Ransomware Protection and Cleanup Solutions Morgan Hill

Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that presents an extinction-level threat for organizations vulnerable to an assault. Multiple generations of crypto-ransomware like the CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for a long time and still inflict havoc. Modern strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, along with additional as yet unnamed newcomers, not only do encryption of on-line information but also infiltrate many configured system protection. Information synched to off-site disaster recovery sites can also be encrypted. In a poorly architected environment, this can render any recovery impossible and effectively sets the datacenter back to square one.

Getting back online programs and data after a crypto-ransomware intrusion becomes a sprint against the clock as the victim tries its best to stop lateral movement and clear the ransomware and to resume mission-critical activity. Due to the fact that ransomware needs time to spread, penetrations are usually sprung at night, when penetrations may take longer to discover. This multiplies the difficulty of promptly marshalling and organizing a capable mitigation team.

Progent provides an assortment of support services for protecting Morgan Hill businesses from ransomware events. These include staff training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to identify and disable zero-day modern malware attacks. Progent in addition can provide the services of expert crypto-ransomware recovery engineers with the skills and commitment to reconstruct a breached network as rapidly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a ransomware attack, sending the ransom demands in Bitcoin cryptocurrency does not provide any assurance that cyber hackers will respond with the needed codes to unencrypt all your data. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their data even after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is significantly above the usual ransomware demands, which ZDNET estimated to be in the range of $13,000 for small organizations. The other path is to setup from scratch the essential elements of your Information Technology environment. Absent access to essential data backups, this calls for a wide range of skills, professional project management, and the willingness to work continuously until the task is complete.

For decades, Progent has made available certified expert IT services for companies throughout the U.S. and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have earned advanced certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of experience affords Progent the skills to knowledgably understand important systems and re-organize the remaining components of your computer network system following a crypto-ransomware attack and rebuild them into a functioning system.

Progent's ransomware team of experts utilizes powerful project management applications to coordinate the complicated recovery process. Progent knows the urgency of acting swiftly and in unison with a client's management and IT team members to prioritize tasks and to get the most important applications back online as fast as possible.

Client Case Study: A Successful Ransomware Attack Recovery
A business hired Progent after their network system was attacked by the Ryuk ransomware virus. Ryuk is believed to have been deployed by Northern Korean state criminal gangs, suspected of adopting approaches leaked from the United States National Security Agency. Ryuk attacks specific organizations with limited room for operational disruption and is one of the most profitable incarnations of crypto-ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in Chicago and has about 500 employees. The Ryuk attack had shut down all company operations and manufacturing capabilities. The majority of the client's system backups had been directly accessible at the beginning of the attack and were destroyed. The client was pursuing financing for paying the ransom demand (in excess of $200K) and wishfully thinking for good luck, but in the end made the decision to use Progent.

Progent worked with the client to quickly understand and assign priority to the mission critical areas that needed to be recovered in order to continue business operations:

• Active Directory
• Exchange Server
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then performed rebuilding and storage recovery on essential applications. All Microsoft Exchange Server ties and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to collect local OST data files (Microsoft Outlook Offline Data Files) on staff desktop computers in order to recover email data. A not too old off-line backup of the client's accounting software made it possible to return these required applications back online for users. Although significant work needed to be completed to recover totally from the Ryuk virus, critical systems were restored rapidly:

Throughout the following couple of weeks critical milestones in the restoration project were achieved in tight collaboration between Progent consultants and the customer:

• Internal web sites were restored with no loss of information.
• The MailStore Server containing more than 4 million historical emails was brought online and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were completely recovered.
• A new Palo Alto Networks 850 firewall was installed and configured.
• 90% of the user PCs were being used by staff.

Conclusion
A likely business-ending catastrophe was evaded with top-tier experts, a broad range of subject matter expertise, and close teamwork. Although in post mortem the crypto-ransomware penetration detailed here could have been identified and prevented with modern cyber security systems and ISO/IEC 27001 best practices, team education, and well designed security procedures for information backup and keeping systems up to date with security patches, the fact is that government-sponsored hackers from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's team of experts has substantial experience in ransomware virus blocking, removal, and file restoration.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Morgan Hill
For ransomware system restoration expertise in the Morgan Hill metro area, call Progent at 800-462-8800 or visit Contact Progent.