Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a modern cyberplague that represents an enterprise-level danger for organizations poorly prepared for an assault. Versions of ransomware such as Dharma, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been running rampant for many years and still inflict havoc. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, along with frequent unnamed newcomers, not only encrypt on-line critical data but also infect many configured system backup. Data synched to the cloud can also be rendered useless. In a poorly designed data protection solution, this can make any restoration impossible and basically knocks the datacenter back to square one.
Recovering applications and information following a crypto-ransomware attack becomes a race against the clock as the victim fights to contain the damage and cleanup the virus and to restore enterprise-critical operations. Since ransomware takes time to move laterally, attacks are often launched during weekends and nights, when successful penetrations typically take longer to detect. This multiplies the difficulty of rapidly marshalling and coordinating an experienced response team.
Progent makes available an assortment of solutions for securing Thousand Oaks businesses from ransomware attacks. Among these are user training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of next-generation security gateways with artificial intelligence technology to quickly detect and suppress day-zero threats. Progent in addition provides the services of veteran crypto-ransomware recovery professionals with the track record and perseverance to re-deploy a compromised environment as soon as possible.
Progent's Crypto-Ransomware Recovery Help
Soon after a ransomware attack, even paying the ransom in cryptocurrency does not guarantee that criminal gangs will return the needed codes to decipher all your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms commonly range from fifteen to forty BTC ($120,000 and $400,000). This is greatly above the usual ransomware demands, which ZDNET estimated to be around $13,000 for small businesses. The fallback is to setup from scratch the critical parts of your Information Technology environment. Without the availability of full information backups, this requires a broad complement of skill sets, professional team management, and the capability to work 24x7 until the recovery project is finished.
For two decades, Progent has offered certified expert Information Technology services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded advanced industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-renowned certifications including CISA, CISSP, CRISC, and SANS GIAC. (See Progent's certifications). Progent in addition has experience in accounting and ERP application software. This breadth of expertise provides Progent the capability to rapidly identify necessary systems and organize the remaining pieces of your computer network system after a ransomware event and configure them into an operational network.
Progent's security team of experts utilizes best of breed project management systems to orchestrate the sophisticated recovery process. Progent understands the urgency of working swiftly and in unison with a customerís management and Information Technology team members to prioritize tasks and to put the most important services back on-line as soon as possible.
Client Case Study: A Successful Ransomware Penetration Recovery
A customer escalated to Progent after their company was brought down by the Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean state cybercriminals, possibly using strategies leaked from Americaís National Security Agency. Ryuk goes after specific organizations with little ability to sustain disruption and is one of the most profitable instances of crypto-ransomware. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company based in Chicago with about 500 workers. The Ryuk attack had shut down all business operations and manufacturing capabilities. Most of the client's system backups had been on-line at the time of the intrusion and were destroyed. The client was evaluating paying the ransom (in excess of $200,000) and wishfully thinking for the best, but ultimately brought in Progent.
"I cannot speak enough in regards to the support Progent provided us throughout the most stressful period of (our) companyís life. We had little choice but to pay the cybercriminals if not for the confidence the Progent experts gave us. That you could get our messaging and production servers back quicker than five days was incredible. Every single person I talked with or texted at Progent was amazingly focused on getting our company operational and was working 24/7 on our behalf."
Progent worked hand in hand the customer to rapidly identify and prioritize the mission critical applications that had to be addressed in order to restart business functions:
To get going, Progent adhered to ransomware incident response industry best practices by halting lateral movement and clearing up compromised systems. Progent then started the task of recovering Windows Active Directory, the key technology of enterprise environments built on Microsoft Windows technology. Exchange messaging will not operate without Windows AD, and the businessesí MRP software used Microsoft SQL, which needs Windows AD for security authorization to the databases.
- Windows Active Directory
- MRP System
In less than 48 hours, Progent was able to rebuild Active Directory to its pre-intrusion state. Progent then accomplished setup and storage recovery of critical servers. All Exchange ties and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to find intact OST data files (Outlook Email Off-Line Data Files) on staff PCs and laptops to recover mail messages. A recent off-line backup of the client's financials/ERP software made them able to return these essential programs back servicing users. Although a large amount of work still had to be done to recover totally from the Ryuk damage, essential systems were recovered rapidly:
"For the most part, the production line operation showed little impact and we did not miss any customer orders."
During the following few weeks critical milestones in the recovery project were completed through close cooperation between Progent engineers and the customer:
- Self-hosted web sites were restored with no loss of data.
- The MailStore Exchange Server exceeding four million historical messages was spun up and available for users.
- CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were fully functional.
- A new Palo Alto Networks 850 security appliance was set up.
- Most of the user desktops and notebooks were back into operation.
"So much of what went on in the initial days is mostly a haze for me, but my team will not forget the dedication each and every one of your team put in to give us our company back. I have been working with Progent for the past 10 years, possibly more, and each time I needed help Progent has come through and delivered as promised. This situation was a stunning achievement."
A possible business-ending catastrophe was averted by dedicated professionals, a broad array of IT skills, and close collaboration. Although in hindsight the ransomware virus incident detailed here could have been shut down with up-to-date cyber security technology solutions and NIST Cybersecurity Framework best practices, team education, and well thought out incident response procedures for data protection and applying software patches, the reality is that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware virus, feel confident that Progent's team of professionals has substantial experience in ransomware virus blocking, cleanup, and file restoration.
"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others that were contributing), thank you for letting me get some sleep after we got through the initial push. All of you did an incredible effort, and if any of your guys is visiting the Chicago area, dinner is my treat!"
Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Services in Thousand Oaks
For ransomware cleanup expertise in the Thousand Oaks metro area, phone Progent at 800-462-8800 or see Contact Progent.