Ransomware Prevention and Recovery Consulting Springfield

Ransomware : Your Feared IT Nightmare
Crypto-Ransomware has become a modern cyberplague that presents an enterprise-level danger for organizations vulnerable to an attack. Different iterations of crypto-ransomware such as CryptoLocker, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been circulating for a long time and still inflict harm. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with frequent unnamed viruses, not only encrypt on-line data files but also infiltrate any available system backup. Information synched to the cloud can also be ransomed. In a vulnerable environment, this can make automatic restoration hopeless and effectively sets the datacenter back to zero.

Retrieving programs and data following a crypto-ransomware outage becomes a race against time as the targeted business struggles to contain the damage, cleanup the ransomware, and restore enterprise-critical operations. Since ransomware needs time to move laterally throughout a targeted network, attacks are frequently sprung on weekends and holidays, when penetrations typically take longer to discover. This compounds the difficulty of promptly assembling and coordinating a qualified mitigation team.

Progent has an assortment of help services for securing Springfield organizations from ransomware events. Among these are staff training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat protection to detect and extinguish day-zero modern malware attacks. Progent also can provide the assistance of expert ransomware recovery engineers with the talent and perseverance to reconstruct a breached system as quickly as possible.

Progent's Crypto-Ransomware Restoration Help
Following a ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will respond with the needed keys to decrypt all your files. Kaspersky Labs determined that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to setup from scratch the essential elements of your Information Technology environment. Absent the availability of complete data backups, this calls for a wide complement of skill sets, top notch team management, and the willingness to work 24x7 until the job is finished.

For decades, Progent has offered expert IT services for businesses throughout the US and has achieved Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded advanced certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial systems and ERP applications. This breadth of expertise provides Progent the capability to rapidly ascertain critical systems and integrate the remaining pieces of your computer network environment following a ransomware attack and configure them into a functioning network.

Progent's security group utilizes top notch project management tools to orchestrate the complex recovery process. Progent knows the importance of working quickly and in concert with a customer's management and Information Technology team members to prioritize tasks and to put key services back on-line as fast as possible.

Customer Case Study: A Successful Crypto-Ransomware Virus Restoration
A business sought out Progent after their company was brought down by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean government sponsored cybercriminals, possibly adopting algorithms exposed from America's National Security Agency. Ryuk goes after specific organizations with limited ability to sustain disruption and is one of the most profitable instances of ransomware viruses. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business located in the Chicago metro area with about 500 workers. The Ryuk attack had brought down all business operations and manufacturing capabilities. Most of the client's system backups had been online at the start of the attack and were destroyed. The client was evaluating paying the ransom demand (more than $200K) and hoping for the best, but in the end brought in Progent.

Progent worked together with the client to quickly understand and assign priority to the essential areas that needed to be restored in order to resume company functions:

• Microsoft Active Directory
• Electronic Messaging
• Accounting/MRP

In less than 2 days, Progent was able to re-build Active Directory to its pre-attack state. Progent then completed reinstallations and storage recovery on critical applications. All Microsoft Exchange Server ties and configuration information were usable, which greatly helped the restore of Exchange. Progent was also able to find intact OST data files (Outlook Email Off-Line Data Files) on user desktop computers to recover mail information. A recent off-line backup of the businesses financials/MRP software made it possible to recover these essential services back on-line. Although a lot of work still had to be done to recover fully from the Ryuk event, core services were restored quickly:

Throughout the following couple of weeks key milestones in the recovery process were accomplished in tight cooperation between Progent engineers and the customer:

• Self-hosted web applications were returned to operation without losing any information.
• The MailStore Server exceeding 4 million archived messages was restored to operations and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory capabilities were fully recovered.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Nearly all of the desktop computers were back into operation.

Conclusion
A potential enterprise-killing disaster was evaded due to top-tier experts, a wide range of IT skills, and tight teamwork. Although in post mortem the crypto-ransomware virus penetration detailed here should have been prevented with advanced security systems and recognized best practices, staff education, and appropriate incident response procedures for information backup and proper patching controls, the reality is that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has substantial experience in ransomware virus blocking, cleanup, and file disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Springfield
For ransomware system recovery services in the Springfield metro area, call Progent at 800-462-8800 or see Contact Progent.