Ransomware Protection and Removal Consulting Montgomery

Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that represents an enterprise-level threat for organizations poorly prepared for an assault. Versions of ransomware such as CryptoLocker, Fusob, Locky, SamSam and MongoLock cryptoworms have been running rampant for years and continue to cause havoc. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, as well as daily as yet unnamed viruses, not only do encryption of online information but also infiltrate all available system backup. Data synchronized to cloud environments can also be rendered useless. In a poorly architected environment, this can make automated recovery hopeless and effectively knocks the network back to square one.

Retrieving programs and information after a crypto-ransomware attack becomes a race against the clock as the victim fights to contain and clear the ransomware and to resume mission-critical operations. Because crypto-ransomware needs time to spread, penetrations are frequently sprung during nights and weekends, when successful penetrations are likely to take more time to identify. This multiplies the difficulty of rapidly marshalling and orchestrating an experienced mitigation team.

Progent offers an assortment of help services for protecting Montgomery organizations from crypto-ransomware events. These include team training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat defense to discover and extinguish zero-day malware attacks. Progent in addition provides the assistance of experienced crypto-ransomware recovery professionals with the skills and perseverance to re-deploy a breached system as rapidly as possible.

Progent's Ransomware Restoration Support Services
Following a ransomware event, paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will return the needed keys to unencrypt all your information. Kaspersky ascertained that seventeen percent of ransomware victims never restored their information after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is well above the typical crypto-ransomware demands, which ZDNET estimated to be in the range of $13,000 for smaller businesses. The alternative is to re-install the critical parts of your Information Technology environment. Absent access to complete system backups, this requires a broad complement of IT skills, well-coordinated project management, and the capability to work 24x7 until the task is completed.

For two decades, Progent has made available certified expert Information Technology services for businesses throughout the US and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISM, CISSP, CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP applications. This breadth of experience gives Progent the skills to rapidly understand necessary systems and consolidate the surviving parts of your network system after a ransomware penetration and configure them into an operational system.

Progent's security team of experts utilizes state-of-the-art project management tools to orchestrate the sophisticated recovery process. Progent knows the urgency of working swiftly and in concert with a customer's management and Information Technology resources to prioritize tasks and to put the most important services back on-line as soon as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Attack Restoration
A business contacted Progent after their network was brought down by the Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state sponsored criminal gangs, suspected of adopting techniques exposed from the U.S. National Security Agency. Ryuk targets specific companies with little or no ability to sustain operational disruption and is among the most profitable iterations of ransomware viruses. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company based in Chicago with around 500 workers. The Ryuk penetration had paralyzed all business operations and manufacturing capabilities. Most of the client's information backups had been directly accessible at the start of the intrusion and were eventually encrypted. The client considered paying the ransom demand (more than two hundred thousand dollars) and hoping for the best, but in the end utilized Progent.

Progent worked with the client to quickly get our arms around and prioritize the key areas that needed to be recovered in order to continue departmental functions:

• Active Directory (AD)
• Electronic Messaging
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to recover Active Directory services to its pre-attack state. Progent then initiated reinstallations and hard drive recovery on essential applications. All Exchange Server ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to find intact OST data files (Outlook Email Offline Data Files) on various desktop computers and laptops to recover email data. A recent offline backup of the businesses accounting/MRP software made it possible to restore these essential applications back online for users. Although a lot of work still had to be done to recover completely from the Ryuk attack, the most important systems were restored rapidly:

During the next few weeks critical milestones in the restoration process were completed through tight cooperation between Progent team members and the client:

• Self-hosted web applications were brought back up without losing any data.
• The MailStore Microsoft Exchange Server containing more than four million archived messages was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control capabilities were 100% restored.
• A new Palo Alto 850 firewall was deployed.
• Nearly all of the user desktops and notebooks were being used by staff.

Conclusion
A likely enterprise-killing catastrophe was averted due to hard-working professionals, a wide spectrum of IT skills, and tight collaboration. Although in hindsight the ransomware virus incident described here should have been disabled with current cyber security technology solutions and security best practices, team training, and well thought out security procedures for data protection and applying software patches, the fact remains that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware incident, remember that Progent's roster of experts has proven experience in ransomware virus defense, cleanup, and data recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Montgomery
For ransomware system recovery consulting services in the Montgomery area, call Progent at 800-462-8800 or see Contact Progent.