Ransomware Protection and Restoration Services Sorocaba

Crypto-Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become a modern cyberplague that presents an extinction-level threat for businesses of all sizes unprepared for an assault. Multiple generations of crypto-ransomware such as CrySIS, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and continue to cause havoc. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, along with daily unnamed viruses, not only encrypt on-line files but also infect all available system protection mechanisms. Data synchronized to off-premises disaster recovery sites can also be ransomed. In a vulnerable environment, this can render any restore operations hopeless and basically sets the entire system back to square one.

Recovering services and data after a crypto-ransomware event becomes a race against time as the targeted organization fights to stop lateral movement, clear the ransomware, and restore enterprise-critical activity. Since ransomware needs time to spread throughout a network, attacks are usually sprung during nights and weekends, when successful attacks may take longer to recognize. This compounds the difficulty of rapidly mobilizing and coordinating a capable response team.

Progent makes available a variety of help services for protecting Sorocaba businesses from crypto-ransomware penetrations. These include team member training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat protection to discover and disable zero-day modern malware assaults. Progent in addition can provide the services of experienced crypto-ransomware recovery professionals with the talent and perseverance to rebuild a breached network as quickly as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a crypto-ransomware event, paying the ransom demands in cryptocurrency does not ensure that criminal gangs will provide the keys to decrypt any or all of your files. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The other path is to re-install the critical elements of your IT environment. Absent the availability of full data backups, this requires a wide range of skills, well-coordinated team management, and the willingness to work non-stop until the recovery project is finished.

For decades, Progent has made available certified expert IT services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP software solutions. This breadth of experience provides Progent the capability to efficiently identify critical systems and organize the surviving parts of your computer network environment following a ransomware attack and configure them into an operational network.

Progent's security team of experts uses best of breed project management tools to coordinate the complex restoration process. Progent understands the importance of working quickly and in unison with a client's management and IT staff to prioritize tasks and to get critical services back on line as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Penetration Recovery
A small business escalated to Progent after their network was brought down by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state hackers, suspected of adopting algorithms exposed from the U.S. National Security Agency. Ryuk seeks specific organizations with limited ability to sustain disruption and is among the most profitable versions of crypto-ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company based in Chicago with about 500 workers. The Ryuk event had frozen all business operations and manufacturing processes. Most of the client's backups had been online at the time of the attack and were encrypted. The client was taking steps for paying the ransom demand (more than $200,000) and wishfully thinking for the best, but ultimately reached out to Progent.

Progent worked hand in hand the client to quickly determine and assign priority to the most important elements that had to be recovered to make it possible to restart departmental functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to restore Active Directory to its pre-penetration state. Progent then charged ahead with reinstallations and storage recovery on key applications. All Exchange Server ties and configuration information were usable, which facilitated the restore of Exchange. Progent was able to assemble intact OST files (Outlook Offline Folder Files) on various desktop computers and laptops to recover email messages. A recent offline backup of the client's financials/MRP software made them able to restore these vital services back servicing users. Although a lot of work was left to recover completely from the Ryuk event, critical services were restored rapidly:

During the following month important milestones in the recovery process were completed through close collaboration between Progent consultants and the customer:

• Self-hosted web applications were restored without losing any information.
• The MailStore Microsoft Exchange Server with over four million archived messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were fully operational.
• A new Palo Alto 850 security appliance was installed and configured.
• Ninety percent of the desktop computers were fully operational.

Conclusion
A probable business-ending disaster was averted due to results-oriented experts, a broad spectrum of IT skills, and tight collaboration. Although in retrospect the ransomware attack detailed here could have been prevented with advanced cyber security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and well designed incident response procedures for backup and proper patching controls, the reality remains that government-sponsored cybercriminals from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has proven experience in ransomware virus defense, remediation, and data restoration.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Sorocaba
For ransomware system restoration consulting in the Sorocaba area, call Progent at 800-462-8800 or go to Contact Progent.