Ransomware Defense and Cleanup Consulting Fort Lauderdale

Ransomware : Your Feared IT Catastrophe
Ransomware has become a too-frequent cyberplague that poses an existential threat for organizations poorly prepared for an attack. Versions of ransomware like the CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for many years and continue to inflict damage. Modern variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, plus additional unnamed malware, not only encrypt on-line files but also infiltrate many accessible system backups. Information synchronized to the cloud can also be encrypted. In a poorly designed data protection solution, it can make any restore operations impossible and effectively sets the entire system back to square one.

Getting back applications and data after a crypto-ransomware intrusion becomes a race against the clock as the targeted organization fights to stop the spread and cleanup the ransomware and to restore business-critical activity. Since ransomware takes time to spread, assaults are usually launched at night, when penetrations may take longer to detect. This compounds the difficulty of promptly mobilizing and coordinating a qualified mitigation team.

Progent provides a variety of services for protecting Fort Lauderdale enterprises from crypto-ransomware penetrations. These include staff education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based threat protection to identify and extinguish zero-day modern malware attacks. Progent also provides the assistance of expert crypto-ransomware recovery professionals with the talent and perseverance to reconstruct a compromised system as rapidly as possible.

Progent's Crypto-Ransomware Restoration Services
After a crypto-ransomware event, sending the ransom demands in cryptocurrency does not guarantee that cyber criminals will respond with the codes to unencrypt all your data. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their data after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms commonly range from fifteen to forty BTC ($120,000 and $400,000). This is well above the average ransomware demands, which ZDNET determined to be around $13,000 for smaller businesses. The other path is to piece back together the vital elements of your Information Technology environment. Absent the availability of full information backups, this requires a broad complement of skill sets, well-coordinated project management, and the capability to work non-stop until the recovery project is completed.

For decades, Progent has offered expert Information Technology services for companies across the United States and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, and GIAC. (See Progent's certifications). Progent in addition has expertise in financial systems and ERP application software. This breadth of experience affords Progent the ability to rapidly identify critical systems and integrate the remaining components of your Information Technology environment following a ransomware attack and rebuild them into an operational network.

Progent's security team of experts utilizes top notch project management applications to orchestrate the complicated recovery process. Progent knows the urgency of working quickly and in unison with a client's management and Information Technology team members to assign priority to tasks and to put the most important systems back online as fast as possible.

Customer Story: A Successful Ransomware Intrusion Response
A business sought out Progent after their company was brought down by the Ryuk ransomware. Ryuk is generally considered to have been created by Northern Korean state cybercriminals, possibly using approaches leaked from the U.S. National Security Agency. Ryuk goes after specific companies with limited room for operational disruption and is one of the most lucrative instances of ransomware viruses. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in the Chicago metro area and has about 500 employees. The Ryuk event had disabled all company operations and manufacturing capabilities. The majority of the client's data backups had been directly accessible at the beginning of the attack and were damaged. The client was taking steps for paying the ransom demand (in excess of $200K) and hoping for the best, but ultimately utilized Progent.

Progent worked with the customer to rapidly identify and assign priority to the mission critical systems that needed to be addressed to make it possible to continue business operations:

• Microsoft Active Directory
• Email
• Accounting/MRP

In less than 2 days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then accomplished reinstallations and hard drive recovery on needed servers. All Exchange Server schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to assemble intact OST data files (Outlook Off-Line Data Files) on team desktop computers to recover email messages. A not too old offline backup of the client's accounting/MRP systems made it possible to recover these vital services back on-line. Although significant work remained to recover fully from the Ryuk damage, essential services were recovered rapidly:

Throughout the following few weeks critical milestones in the restoration process were made in close cooperation between Progent team members and the client:

• Internal web sites were returned to operation with no loss of information.
• The MailStore Server exceeding 4 million historical emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables/Inventory capabilities were 100 percent functional.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Most of the desktops and laptops were operational.

Conclusion
A potential business catastrophe was evaded due to dedicated experts, a broad array of knowledge, and close collaboration. Although in hindsight the ransomware attack detailed here should have been disabled with up-to-date cyber security systems and security best practices, user training, and well thought out incident response procedures for data protection and keeping systems up to date with security patches, the fact remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware incident, remember that Progent's roster of professionals has a proven track record in ransomware virus blocking, remediation, and information systems restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Fort Lauderdale
For ransomware cleanup consulting in the Fort Lauderdale metro area, phone Progent at 800-462-8800 or see Contact Progent.