Ransomware Filtering and Restoration Solutions Tucson

Ransomware : Your Worst IT Disaster
Ransomware has become a too-frequent cyber pandemic that represents an existential danger for businesses poorly prepared for an attack. Multiple generations of crypto-ransomware like the CrySIS, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for years and continue to cause havoc. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as daily unnamed viruses, not only do encryption of on-line critical data but also infiltrate any available system backup. Data replicated to the cloud can also be encrypted. In a vulnerable system, it can make automatic restoration useless and effectively sets the datacenter back to zero.

Getting back services and data after a ransomware event becomes a race against the clock as the targeted business fights to contain and eradicate the ransomware and to resume business-critical operations. Because ransomware needs time to move laterally, penetrations are frequently sprung during weekends and nights, when attacks typically take longer to recognize. This compounds the difficulty of rapidly mobilizing and orchestrating a knowledgeable response team.

Progent provides a variety of support services for securing Tucson organizations from ransomware attacks. These include staff training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus installation of next-generation security solutions with AI technology to quickly identify and disable zero-day threats. Progent in addition can provide the services of veteran ransomware recovery consultants with the track record and perseverance to reconstruct a breached system as quickly as possible.

Progent's Ransomware Recovery Help
Soon after a crypto-ransomware event, paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will respond with the keys to unencrypt all your data. Kaspersky determined that 17% of crypto-ransomware victims never restored their information even after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is greatly above the typical ransomware demands, which ZDNET determined to be around $13,000 for smaller businesses. The other path is to piece back together the essential elements of your IT environment. Without the availability of complete system backups, this requires a broad range of IT skills, well-coordinated project management, and the ability to work 24x7 until the recovery project is completed.

For decades, Progent has made available professional Information Technology services for companies across the U.S. and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, and GIAC. (Visit Progent's certifications). Progent also has expertise in accounting and ERP applications. This breadth of expertise provides Progent the ability to quickly ascertain necessary systems and consolidate the surviving parts of your IT system after a crypto-ransomware attack and rebuild them into a functioning network.

Progent's ransomware team has best of breed project management systems to orchestrate the sophisticated restoration process. Progent understands the urgency of working rapidly and together with a client's management and IT resources to assign priority to tasks and to get essential systems back on line as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Attack Restoration
A client escalated to Progent after their network was attacked by the Ryuk ransomware virus. Ryuk is generally considered to have been created by Northern Korean state cybercriminals, possibly adopting strategies exposed from the United States NSA organization. Ryuk attacks specific companies with limited ability to sustain disruption and is among the most lucrative versions of ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturer located in the Chicago metro area and has about 500 staff members. The Ryuk attack had paralyzed all business operations and manufacturing capabilities. Most of the client's data protection had been online at the time of the intrusion and were encrypted. The client was taking steps for paying the ransom demand (in excess of two hundred thousand dollars) and hoping for the best, but ultimately called Progent.

Progent worked hand in hand the customer to rapidly assess and prioritize the critical systems that had to be recovered to make it possible to restart company operations:

• Windows Active Directory
• Electronic Messaging
• MRP System

In less than two days, Progent was able to re-build Active Directory to its pre-virus state. Progent then charged ahead with rebuilding and hard drive recovery on critical systems. All Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to collect non-encrypted OST files (Outlook Off-Line Data Files) on staff PCs and laptops to recover email data. A not too old offline backup of the client's financials/MRP systems made it possible to restore these vital services back online. Although significant work was left to recover completely from the Ryuk event, the most important systems were recovered quickly:

Over the following few weeks critical milestones in the recovery project were made through close collaboration between Progent team members and the customer:

• Self-hosted web applications were restored with no loss of data.
• The MailStore Exchange Server exceeding four million archived emails was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control functions were fully functional.
• A new Palo Alto Networks 850 security appliance was deployed.
• Ninety percent of the desktops and laptops were operational.

Conclusion
A probable company-ending catastrophe was evaded due to top-tier professionals, a wide spectrum of subject matter expertise, and tight collaboration. Although upon completion of forensics the ransomware virus penetration described here would have been blocked with current security technology solutions and security best practices, team training, and properly executed incident response procedures for data backup and applying software patches, the fact is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's roster of professionals has a proven track record in ransomware virus blocking, remediation, and data restoration.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Tucson
For ransomware system recovery consulting services in the Tucson area, call Progent at 800-462-8800 or see Contact Progent.