Ransomware Defense and Recovery Services Augusta-Richmond County

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a modern cyber pandemic that represents an enterprise-level danger for organizations unprepared for an attack. Versions of ransomware like the Reveton, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for years and still inflict havoc. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as more as yet unnamed viruses, not only encrypt online data but also infect any accessible system backups. Data synchronized to cloud environments can also be ransomed. In a vulnerable data protection solution, it can make automated recovery impossible and effectively sets the datacenter back to square one.

Getting back on-line programs and data following a ransomware outage becomes a race against time as the targeted organization struggles to stop the spread, eradicate the crypto-ransomware, and resume business-critical activity. Since crypto-ransomware needs time to spread throughout a network, penetrations are usually sprung on weekends, when successful attacks in many cases take more time to detect. This multiplies the difficulty of rapidly marshalling and coordinating a knowledgeable mitigation team.

Progent has an assortment of services for protecting Augusta-Richmond County organizations from ransomware penetrations. These include user training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to discover and suppress zero-day modern malware attacks. Progent also offers the services of experienced crypto-ransomware recovery engineers with the skills and commitment to restore a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Restoration Support Services
Following a crypto-ransomware penetration, sending the ransom in cryptocurrency does not ensure that cyber criminals will respond with the needed keys to decrypt any or all of your information. Kaspersky ascertained that 17% of ransomware victims never recovered their data even after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to re-install the key components of your IT environment. Without access to essential information backups, this requires a broad complement of skill sets, professional team management, and the ability to work 24x7 until the task is finished.

For twenty years, Progent has made available professional IT services for businesses across the U.S. and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned top industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial systems and ERP applications. This breadth of expertise gives Progent the skills to efficiently ascertain critical systems and consolidate the surviving parts of your Information Technology environment following a crypto-ransomware event and rebuild them into an operational network.

Progent's ransomware team utilizes powerful project management tools to orchestrate the complex restoration process. Progent understands the importance of working rapidly and together with a customer's management and IT resources to assign priority to tasks and to put critical systems back on line as soon as humanly possible.

Business Case Study: A Successful Ransomware Intrusion Response
A small business escalated to Progent after their network was crashed by the Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean state sponsored criminal gangs, suspected of using strategies exposed from America's NSA organization. Ryuk attacks specific companies with limited tolerance for operational disruption and is one of the most lucrative iterations of crypto-ransomware. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago with about 500 workers. The Ryuk penetration had frozen all company operations and manufacturing processes. The majority of the client's data protection had been directly accessible at the beginning of the attack and were encrypted. The client was evaluating paying the ransom demand (more than $200,000) and praying for the best, but ultimately engaged Progent.

Progent worked together with the client to rapidly determine and prioritize the key elements that had to be recovered to make it possible to resume company operations:

• Active Directory (AD)
• Microsoft Exchange Email
• Accounting and Manufacturing Software

In less than two days, Progent was able to restore Active Directory services to its pre-attack state. Progent then helped perform reinstallations and hard drive recovery of needed applications. All Microsoft Exchange Server ties and attributes were intact, which greatly helped the restore of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Email Offline Data Files) on various workstations and laptops in order to recover email data. A not too old off-line backup of the businesses accounting systems made them able to restore these required services back on-line. Although significant work still had to be done to recover totally from the Ryuk virus, essential systems were recovered quickly:

Throughout the following couple of weeks critical milestones in the recovery process were achieved in tight cooperation between Progent consultants and the client:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Exchange Server exceeding 4 million archived emails was brought on-line and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were completely functional.
• A new Palo Alto 850 security appliance was brought on-line.
• Ninety percent of the user workstations were back into operation.

Conclusion
A possible business-killing catastrophe was avoided through the efforts of hard-working professionals, a wide range of IT skills, and close collaboration. Although in analyzing the event afterwards the ransomware penetration detailed here should have been stopped with advanced cyber security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and well thought out incident response procedures for information protection and applying software patches, the reality remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's team of experts has substantial experience in crypto-ransomware virus defense, remediation, and file disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Augusta-Richmond County
For ransomware recovery services in the Augusta-Richmond County area, call Progent at 800-462-8800 or visit Contact Progent.