Ransomware Filtering and Remediation Services Porto Alegre

Ransomware : Your Feared IT Disaster
Ransomware has become an escalating cyber pandemic that poses an enterprise-level danger for businesses poorly prepared for an attack. Versions of ransomware such as CryptoLocker, WannaCry, Locky, SamSam and MongoLock cryptoworms have been replicating for years and continue to cause destruction. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, plus daily unnamed malware, not only encrypt on-line data files but also infiltrate many accessible system restores and backups. Information replicated to the cloud can also be ransomed. In a poorly designed environment, it can render any restore operations impossible and basically knocks the entire system back to square one.

Retrieving applications and information following a ransomware outage becomes a race against the clock as the targeted business tries its best to contain the damage and cleanup the ransomware and to restore enterprise-critical operations. Since ransomware takes time to spread, penetrations are frequently sprung on weekends, when attacks are likely to take longer to detect. This multiplies the difficulty of rapidly mobilizing and orchestrating a capable mitigation team.

Progent provides a variety of solutions for securing Porto Alegre organizations from ransomware attacks. These include team training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to detect and quarantine zero-day malware attacks. Progent in addition provides the services of expert ransomware recovery consultants with the track record and commitment to restore a compromised system as rapidly as possible.

Progent's Ransomware Restoration Services
Soon after a ransomware event, sending the ransom demands in Bitcoin cryptocurrency does not provide any assurance that merciless criminals will return the keys to unencrypt any or all of your information. Kaspersky ascertained that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is well above the usual ransomware demands, which ZDNET determined to be in the range of $13,000 for small businesses. The other path is to piece back together the vital components of your IT environment. Without access to essential system backups, this requires a broad range of skills, top notch project management, and the ability to work continuously until the job is complete.

For decades, Progent has made available professional Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned top certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, and SANS GIAC. (See Progent's certifications). Progent in addition has expertise with financial management and ERP applications. This breadth of experience provides Progent the capability to rapidly understand critical systems and re-organize the surviving parts of your IT environment following a ransomware event and assemble them into an operational system.

Progent's ransomware team utilizes powerful project management tools to orchestrate the sophisticated restoration process. Progent appreciates the importance of acting swiftly and in unison with a customer's management and IT team members to prioritize tasks and to get essential systems back online as fast as humanly possible.

Customer Story: A Successful Ransomware Virus Recovery
A customer hired Progent after their network was brought down by Ryuk ransomware. Ryuk is believed to have been created by North Korean state sponsored hackers, possibly adopting algorithms exposed from the U.S. NSA organization. Ryuk targets specific businesses with little tolerance for operational disruption and is among the most profitable incarnations of ransomware viruses. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in Chicago with about 500 employees. The Ryuk attack had brought down all essential operations and manufacturing capabilities. The majority of the client's system backups had been on-line at the beginning of the attack and were destroyed. The client considered paying the ransom demand (exceeding $200,000) and praying for the best, but in the end brought in Progent.

Progent worked together with the customer to rapidly identify and prioritize the critical areas that had to be restored to make it possible to resume business operations:

• Active Directory
• Electronic Messaging
• Financials/MRP

Within 48 hours, Progent was able to restore Active Directory to its pre-attack state. Progent then helped perform rebuilding and hard drive recovery on critical servers. All Exchange Server schema and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to collect intact OST files (Outlook Email Off-Line Data Files) on user workstations to recover email messages. A recent off-line backup of the customer's financials/ERP systems made it possible to recover these required services back on-line. Although major work needed to be completed to recover fully from the Ryuk attack, critical services were restored quickly:

During the next month important milestones in the recovery project were completed through tight cooperation between Progent engineers and the client:

• Internal web applications were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server exceeding 4 million archived emails was brought online and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory functions were completely recovered.
• A new Palo Alto 850 security appliance was brought on-line.
• 90% of the desktop computers were fully operational.

Conclusion
A likely company-ending catastrophe was evaded with dedicated experts, a wide array of subject matter expertise, and close teamwork. Although in retrospect the ransomware virus penetration detailed here would have been identified and disabled with up-to-date cyber security solutions and best practices, team training, and properly executed security procedures for information protection and applying software patches, the reality remains that government-sponsored hackers from China, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware penetration, remember that Progent's team of experts has substantial experience in ransomware virus blocking, removal, and file disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Porto Alegre
For ransomware recovery consulting in the Porto Alegre metro area, call Progent at 800-462-8800 or visit Contact Progent.