Ransomware Prevention and Remediation Consulting Durham

Crypto-Ransomware : Your Worst Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyberplague that presents an extinction-level threat for businesses of all sizes unprepared for an attack. Different iterations of crypto-ransomware like the CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for years and still cause damage. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, along with daily unnamed viruses, not only encrypt online critical data but also infiltrate most configured system protection. Data synched to off-site disaster recovery sites can also be encrypted. In a vulnerable data protection solution, it can make automated restore operations useless and basically knocks the network back to square one.

Getting back on-line services and data after a crypto-ransomware attack becomes a race against time as the targeted organization struggles to stop lateral movement and clear the crypto-ransomware and to restore mission-critical operations. Since ransomware takes time to replicate, penetrations are often launched on weekends and holidays, when penetrations are likely to take more time to identify. This compounds the difficulty of promptly mobilizing and coordinating a qualified mitigation team.

Progent makes available a range of services for securing Durham organizations from crypto-ransomware penetrations. These include team member training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat defense to discover and quarantine zero-day modern malware attacks. Progent in addition offers the services of seasoned crypto-ransomware recovery professionals with the skills and commitment to rebuild a breached environment as soon as possible.

Progent's Crypto-Ransomware Restoration Support Services
Following a ransomware event, paying the ransom demands in Bitcoin cryptocurrency does not guarantee that merciless criminals will return the needed keys to decrypt all your data. Kaspersky estimated that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is significantly above the typical crypto-ransomware demands, which ZDNET determined to be approximately $13,000 for smaller businesses. The alternative is to piece back together the mission-critical components of your IT environment. Absent the availability of essential information backups, this calls for a wide complement of IT skills, top notch project management, and the capability to work continuously until the recovery project is completed.

For twenty years, Progent has made available certified expert IT services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded high-level industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, and GIAC. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of expertise provides Progent the skills to rapidly understand important systems and organize the remaining pieces of your network system after a ransomware attack and rebuild them into an operational system.

Progent's ransomware group uses state-of-the-art project management tools to orchestrate the complex restoration process. Progent understands the urgency of acting rapidly and together with a client's management and IT team members to prioritize tasks and to get the most important applications back on-line as soon as humanly possible.

Client Case Study: A Successful Ransomware Virus Recovery
A business escalated to Progent after their organization was taken over by Ryuk ransomware virus. Ryuk is generally considered to have been launched by Northern Korean state cybercriminals, suspected of adopting algorithms exposed from the United States National Security Agency. Ryuk targets specific companies with limited ability to sustain operational disruption and is among the most lucrative incarnations of ransomware viruses. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in the Chicago metro area with around 500 staff members. The Ryuk penetration had frozen all business operations and manufacturing capabilities. The majority of the client's information backups had been online at the beginning of the attack and were destroyed. The client was actively seeking loans for paying the ransom demand (in excess of $200,000) and praying for the best, but ultimately called Progent.

Progent worked with the customer to rapidly determine and assign priority to the most important systems that had to be addressed in order to restart departmental operations:

• Active Directory (AD)
• Electronic Mail
• Financials/MRP

In less than 48 hours, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then accomplished reinstallations and storage recovery on needed systems. All Microsoft Exchange Server ties and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to collect non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on team workstations and laptops in order to recover email information. A not too old offline backup of the customer's accounting/MRP systems made it possible to restore these required applications back on-line. Although major work needed to be completed to recover totally from the Ryuk event, essential systems were returned to operations rapidly:

During the following few weeks important milestones in the restoration project were accomplished through close cooperation between Progent team members and the client:

• Internal web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than 4 million archived messages was restored to operations and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory capabilities were completely functional.
• A new Palo Alto Networks 850 security appliance was deployed.
• 90% of the desktops and laptops were functioning as before the incident.

Conclusion
A possible company-ending disaster was avoided with top-tier experts, a broad range of knowledge, and close teamwork. Although in hindsight the crypto-ransomware incident described here should have been blocked with up-to-date security technology solutions and best practices, user and IT administrator education, and well thought out security procedures for information backup and applying software patches, the fact remains that government-sponsored hackers from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's roster of experts has proven experience in ransomware virus defense, cleanup, and data restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Durham
For ransomware system recovery expertise in the Durham area, call Progent at 800-462-8800 or go to Contact Progent.