Ransomware Protection and Remediation Services Allen

Crypto-Ransomware : Your Worst IT Catastrophe
Ransomware has become a modern cyber pandemic that presents an enterprise-level danger for organizations poorly prepared for an assault. Multiple generations of crypto-ransomware such as Reveton, Fusob, Locky, Syskey and MongoLock cryptoworms have been circulating for many years and still cause havoc. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as daily unnamed viruses, not only encrypt online critical data but also infect all available system protection mechanisms. Files synched to the cloud can also be corrupted. In a poorly designed environment, this can make automatic recovery impossible and basically sets the network back to square one.

Recovering programs and data after a ransomware attack becomes a race against the clock as the targeted business tries its best to stop the spread and cleanup the ransomware and to resume business-critical operations. Due to the fact that crypto-ransomware needs time to spread, assaults are frequently sprung during weekends and nights, when successful penetrations in many cases take longer to notice. This compounds the difficulty of rapidly assembling and orchestrating a knowledgeable response team.

Progent provides a variety of services for protecting Allen businesses from ransomware attacks. Among these are staff education to help identify and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based threat protection to discover and extinguish zero-day modern malware assaults. Progent in addition provides the services of seasoned ransomware recovery consultants with the skills and perseverance to restore a compromised system as soon as possible.

Progent's Ransomware Recovery Help
Subsequent to a ransomware attack, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the keys to decipher all your files. Kaspersky Labs estimated that seventeen percent of ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms frequently range from fifteen to forty BTC ($120,000 and $400,000). This is significantly higher than the usual crypto-ransomware demands, which ZDNET determined to be approximately $13,000 for small organizations. The alternative is to setup from scratch the key elements of your IT environment. Without access to full system backups, this requires a wide complement of skill sets, well-coordinated team management, and the willingness to work non-stop until the recovery project is completed.

For twenty years, Progent has provided professional Information Technology services for businesses throughout the US and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have earned high-level certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, and SANS GIAC. (Visit Progent's certifications). Progent also has expertise in financial management and ERP applications. This breadth of experience gives Progent the capability to knowledgably identify critical systems and re-organize the remaining pieces of your IT system following a crypto-ransomware event and assemble them into a functioning system.

Progent's recovery group deploys top notch project management applications to orchestrate the sophisticated restoration process. Progent understands the importance of working swiftly and together with a client's management and IT staff to assign priority to tasks and to get essential systems back online as fast as possible.

Business Case Study: A Successful Ransomware Attack Restoration
A small business escalated to Progent after their organization was taken over by Ryuk ransomware. Ryuk is believed to have been launched by North Korean state hackers, possibly using strategies leaked from the United States NSA organization. Ryuk targets specific businesses with little or no tolerance for disruption and is among the most profitable examples of ransomware. Major victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturer based in the Chicago metro area with about 500 workers. The Ryuk intrusion had brought down all essential operations and manufacturing capabilities. Most of the client's backups had been online at the time of the attack and were destroyed. The client was taking steps for paying the ransom (more than two hundred thousand dollars) and hoping for the best, but in the end made the decision to use Progent.

Progent worked hand in hand the customer to rapidly assess and assign priority to the most important systems that needed to be restored to make it possible to continue business functions:

• Active Directory (AD)
• Microsoft Exchange
• Accounting/MRP

In less than two days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then charged ahead with rebuilding and storage recovery of critical servers. All Exchange Server ties and configuration information were usable, which facilitated the restore of Exchange. Progent was also able to locate non-encrypted OST data files (Outlook Email Off-Line Data Files) on various desktop computers and laptops in order to recover mail data. A recent off-line backup of the businesses accounting/MRP software made them able to recover these essential services back online for users. Although significant work remained to recover completely from the Ryuk damage, critical services were returned to operations rapidly:

Over the following month important milestones in the recovery project were achieved in close cooperation between Progent engineers and the customer:

• Internal web sites were returned to operation with no loss of information.
• The MailStore Exchange Server exceeding four million archived messages was spun up and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control capabilities were fully operational.
• A new Palo Alto Networks 850 security appliance was set up.
• Ninety percent of the desktop computers were being used by staff.

Conclusion
A probable business extinction catastrophe was evaded with top-tier experts, a wide array of IT skills, and tight teamwork. Although upon completion of forensics the ransomware virus attack described here should have been shut down with current security solutions and security best practices, user training, and appropriate incident response procedures for information protection and proper patching controls, the fact is that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and will continue. If you do get hit by a ransomware incursion, remember that Progent's roster of professionals has proven experience in ransomware virus defense, mitigation, and data disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Allen
For ransomware cleanup consulting in the Allen metro area, call Progent at 800-462-8800 or see Contact Progent.