Ransomware Filtering and Remediation Solutions Tukwila

Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that presents an enterprise-level threat for organizations poorly prepared for an attack. Different versions of ransomware such as CrySIS, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for many years and continue to inflict damage. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, plus additional unnamed newcomers, not only encrypt on-line critical data but also infect any accessible system backup. Files synched to cloud environments can also be rendered useless. In a poorly architected environment, it can render any recovery useless and effectively sets the entire system back to zero.

Recovering services and information after a crypto-ransomware event becomes a race against the clock as the targeted business tries its best to stop the spread and clear the virus and to resume enterprise-critical operations. Due to the fact that ransomware takes time to move laterally, attacks are often sprung at night, when penetrations may take more time to discover. This multiplies the difficulty of quickly assembling and coordinating a capable response team.

Progent has a range of services for securing Tukwila enterprises from crypto-ransomware events. Among these are team member education to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based threat defense to identify and extinguish zero-day malware assaults. Progent in addition provides the assistance of expert crypto-ransomware recovery professionals with the talent and commitment to rebuild a breached system as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Soon after a ransomware penetration, even paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will return the needed codes to decrypt any of your information. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never restored their files even after having paid the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is greatly above the usual ransomware demands, which ZDNET estimated to be around $13,000 for smaller businesses. The alternative is to piece back together the critical components of your Information Technology environment. Absent access to full information backups, this requires a broad complement of IT skills, top notch project management, and the ability to work 24x7 until the job is complete.

For decades, Progent has provided certified expert IT services for companies throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, and GIAC. (Refer to Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of expertise provides Progent the capability to efficiently identify critical systems and re-organize the remaining parts of your computer network environment following a crypto-ransomware penetration and configure them into an operational network.

Progent's security team of experts utilizes best of breed project management applications to coordinate the complex recovery process. Progent knows the importance of acting rapidly and together with a customer's management and IT staff to assign priority to tasks and to get critical systems back on line as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Attack Restoration
A business contacted Progent after their network system was brought down by Ryuk crypto-ransomware. Ryuk is believed to have been developed by North Korean government sponsored cybercriminals, possibly adopting technology exposed from America's National Security Agency. Ryuk attacks specific companies with limited tolerance for operational disruption and is among the most profitable examples of ransomware viruses. Headline targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing company located in Chicago and has about 500 staff members. The Ryuk attack had shut down all company operations and manufacturing processes. The majority of the client's system backups had been on-line at the beginning of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and hoping for the best, but ultimately called Progent.

Progent worked with the client to rapidly assess and prioritize the key applications that needed to be restored in order to continue departmental functions:

• Active Directory
• Email
• Accounting/MRP

In less than 48 hours, Progent was able to restore Active Directory services to its pre-penetration state. Progent then helped perform setup and hard drive recovery of critical applications. All Exchange Server ties and attributes were usable, which accelerated the restore of Exchange. Progent was able to find local OST files (Outlook Offline Folder Files) on user workstations in order to recover email messages. A recent off-line backup of the customer's accounting/ERP software made them able to restore these vital programs back available to users. Although significant work still had to be done to recover totally from the Ryuk virus, essential services were restored quickly:

Over the following few weeks key milestones in the restoration process were achieved through tight cooperation between Progent consultants and the customer:

• Self-hosted web applications were brought back up with no loss of data.
• The MailStore Exchange Server containing more than 4 million archived messages was spun up and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control functions were 100% recovered.
• A new Palo Alto 850 security appliance was deployed.
• 90% of the desktop computers were operational.

Conclusion
A likely company-ending disaster was dodged due to dedicated professionals, a wide spectrum of knowledge, and tight teamwork. Although in retrospect the ransomware incident described here could have been disabled with up-to-date security technology and NIST Cybersecurity Framework best practices, team training, and appropriate incident response procedures for data backup and proper patching controls, the reality is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware incident, remember that Progent's roster of experts has proven experience in crypto-ransomware virus blocking, mitigation, and data restoration.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Tukwila
For ransomware cleanup services in the Tukwila metro area, phone Progent at 800-462-8800 or visit Contact Progent.