Ransomware Prevention and Cleanup Solutions Austin

Ransomware : Your Crippling IT Nightmare
Ransomware has become a modern cyber pandemic that presents an extinction-level threat for businesses poorly prepared for an attack. Different versions of crypto-ransomware like the Dharma, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been around for years and continue to inflict damage. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, along with more as yet unnamed malware, not only do encryption of on-line data but also infiltrate any available system protection mechanisms. Files synched to the cloud can also be encrypted. In a poorly designed data protection solution, it can make automated restore operations hopeless and basically sets the entire system back to square one.

Getting back on-line programs and information after a ransomware attack becomes a sprint against the clock as the victim struggles to contain the damage and cleanup the virus and to resume enterprise-critical activity. Because ransomware needs time to replicate, assaults are often launched at night, when successful penetrations are likely to take more time to identify. This multiplies the difficulty of rapidly assembling and organizing a qualified mitigation team.

Progent offers a range of services for protecting Austin enterprises from crypto-ransomware penetrations. Among these are team member education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based threat defense to detect and disable day-zero modern malware attacks. Progent also can provide the assistance of expert crypto-ransomware recovery engineers with the talent and commitment to restore a breached network as soon as possible.

Progent's Ransomware Restoration Help
Soon after a ransomware attack, even paying the ransom in Bitcoin cryptocurrency does not guarantee that cyber criminals will return the keys to unencrypt all your data. Kaspersky estimated that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms commonly range from fifteen to forty BTC ($120,000 and $400,000). This is significantly higher than the typical crypto-ransomware demands, which ZDNET estimated to be approximately $13,000 for smaller businesses. The other path is to piece back together the key elements of your Information Technology environment. Absent the availability of essential information backups, this calls for a wide complement of skill sets, well-coordinated project management, and the capability to work continuously until the job is finished.

For decades, Progent has offered professional IT services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, and GIAC. (Refer to Progent's certifications). Progent in addition has expertise with financial management and ERP software solutions. This breadth of expertise provides Progent the ability to quickly identify important systems and re-organize the remaining parts of your network environment after a crypto-ransomware event and configure them into a functioning system.

Progent's recovery team of experts utilizes powerful project management applications to orchestrate the complex recovery process. Progent understands the importance of acting swiftly and together with a customer's management and IT staff to assign priority to tasks and to put key services back on line as fast as humanly possible.

Client Story: A Successful Ransomware Incident Response
A small business engaged Progent after their network was penetrated by Ryuk crypto-ransomware. Ryuk is thought to have been created by Northern Korean state sponsored hackers, possibly adopting technology exposed from the United States NSA organization. Ryuk seeks specific businesses with little room for disruption and is one of the most profitable iterations of ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company located in Chicago and has about 500 employees. The Ryuk attack had frozen all essential operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the start of the intrusion and were destroyed. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but ultimately brought in Progent.

Progent worked with the customer to rapidly identify and assign priority to the critical applications that had to be addressed to make it possible to restart business operations:

• Microsoft Active Directory
• Email
• MRP System

Within 48 hours, Progent was able to rebuild Active Directory to its pre-virus state. Progent then completed reinstallations and hard drive recovery of the most important applications. All Exchange Server schema and configuration information were usable, which accelerated the restore of Exchange. Progent was able to locate local OST files (Outlook Offline Folder Files) on team workstations in order to recover email data. A recent offline backup of the businesses manufacturing systems made them able to return these essential programs back servicing users. Although a lot of work needed to be completed to recover totally from the Ryuk attack, critical systems were returned to operations quickly:

Throughout the next few weeks critical milestones in the restoration process were completed through tight collaboration between Progent team members and the client:

• In-house web applications were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server exceeding four million archived emails was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory Control modules were 100% functional.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Ninety percent of the user workstations were being used by staff.

Conclusion
A probable business extinction catastrophe was avoided through the efforts of hard-working professionals, a wide spectrum of subject matter expertise, and tight collaboration. Although in hindsight the ransomware virus attack detailed here would have been identified and stopped with advanced security technology solutions and recognized best practices, user training, and well designed security procedures for information backup and proper patching controls, the reality remains that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's roster of experts has a proven track record in ransomware virus blocking, cleanup, and information systems recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Austin
For ransomware recovery consulting services in the Austin metro area, phone Progent at 800-462-8800 or go to Contact Progent.