Ransomware Filtering and Remediation Services San Mateo

Ransomware : Your Worst IT Nightmare
Ransomware has become a modern cyber pandemic that represents an extinction-level threat for businesses unprepared for an assault. Multiple generations of ransomware like the Reveton, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for a long time and still inflict harm. More recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, plus more as yet unnamed malware, not only do encryption of online files but also infect any available system protection. Information synchronized to cloud environments can also be encrypted. In a vulnerable data protection solution, it can make automated restore operations impossible and basically sets the network back to square one.

Retrieving programs and data following a ransomware outage becomes a sprint against the clock as the targeted business struggles to contain the damage and eradicate the ransomware and to restore business-critical activity. Since ransomware takes time to replicate, assaults are often sprung during nights and weekends, when successful penetrations typically take longer to recognize. This multiplies the difficulty of rapidly assembling and organizing a qualified mitigation team.

Progent provides an assortment of solutions for securing San Mateo businesses from ransomware penetrations. These include team member education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to identify and quarantine day-zero modern malware attacks. Progent also can provide the assistance of veteran ransomware recovery consultants with the skills and commitment to re-deploy a breached environment as urgently as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware penetration, sending the ransom demands in Bitcoin cryptocurrency does not provide any assurance that merciless criminals will respond with the codes to decipher any or all of your files. Kaspersky determined that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms frequently range from fifteen to forty BTC ($120,000 and $400,000). This is well higher than the typical ransomware demands, which ZDNET determined to be approximately $13,000 for smaller organizations. The fallback is to piece back together the critical parts of your Information Technology environment. Absent the availability of complete data backups, this requires a broad range of IT skills, professional project management, and the capability to work non-stop until the task is done.

For decades, Progent has made available professional IT services for companies throughout the US and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained top certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of experience affords Progent the ability to rapidly ascertain critical systems and consolidate the surviving pieces of your Information Technology system after a ransomware attack and assemble them into a functioning system.

Progent's security team of experts utilizes state-of-the-art project management tools to orchestrate the sophisticated recovery process. Progent appreciates the importance of acting rapidly and together with a client's management and IT resources to prioritize tasks and to get the most important services back online as fast as humanly possible.

Customer Case Study: A Successful Crypto-Ransomware Intrusion Response
A small business hired Progent after their organization was penetrated by Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state sponsored criminal gangs, possibly adopting techniques leaked from the U.S. National Security Agency. Ryuk targets specific businesses with little or no tolerance for disruption and is among the most lucrative instances of ransomware viruses. Headline targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business based in Chicago and has around 500 employees. The Ryuk penetration had paralyzed all business operations and manufacturing processes. The majority of the client's backups had been on-line at the time of the intrusion and were eventually encrypted. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but in the end reached out to Progent.

Progent worked hand in hand the customer to quickly understand and assign priority to the most important areas that needed to be recovered in order to resume business functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• Financials/MRP

In less than 48 hours, Progent was able to recover Active Directory services to its pre-attack state. Progent then assisted with reinstallations and storage recovery on essential systems. All Microsoft Exchange Server schema and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to find non-encrypted OST data files (Outlook Offline Data Files) on various workstations and laptops to recover email messages. A recent off-line backup of the customer's financials/ERP systems made it possible to restore these essential applications back on-line. Although major work still had to be done to recover totally from the Ryuk virus, critical services were restored rapidly:

During the following couple of weeks key milestones in the restoration process were achieved in close cooperation between Progent consultants and the customer:

• In-house web applications were restored with no loss of data.
• The MailStore Exchange Server containing more than 4 million archived messages was brought online and available for users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory capabilities were fully recovered.
• A new Palo Alto 850 firewall was deployed.
• Most of the desktop computers were being used by staff.

Conclusion
A likely business disaster was dodged due to results-oriented experts, a broad spectrum of technical expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration detailed here could have been stopped with current security systems and ISO/IEC 27001 best practices, user education, and properly executed incident response procedures for data backup and keeping systems up to date with security patches, the reality remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's roster of experts has proven experience in crypto-ransomware virus defense, mitigation, and data restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in San Mateo
For ransomware system recovery services in the San Mateo metro area, phone Progent at 800-462-8800 or see Contact Progent.