Ransomware Filtering and Recovery Services San Mateo

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that poses an existential danger for businesses of all sizes poorly prepared for an attack. Different iterations of ransomware such as Dharma, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for a long time and continue to inflict destruction. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as daily as yet unnamed newcomers, not only encrypt on-line data files but also infiltrate any accessible system protection mechanisms. Information synchronized to the cloud can also be ransomed. In a poorly designed data protection solution, it can render automatic recovery hopeless and effectively knocks the network back to square one.

Getting back programs and data after a ransomware attack becomes a sprint against time as the targeted business tries its best to stop the spread, cleanup the ransomware, and resume enterprise-critical operations. Due to the fact that crypto-ransomware needs time to spread across a network, assaults are usually launched on weekends and holidays, when attacks may take more time to recognize. This multiplies the difficulty of promptly marshalling and organizing a qualified response team.

Progent makes available a range of services for protecting San Mateo organizations from ransomware attacks. Among these are staff training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based cyberthreat defense to discover and suppress zero-day malware attacks. Progent in addition offers the services of veteran crypto-ransomware recovery professionals with the track record and perseverance to re-deploy a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Restoration Help
Subsequent to a crypto-ransomware invasion, even paying the ransom in cryptocurrency does not guarantee that distant criminals will provide the needed codes to decrypt any of your information. Kaspersky Labs estimated that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to re-install the key components of your IT environment. Without access to complete data backups, this calls for a broad range of skills, well-coordinated project management, and the capability to work continuously until the job is complete.

For two decades, Progent has made available certified expert IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of expertise affords Progent the skills to knowledgably ascertain necessary systems and re-organize the surviving components of your computer network system following a crypto-ransomware event and assemble them into an operational system.

Progent's ransomware group utilizes top notch project management systems to coordinate the sophisticated restoration process. Progent understands the urgency of working swiftly and in unison with a customer's management and Information Technology staff to assign priority to tasks and to get essential services back online as soon as possible.

Client Case Study: A Successful Ransomware Incident Recovery
A client contacted Progent after their organization was taken over by Ryuk ransomware. Ryuk is believed to have been launched by North Korean state criminal gangs, suspected of adopting strategies leaked from the U.S. NSA organization. Ryuk seeks specific organizations with little ability to sustain disruption and is among the most lucrative instances of ransomware viruses. Major victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer located in Chicago with about 500 staff members. The Ryuk event had brought down all business operations and manufacturing capabilities. Most of the client's information backups had been online at the beginning of the intrusion and were destroyed. The client was evaluating paying the ransom demand (more than two hundred thousand dollars) and hoping for the best, but ultimately reached out to Progent.

Progent worked with the customer to quickly understand and prioritize the essential elements that had to be addressed in order to resume company operations:

• Microsoft Active Directory
• Microsoft Exchange
• Financials/MRP

In less than 2 days, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then helped perform setup and storage recovery of critical servers. All Exchange data and configuration information were intact, which facilitated the restore of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Email Off-Line Data Files) on user desktop computers and laptops to recover mail messages. A not too old off-line backup of the customer's manufacturing software made it possible to recover these required programs back online for users. Although major work needed to be completed to recover fully from the Ryuk damage, the most important systems were recovered quickly:

Over the following couple of weeks important milestones in the recovery process were completed in tight cooperation between Progent engineers and the customer:

• In-house web applications were brought back up without losing any data.
• The MailStore Exchange Server exceeding four million historical emails was spun up and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory functions were fully restored.
• A new Palo Alto 850 firewall was set up and programmed.
• Ninety percent of the desktops and laptops were functioning as before the incident.

Conclusion
A likely company-ending disaster was evaded due to hard-working professionals, a broad spectrum of technical expertise, and tight collaboration. Although upon completion of forensics the crypto-ransomware penetration described here could have been shut down with up-to-date security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and well designed security procedures for information backup and keeping systems up to date with security patches, the reality is that state-sponsored hackers from Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of experts has substantial experience in ransomware virus blocking, mitigation, and information systems recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in San Mateo
For ransomware recovery consulting in the San Mateo metro area, call Progent at 800-462-8800 or see Contact Progent.