Ransomware Prevention and Cleanup Consulting Midtown Manhattan

Crypto-Ransomware : Your Feared IT Catastrophe
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level danger for businesses of all sizes vulnerable to an assault. Different iterations of ransomware such as CryptoLocker, Fusob, Locky, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to inflict destruction. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with additional as yet unnamed newcomers, not only perform encryption of online critical data but also infiltrate any accessible system backup. Information synched to the cloud can also be ransomed. In a vulnerable system, this can make any restoration useless and effectively sets the entire system back to zero.

Recovering programs and data after a crypto-ransomware event becomes a race against time as the targeted business tries its best to stop lateral movement, remove the virus, and resume business-critical operations. Because crypto-ransomware needs time to replicate across a network, penetrations are often launched at night, when penetrations are likely to take longer to uncover. This multiplies the difficulty of promptly assembling and coordinating a capable response team.

Progent offers a variety of services for protecting Midtown Manhattan enterprises from ransomware events. Among these are team member education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to detect and quarantine zero-day modern malware assaults. Progent in addition provides the services of experienced crypto-ransomware recovery engineers with the track record and perseverance to rebuild a breached system as rapidly as possible.

Progent's Ransomware Restoration Help
After a ransomware invasion, even paying the ransom in cryptocurrency does not ensure that merciless criminals will return the needed keys to decipher any or all of your information. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their files even after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The alternative is to re-install the vital parts of your Information Technology environment. Absent the availability of essential data backups, this calls for a broad range of skills, top notch project management, and the capability to work non-stop until the recovery project is over.

For decades, Progent has made available expert IT services for companies across the United States and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded high-level industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-recognized certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of experience provides Progent the capability to quickly identify critical systems and consolidate the surviving pieces of your computer network environment following a ransomware attack and configure them into an operational system.

Progent's recovery group uses top notch project management systems to coordinate the complex recovery process. Progent understands the importance of acting quickly and in unison with a client's management and IT team members to assign priority to tasks and to put the most important systems back online as fast as humanly possible.

Case Study: A Successful Ransomware Virus Recovery
A customer escalated to Progent after their network system was penetrated by Ryuk crypto-ransomware. Ryuk is believed to have been created by North Korean state sponsored cybercriminals, suspected of adopting algorithms leaked from America's NSA organization. Ryuk goes after specific organizations with limited tolerance for disruption and is one of the most lucrative incarnations of ransomware malware. Headline victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer located in the Chicago metro area and has about 500 employees. The Ryuk event had brought down all business operations and manufacturing capabilities. The majority of the client's data backups had been directly accessible at the beginning of the attack and were damaged. The client was taking steps for paying the ransom (exceeding $200K) and wishfully thinking for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the customer to quickly understand and prioritize the key areas that had to be restored to make it possible to restart departmental functions:

• Microsoft Active Directory
• Exchange Server
• MRP System

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then accomplished rebuilding and storage recovery on the most important servers. All Microsoft Exchange Server data and attributes were usable, which greatly helped the restore of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Email Off-Line Data Files) on staff desktop computers to recover mail data. A recent off-line backup of the businesses accounting/ERP software made them able to return these required services back available to users. Although significant work needed to be completed to recover completely from the Ryuk event, critical services were returned to operations rapidly:

During the following few weeks critical milestones in the restoration project were made in close collaboration between Progent engineers and the client:

• Self-hosted web sites were restored with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million archived emails was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were completely recovered.
• A new Palo Alto 850 firewall was set up.
• 90% of the user workstations were fully operational.

Conclusion
A likely enterprise-killing disaster was avoided through the efforts of hard-working professionals, a broad spectrum of IT skills, and tight teamwork. Although in analyzing the event afterwards the ransomware penetration described here would have been disabled with current security technology solutions and NIST Cybersecurity Framework best practices, team training, and properly executed incident response procedures for data backup and keeping systems up to date with security patches, the fact remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware incursion, feel confident that Progent's team of professionals has a proven track record in ransomware virus blocking, cleanup, and file recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Midtown Manhattan
For ransomware system recovery consulting in the Midtown Manhattan area, phone Progent at 800-462-8800 or go to Contact Progent.