Ransomware Prevention and Remediation Consulting Tucson

Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level danger for businesses of all sizes unprepared for an attack. Multiple generations of ransomware such as CryptoLocker, WannaCry, Locky, SamSam and MongoLock cryptoworms have been around for a long time and continue to cause damage. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, plus additional unnamed malware, not only do encryption of online information but also infiltrate many configured system protection mechanisms. Files synchronized to the cloud can also be ransomed. In a poorly designed system, this can render automated recovery hopeless and basically sets the network back to zero.

Recovering applications and data after a crypto-ransomware event becomes a race against the clock as the victim fights to stop lateral movement and cleanup the virus and to resume business-critical activity. Because ransomware requires time to spread, penetrations are frequently sprung during weekends and nights, when attacks are likely to take longer to uncover. This compounds the difficulty of rapidly marshalling and organizing a knowledgeable mitigation team.

Progent offers a variety of services for protecting Tucson businesses from crypto-ransomware events. These include user education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based threat defense to detect and disable zero-day malware assaults. Progent in addition provides the services of veteran ransomware recovery consultants with the talent and perseverance to restore a compromised environment as soon as possible.

Progent's Ransomware Recovery Support Services
Following a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will provide the needed codes to unencrypt all your files. Kaspersky Labs determined that 17% of ransomware victims never restored their information after having paid the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms frequently range from fifteen to forty BTC ($120,000 and $400,000). This is significantly higher than the typical crypto-ransomware demands, which ZDNET determined to be approximately $13,000 for smaller businesses. The alternative is to piece back together the vital elements of your IT environment. Absent access to full information backups, this calls for a wide complement of skill sets, professional team management, and the ability to work non-stop until the job is completed.

For two decades, Progent has provided expert IT services for companies throughout the United States and has achieved Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained high-level certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, and GIAC. (Refer to Progent's certifications). Progent in addition has experience with accounting and ERP applications. This breadth of experience gives Progent the ability to rapidly understand necessary systems and organize the remaining parts of your computer network environment following a ransomware event and assemble them into an operational network.

Progent's recovery team of experts utilizes top notch project management applications to orchestrate the complex restoration process. Progent understands the importance of working quickly and in unison with a client's management and Information Technology staff to prioritize tasks and to get essential applications back on line as soon as humanly possible.

Business Case Study: A Successful Ransomware Virus Recovery
A customer engaged Progent after their company was taken over by Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean government sponsored cybercriminals, suspected of using algorithms leaked from the U.S. National Security Agency. Ryuk targets specific organizations with little or no tolerance for disruption and is one of the most profitable examples of ransomware viruses. Major targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business located in Chicago with about 500 employees. The Ryuk penetration had frozen all company operations and manufacturing processes. The majority of the client's system backups had been on-line at the beginning of the attack and were eventually encrypted. The client considered paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but ultimately brought in Progent.

Progent worked hand in hand the customer to quickly identify and assign priority to the most important applications that needed to be recovered to make it possible to restart company functions:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to recover Active Directory to its pre-penetration state. Progent then completed reinstallations and storage recovery on needed applications. All Exchange Server data and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to locate non-encrypted OST data files (Outlook Offline Folder Files) on various workstations and laptops to recover mail information. A not too old offline backup of the customer's accounting/MRP software made them able to return these vital programs back available to users. Although major work remained to recover totally from the Ryuk event, core systems were returned to operations quickly:

During the following month critical milestones in the recovery project were achieved in close collaboration between Progent team members and the customer:

• In-house web applications were returned to operation with no loss of information.
• The MailStore Exchange Server exceeding 4 million historical emails was brought online and available for users.
• CRM/Orders/Invoices/AP/AR/Inventory modules were fully recovered.
• A new Palo Alto 850 security appliance was brought online.
• Nearly all of the user workstations were back into operation.

Conclusion
A possible business-ending disaster was dodged by dedicated experts, a wide array of technical expertise, and close teamwork. Although upon completion of forensics the crypto-ransomware incident described here would have been identified and disabled with modern cyber security solutions and NIST Cybersecurity Framework best practices, staff training, and well designed security procedures for information backup and applying software patches, the reality remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's team of experts has substantial experience in ransomware virus defense, mitigation, and data recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Tucson
For ransomware cleanup consulting services in the Tucson area, call Progent at 800-462-8800 or see Contact Progent.