Ransomware Filtering and Removal Consulting Norfolk

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that presents an existential threat for organizations vulnerable to an assault. Different iterations of crypto-ransomware like the CryptoLocker, Fusob, Locky, SamSam and MongoLock cryptoworms have been around for many years and continue to inflict havoc. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, plus daily as yet unnamed newcomers, not only encrypt online data files but also infiltrate all configured system backup. Information synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly architected data protection solution, this can render any restore operations hopeless and effectively knocks the entire system back to square one.

Getting back applications and data after a ransomware outage becomes a race against time as the targeted business fights to contain, eradicate the ransomware, and resume enterprise-critical operations. Since crypto-ransomware takes time to spread across a targeted network, penetrations are usually launched during nights and weekends, when penetrations are likely to take longer to notice. This compounds the difficulty of promptly assembling and organizing a capable mitigation team.

Progent provides a range of solutions for protecting Norfolk organizations from ransomware penetrations. Among these are team member training to help recognize and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to identify and quarantine zero-day modern malware assaults. Progent in addition offers the assistance of seasoned crypto-ransomware recovery consultants with the skills and commitment to reconstruct a breached network as quickly as possible.

Progent's Ransomware Restoration Services
After a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that criminal gangs will respond with the needed keys to decipher any or all of your information. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to setup from scratch the vital parts of your Information Technology environment. Absent the availability of complete system backups, this calls for a broad complement of skills, well-coordinated team management, and the capability to work 24x7 until the recovery project is over.

For two decades, Progent has offered expert Information Technology services for businesses across the United States and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have been awarded top industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP software solutions. This breadth of experience gives Progent the skills to efficiently identify necessary systems and consolidate the remaining parts of your IT system following a ransomware penetration and rebuild them into an operational network.

Progent's ransomware team of experts deploys best of breed project management applications to orchestrate the complicated restoration process. Progent understands the importance of working rapidly and in concert with a customer's management and IT staff to prioritize tasks and to get the most important systems back online as soon as humanly possible.

Customer Case Study: A Successful Crypto-Ransomware Penetration Recovery
A client engaged Progent after their network was attacked by Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean state cybercriminals, possibly adopting techniques exposed from the U.S. NSA organization. Ryuk attacks specific businesses with limited room for operational disruption and is one of the most lucrative instances of ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company located in Chicago with around 500 workers. The Ryuk intrusion had disabled all essential operations and manufacturing processes. Most of the client's system backups had been online at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom (exceeding $200,000) and praying for the best, but ultimately utilized Progent.

Progent worked with the client to quickly identify and assign priority to the essential elements that had to be addressed in order to restart business operations:

• Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to re-build Active Directory to its pre-attack state. Progent then assisted with reinstallations and storage recovery on needed systems. All Exchange ties and attributes were usable, which accelerated the restore of Exchange. Progent was able to collect intact OST data files (Outlook Off-Line Data Files) on user workstations and laptops to recover mail data. A not too old offline backup of the businesses accounting software made them able to restore these vital services back servicing users. Although major work needed to be completed to recover totally from the Ryuk event, essential systems were returned to operations rapidly:

Over the next couple of weeks key milestones in the recovery project were accomplished in tight collaboration between Progent team members and the client:

• In-house web applications were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server with over four million archived messages was restored to operations and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory functions were 100% restored.
• A new Palo Alto 850 security appliance was brought online.
• Most of the user PCs were fully operational.

Conclusion
A possible business catastrophe was dodged by results-oriented experts, a broad spectrum of technical expertise, and close teamwork. Although in post mortem the ransomware virus incident detailed here would have been identified and blocked with up-to-date security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and well thought out incident response procedures for data backup and applying software patches, the reality remains that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware attack, remember that Progent's team of professionals has proven experience in ransomware virus defense, cleanup, and data disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Norfolk
For ransomware cleanup expertise in the Norfolk metro area, phone Progent at 800-462-8800 or visit Contact Progent.