Ransomware Prevention and Restoration Expertise Portland

Ransomware : Your Feared IT Disaster
Ransomware has become an escalating cyber pandemic that presents an enterprise-level danger for businesses of all sizes vulnerable to an assault. Versions of ransomware like the CryptoLocker, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for many years and continue to cause destruction. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as frequent as yet unnamed viruses, not only do encryption of online files but also infiltrate most accessible system restores and backups. Files replicated to off-site disaster recovery sites can also be rendered useless. In a poorly designed environment, this can render automated restore operations hopeless and effectively sets the network back to zero.

Retrieving applications and information following a ransomware intrusion becomes a sprint against the clock as the targeted organization tries its best to stop lateral movement and clear the ransomware and to resume enterprise-critical activity. Since ransomware needs time to move laterally, penetrations are usually sprung on weekends and holidays, when penetrations typically take longer to recognize. This compounds the difficulty of promptly marshalling and orchestrating an experienced response team.

Progent offers an assortment of support services for protecting Portland organizations from ransomware events. These include team member education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of modern security solutions with artificial intelligence technology to quickly detect and extinguish day-zero threats. Progent also offers the services of expert crypto-ransomware recovery professionals with the talent and commitment to reconstruct a breached environment as soon as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a crypto-ransomware event, paying the ransom demands in cryptocurrency does not ensure that cyber criminals will return the codes to unencrypt any of your information. Kaspersky ascertained that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is significantly higher than the average crypto-ransomware demands, which ZDNET estimated to be in the range of $13,000 for smaller businesses. The fallback is to setup from scratch the vital components of your IT environment. Absent access to full data backups, this calls for a broad complement of IT skills, professional project management, and the capability to work non-stop until the task is finished.

For two decades, Progent has provided certified expert Information Technology services for companies throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained high-level certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has expertise with financial systems and ERP software solutions. This breadth of expertise provides Progent the capability to rapidly identify necessary systems and re-organize the surviving pieces of your Information Technology system following a ransomware event and rebuild them into an operational network.

Progent's ransomware team of experts deploys top notch project management tools to orchestrate the sophisticated recovery process. Progent appreciates the urgency of working quickly and in concert with a client's management and Information Technology staff to assign priority to tasks and to get the most important systems back on-line as fast as humanly possible.

Client Story: A Successful Ransomware Incident Response
A customer hired Progent after their network system was brought down by the Ryuk ransomware. Ryuk is generally considered to have been deployed by Northern Korean government sponsored hackers, suspected of adopting algorithms leaked from America’s NSA organization. Ryuk seeks specific organizations with little ability to sustain disruption and is among the most lucrative incarnations of ransomware viruses. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in the Chicago metro area with around 500 staff members. The Ryuk penetration had disabled all essential operations and manufacturing processes. Most of the client's system backups had been online at the time of the attack and were encrypted. The client was taking steps for paying the ransom demand (more than $200,000) and hoping for good luck, but ultimately reached out to Progent.

Progent worked together with the customer to rapidly determine and prioritize the essential services that had to be recovered to make it possible to restart business functions:

• Active Directory
• Electronic Messaging
• Accounting and Manufacturing Software

Within two days, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then completed rebuilding and hard drive recovery on needed applications. All Microsoft Exchange Server schema and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to assemble non-encrypted OST data files (Outlook Off-Line Folder Files) on user workstations in order to recover mail messages. A recent off-line backup of the businesses accounting/MRP software made them able to return these vital programs back online. Although a lot of work remained to recover fully from the Ryuk virus, essential services were recovered quickly:

During the following month key milestones in the recovery process were accomplished in tight cooperation between Progent consultants and the customer:

• Internal web applications were returned to operation without losing any information.
• The MailStore Exchange Server containing more than four million archived messages was restored to operations and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory modules were completely operational.
• A new Palo Alto 850 firewall was deployed.
• Most of the user workstations were operational.

Conclusion
A potential enterprise-killing disaster was dodged with top-tier professionals, a wide array of knowledge, and close collaboration. Although in retrospect the crypto-ransomware penetration described here could have been identified and blocked with current cyber security systems and NIST Cybersecurity Framework best practices, user education, and appropriate incident response procedures for information protection and applying software patches, the reality remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware attack, remember that Progent's roster of experts has extensive experience in ransomware virus defense, removal, and data recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

File body_ransomware_recovery_contact_city.asp does not exist