progent at 800-462-8800 or visit Contact Progent.