Ransomware Protection and Removal Consulting Jersey City

Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become a too-frequent cyber pandemic that presents an extinction-level danger for organizations vulnerable to an assault. Different versions of ransomware like the Dharma, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for many years and still cause damage. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, plus frequent as yet unnamed newcomers, not only encrypt on-line files but also infect any configured system backups. Data synched to off-site disaster recovery sites can also be rendered useless. In a vulnerable data protection solution, it can make automated restoration impossible and basically sets the datacenter back to zero.

Restoring applications and data after a crypto-ransomware event becomes a sprint against time as the victim tries its best to contain the damage and clear the crypto-ransomware and to resume mission-critical activity. Due to the fact that ransomware requires time to move laterally, attacks are frequently launched on weekends and holidays, when successful penetrations typically take more time to recognize. This compounds the difficulty of rapidly mobilizing and organizing a capable mitigation team.

Progent makes available a variety of solutions for protecting Jersey City businesses from crypto-ransomware attacks. These include team training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to discover and disable day-zero malware attacks. Progent in addition offers the services of experienced crypto-ransomware recovery engineers with the track record and commitment to reconstruct a compromised system as soon as possible.

Progent's Ransomware Recovery Services
Soon after a ransomware penetration, even paying the ransom in Bitcoin cryptocurrency does not guarantee that merciless criminals will return the keys to decrypt any or all of your information. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their files after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms frequently range from fifteen to forty BTC ($120,000 and $400,000). This is significantly above the average crypto-ransomware demands, which ZDNET determined to be in the range of $13,000 for small organizations. The alternative is to piece back together the essential components of your Information Technology environment. Absent the availability of essential system backups, this calls for a broad complement of skill sets, well-coordinated team management, and the willingness to work 24x7 until the task is completed.

For twenty years, Progent has made available professional Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have attained high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, and GIAC. (See Progent's certifications). Progent also has expertise with financial management and ERP applications. This breadth of expertise affords Progent the ability to rapidly understand necessary systems and consolidate the surviving parts of your Information Technology system after a ransomware attack and rebuild them into a functioning network.

Progent's ransomware group deploys best of breed project management applications to coordinate the complex restoration process. Progent knows the importance of working rapidly and in unison with a client's management and IT resources to assign priority to tasks and to put key services back on line as fast as humanly possible.

Case Study: A Successful Ransomware Intrusion Response
A small business escalated to Progent after their network system was taken over by Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean government sponsored criminal gangs, suspected of adopting technology leaked from the U.S. National Security Agency. Ryuk goes after specific companies with little or no tolerance for disruption and is among the most profitable iterations of ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago with around 500 staff members. The Ryuk penetration had frozen all business operations and manufacturing capabilities. Most of the client's data backups had been on-line at the beginning of the intrusion and were destroyed. The client was taking steps for paying the ransom demand (more than $200,000) and hoping for the best, but in the end brought in Progent.

Progent worked with the client to rapidly determine and assign priority to the key applications that had to be addressed in order to restart departmental functions:

• Microsoft Active Directory
• E-Mail
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to restore Active Directory to its pre-virus state. Progent then performed rebuilding and hard drive recovery on mission critical servers. All Exchange schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was also able to collect local OST files (Microsoft Outlook Off-Line Data Files) on team PCs and laptops in order to recover mail data. A recent offline backup of the businesses financials/ERP software made them able to restore these required programs back online for users. Although significant work still had to be done to recover totally from the Ryuk virus, critical services were restored rapidly:

During the next month important milestones in the restoration process were accomplished through close collaboration between Progent engineers and the client:

• In-house web applications were restored without losing any data.
• The MailStore Exchange Server containing more than four million archived messages was brought on-line and available for users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory functions were 100 percent recovered.
• A new Palo Alto 850 security appliance was set up and programmed.
• Ninety percent of the desktops and laptops were fully operational.

Conclusion
A possible business disaster was evaded by hard-working experts, a wide spectrum of knowledge, and close teamwork. Although in retrospect the crypto-ransomware virus penetration detailed here could have been prevented with advanced security technology solutions and security best practices, team education, and well thought out incident response procedures for data backup and applying software patches, the fact remains that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware virus, feel confident that Progent's team of professionals has substantial experience in ransomware virus defense, mitigation, and information systems disaster recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Jersey City
For ransomware cleanup services in the Jersey City area, call Progent at 800-462-8800 or see Contact Progent.