Ransomware Prevention and Cleanup Services Austin

Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware has become an escalating cyberplague that presents an existential danger for organizations vulnerable to an attack. Versions of ransomware like the Dharma, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for many years and still inflict damage. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, as well as additional unnamed malware, not only do encryption of on-line information but also infect most accessible system backup. Information replicated to off-site disaster recovery sites can also be ransomed. In a poorly architected data protection solution, this can render automated restoration hopeless and basically knocks the datacenter back to zero.

Getting back on-line applications and information following a ransomware event becomes a sprint against time as the targeted business tries its best to contain and eradicate the virus and to restore mission-critical activity. Because crypto-ransomware takes time to move laterally, penetrations are frequently sprung at night, when successful attacks typically take more time to recognize. This multiplies the difficulty of rapidly marshalling and orchestrating a capable mitigation team.

Progent has a range of solutions for securing Austin businesses from crypto-ransomware events. These include team member training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat defense to identify and quarantine day-zero modern malware attacks. Progent in addition can provide the services of expert ransomware recovery consultants with the track record and commitment to re-deploy a breached system as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a ransomware attack, sending the ransom in Bitcoin cryptocurrency does not ensure that merciless criminals will respond with the needed codes to unencrypt any or all of your data. Kaspersky determined that 17% of crypto-ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms commonly range from fifteen to forty BTC ($120,000 and $400,000). This is significantly above the usual ransomware demands, which ZDNET estimated to be around $13,000 for small businesses. The other path is to re-install the mission-critical components of your IT environment. Absent the availability of essential system backups, this calls for a wide complement of skills, professional project management, and the willingness to work continuously until the task is complete.

For decades, Progent has made available certified expert Information Technology services for companies throughout the US and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have been awarded high-level certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, and GIAC. (Refer to Progent's certifications). Progent in addition has experience with financial systems and ERP software solutions. This breadth of experience gives Progent the capability to rapidly identify important systems and consolidate the surviving components of your network environment following a ransomware event and configure them into a functioning network.

Progent's security team uses powerful project management applications to orchestrate the sophisticated restoration process. Progent understands the urgency of acting swiftly and in unison with a customer's management and Information Technology team members to assign priority to tasks and to put the most important services back on line as fast as humanly possible.

Client Story: A Successful Ransomware Penetration Response
A client escalated to Progent after their organization was brought down by the Ryuk ransomware. Ryuk is thought to have been launched by North Korean government sponsored hackers, possibly using strategies exposed from the U.S. National Security Agency. Ryuk seeks specific companies with limited tolerance for disruption and is among the most lucrative versions of ransomware viruses. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer based in the Chicago metro area with about 500 staff members. The Ryuk penetration had disabled all business operations and manufacturing capabilities. Most of the client's information backups had been on-line at the time of the intrusion and were damaged. The client was evaluating paying the ransom demand (more than $200,000) and hoping for the best, but ultimately made the decision to use Progent.

Progent worked with the client to rapidly assess and assign priority to the key applications that had to be restored to make it possible to resume company functions:

• Windows Active Directory
• Exchange Server
• Financials/MRP

In less than 48 hours, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then completed setup and storage recovery of needed systems. All Microsoft Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to locate intact OST data files (Outlook Off-Line Folder Files) on various workstations and laptops to recover email information. A recent off-line backup of the customer's accounting/MRP systems made them able to return these essential services back on-line. Although a large amount of work was left to recover fully from the Ryuk attack, core systems were restored quickly:

Over the next few weeks key milestones in the restoration project were made in close collaboration between Progent consultants and the customer:

• Internal web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server exceeding four million historical emails was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control functions were completely operational.
• A new Palo Alto Networks 850 firewall was installed.
• Nearly all of the user PCs were back into operation.

Conclusion
A possible company-ending catastrophe was avoided due to hard-working professionals, a broad spectrum of knowledge, and tight teamwork. Although in retrospect the ransomware incident described here would have been prevented with current cyber security technology and NIST Cybersecurity Framework best practices, team education, and well designed incident response procedures for information backup and applying software patches, the reality remains that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware virus, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, cleanup, and data disaster recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Austin
For ransomware cleanup consulting services in the Austin area, call Progent at 800-462-8800 or visit Contact Progent.