Ransomware Defense and Remediation Expertise Montgomery

Ransomware : Your Crippling IT Disaster
Ransomware has become a modern cyberplague that poses an enterprise-level danger for businesses of all sizes unprepared for an attack. Multiple generations of ransomware like the CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been running rampant for a long time and still inflict destruction. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, plus frequent unnamed malware, not only perform encryption of online files but also infiltrate many accessible system protection mechanisms. Information synchronized to cloud environments can also be ransomed. In a poorly designed environment, it can make any recovery useless and basically knocks the entire system back to square one.

Getting back services and information following a crypto-ransomware outage becomes a race against the clock as the victim struggles to stop lateral movement, eradicate the virus, and resume business-critical activity. Due to the fact that crypto-ransomware needs time to replicate across a network, penetrations are usually sprung during weekends and nights, when penetrations typically take more time to notice. This compounds the difficulty of quickly mobilizing and organizing a qualified mitigation team.

Progent makes available an assortment of support services for protecting Montgomery businesses from crypto-ransomware attacks. Among these are user education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to discover and quarantine day-zero modern malware attacks. Progent also can provide the assistance of experienced ransomware recovery consultants with the track record and commitment to re-deploy a breached system as quickly as possible.

Progent's Ransomware Restoration Services
Soon after a ransomware invasion, sending the ransom in cryptocurrency does not provide any assurance that criminal gangs will respond with the needed codes to decrypt all your data. Kaspersky Labs estimated that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to re-install the vital parts of your Information Technology environment. Without the availability of full data backups, this requires a broad complement of IT skills, professional project management, and the willingness to work continuously until the job is completed.

For two decades, Progent has made available expert Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained high-level industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-recognized certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of experience affords Progent the ability to rapidly identify necessary systems and consolidate the surviving components of your Information Technology system following a ransomware attack and rebuild them into a functioning network.

Progent's recovery team of experts has best of breed project management tools to orchestrate the sophisticated recovery process. Progent appreciates the urgency of acting rapidly and together with a customer's management and IT resources to assign priority to tasks and to put the most important applications back on-line as fast as possible.

Customer Case Study: A Successful Crypto-Ransomware Incident Recovery
A customer hired Progent after their network system was penetrated by the Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state criminal gangs, suspected of using techniques exposed from America's NSA organization. Ryuk goes after specific businesses with little or no ability to sustain operational disruption and is one of the most profitable instances of ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in the Chicago metro area with about 500 workers. The Ryuk event had brought down all business operations and manufacturing processes. Most of the client's information backups had been online at the beginning of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (more than $200,000) and praying for good luck, but in the end engaged Progent.

Progent worked together with the customer to quickly determine and prioritize the most important elements that needed to be restored to make it possible to continue business operations:

• Windows Active Directory
• Microsoft Exchange
• Accounting/MRP

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then initiated rebuilding and storage recovery on essential applications. All Microsoft Exchange Server data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to locate local OST data files (Outlook Email Off-Line Data Files) on staff PCs and laptops to recover mail data. A recent off-line backup of the businesses financials/ERP systems made it possible to restore these required services back online. Although significant work was left to recover fully from the Ryuk damage, essential services were restored quickly:

Over the following month important milestones in the restoration process were accomplished in tight cooperation between Progent team members and the client:

• Internal web applications were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server exceeding 4 million historical emails was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory capabilities were 100% functional.
• A new Palo Alto Networks 850 firewall was installed.
• Ninety percent of the user workstations were operational.

Conclusion
A likely business-killing disaster was dodged by top-tier experts, a broad array of knowledge, and tight collaboration. Although in retrospect the ransomware penetration detailed here would have been identified and blocked with current cyber security solutions and security best practices, team education, and properly executed security procedures for backup and applying software patches, the fact is that government-sponsored cybercriminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a crypto-ransomware incursion, remember that Progent's roster of professionals has substantial experience in crypto-ransomware virus defense, mitigation, and data disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Montgomery
For ransomware recovery consulting services in the Montgomery area, phone Progent at 800-462-8800 or see Contact Progent.