Ransomware Filtering and Recovery Expertise Orlando

Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level danger for businesses poorly prepared for an attack. Versions of ransomware such as CryptoLocker, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for a long time and still cause destruction. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, along with frequent unnamed newcomers, not only encrypt on-line information but also infiltrate any accessible system protection. Data synchronized to cloud environments can also be rendered useless. In a poorly architected environment, it can make automatic restoration useless and effectively knocks the entire system back to zero.

Getting back applications and information after a crypto-ransomware outage becomes a sprint against the clock as the victim struggles to contain the damage and eradicate the ransomware and to restore mission-critical activity. Since ransomware needs time to replicate, attacks are usually launched at night, when penetrations in many cases take more time to notice. This compounds the difficulty of rapidly marshalling and coordinating an experienced response team.

Progent makes available an assortment of services for securing Orlando businesses from ransomware attacks. These include staff training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat defense to identify and disable zero-day malware attacks. Progent also provides the services of seasoned crypto-ransomware recovery consultants with the talent and perseverance to reconstruct a compromised environment as quickly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Subsequent to a ransomware attack, sending the ransom demands in cryptocurrency does not guarantee that cyber hackers will return the codes to decrypt all your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their data even after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is well higher than the typical crypto-ransomware demands, which ZDNET determined to be around $13,000 for smaller businesses. The alternative is to piece back together the mission-critical parts of your Information Technology environment. Absent access to complete information backups, this requires a broad range of skill sets, top notch project management, and the willingness to work continuously until the recovery project is over.

For two decades, Progent has made available professional Information Technology services for companies throughout the US and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded advanced industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, and SANS GIAC. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of expertise affords Progent the ability to efficiently identify necessary systems and organize the surviving components of your Information Technology system following a crypto-ransomware penetration and assemble them into an operational system.

Progent's recovery team of experts has best of breed project management applications to orchestrate the sophisticated recovery process. Progent appreciates the urgency of acting swiftly and in concert with a client's management and IT staff to prioritize tasks and to put essential systems back online as soon as possible.

Customer Story: A Successful Crypto-Ransomware Incident Response
A client engaged Progent after their network was attacked by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state sponsored cybercriminals, possibly adopting algorithms exposed from America's National Security Agency. Ryuk seeks specific companies with limited tolerance for disruption and is among the most profitable iterations of ransomware viruses. Major victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in the Chicago metro area and has around 500 staff members. The Ryuk attack had frozen all business operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the start of the intrusion and were eventually encrypted. The client considered paying the ransom demand (in excess of $200,000) and hoping for good luck, but in the end called Progent.

Progent worked together with the customer to rapidly get our arms around and assign priority to the essential systems that had to be recovered in order to resume company functions:

• Active Directory
• Electronic Mail
• Financials/MRP

Within two days, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then initiated setup and storage recovery on needed servers. All Microsoft Exchange Server data and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to assemble non-encrypted OST data files (Microsoft Outlook Off-Line Folder Files) on user PCs and laptops in order to recover email messages. A not too old off-line backup of the customer's accounting/ERP software made them able to return these vital applications back available to users. Although a lot of work remained to recover totally from the Ryuk damage, core systems were restored quickly:

During the following couple of weeks important milestones in the recovery process were completed through close collaboration between Progent team members and the customer:

• Self-hosted web applications were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/AP/Accounts Receivables/Inventory Control functions were 100% operational.
• A new Palo Alto 850 security appliance was installed.
• Ninety percent of the user desktops and notebooks were functioning as before the incident.

Conclusion
A potential business catastrophe was evaded through the efforts of hard-working professionals, a wide array of technical expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware penetration described here should have been shut down with current security technology solutions and best practices, user and IT administrator education, and appropriate security procedures for data backup and proper patching controls, the reality remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's team of professionals has proven experience in crypto-ransomware virus blocking, removal, and data restoration.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Orlando
For ransomware system recovery consulting services in the Orlando area, phone Progent at 800-462-8800 or go to Contact Progent.