Ransomware Prevention and Remediation Consulting Clearwater

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a modern cyberplague that poses an extinction-level danger for organizations unprepared for an attack. Different versions of ransomware such as Dharma, Fusob, Locky, Syskey and MongoLock cryptoworms have been around for years and still inflict harm. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as additional as yet unnamed viruses, not only encrypt on-line files but also infect all configured system protection mechanisms. Information replicated to off-site disaster recovery sites can also be ransomed. In a poorly architected data protection solution, it can render automatic recovery useless and effectively knocks the datacenter back to square one.

Getting back online services and information following a ransomware event becomes a sprint against the clock as the targeted business struggles to contain and eradicate the ransomware and to restore business-critical activity. Since ransomware takes time to spread, penetrations are frequently launched during weekends and nights, when attacks typically take more time to recognize. This compounds the difficulty of quickly marshalling and orchestrating an experienced mitigation team.

Progent provides a range of solutions for protecting Clearwater enterprises from ransomware events. Among these are team member training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to detect and extinguish zero-day malware assaults. Progent in addition offers the services of experienced crypto-ransomware recovery engineers with the track record and commitment to re-deploy a compromised system as rapidly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a ransomware penetration, even paying the ransom demands in cryptocurrency does not ensure that cyber hackers will respond with the keys to decipher any or all of your files. Kaspersky determined that seventeen percent of ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms frequently range from fifteen to forty BTC ($120,000 and $400,000). This is greatly above the usual ransomware demands, which ZDNET estimated to be approximately $13,000 for smaller businesses. The alternative is to piece back together the key parts of your IT environment. Absent the availability of full information backups, this requires a wide range of skills, professional team management, and the ability to work continuously until the recovery project is done.

For twenty years, Progent has provided expert Information Technology services for companies across the U.S. and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have garnered internationally-renowned industry certifications including CISA, CISSP, CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has expertise in accounting and ERP software solutions. This breadth of expertise gives Progent the capability to rapidly identify important systems and consolidate the surviving pieces of your Information Technology system following a ransomware event and configure them into an operational network.

Progent's security team has powerful project management applications to orchestrate the sophisticated restoration process. Progent appreciates the urgency of acting rapidly and in unison with a client's management and IT staff to prioritize tasks and to get essential services back online as soon as humanly possible.

Client Story: A Successful Ransomware Intrusion Response
A client engaged Progent after their organization was brought down by the Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean government sponsored cybercriminals, suspected of using strategies leaked from the United States National Security Agency. Ryuk goes after specific businesses with limited room for operational disruption and is among the most profitable incarnations of ransomware viruses. Major victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company located in Chicago with around 500 workers. The Ryuk event had brought down all company operations and manufacturing capabilities. Most of the client's backups had been on-line at the beginning of the intrusion and were encrypted. The client was taking steps for paying the ransom (exceeding $200,000) and hoping for good luck, but ultimately made the decision to use Progent.

Progent worked hand in hand the customer to quickly understand and assign priority to the most important systems that needed to be addressed in order to restart business functions:

• Microsoft Active Directory
• Exchange Server
• Accounting/MRP

Within 2 days, Progent was able to restore Active Directory services to its pre-penetration state. Progent then assisted with reinstallations and storage recovery of the most important systems. All Exchange Server schema and configuration information were intact, which accelerated the restore of Exchange. Progent was able to find non-encrypted OST files (Microsoft Outlook Offline Folder Files) on team workstations and laptops to recover email data. A not too old offline backup of the customer's accounting/MRP software made them able to return these required programs back available to users. Although significant work was left to recover fully from the Ryuk attack, critical systems were recovered quickly:

During the next few weeks important milestones in the restoration project were completed through close cooperation between Progent consultants and the customer:

• In-house web sites were brought back up without losing any data.
• The MailStore Server exceeding four million historical messages was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory functions were 100% recovered.
• A new Palo Alto 850 security appliance was deployed.
• Nearly all of the user desktops were being used by staff.

Conclusion
A likely enterprise-killing disaster was averted due to dedicated professionals, a wide range of subject matter expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware virus incident detailed here should have been identified and disabled with advanced security solutions and security best practices, user training, and well designed security procedures for information backup and proper patching controls, the reality is that government-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a ransomware incursion, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, cleanup, and data recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Clearwater
For ransomware system recovery consulting in the Clearwater metro area, call Progent at 800-462-8800 or visit Contact Progent.