Ransomware Filtering and Cleanup Consulting Charlotte

Ransomware : Your Worst IT Disaster
Ransomware has become a too-frequent cyberplague that presents an existential danger for organizations vulnerable to an attack. Multiple generations of ransomware such as CryptoLocker, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been circulating for many years and continue to inflict havoc. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with additional as yet unnamed viruses, not only do encryption of on-line files but also infiltrate most accessible system protection mechanisms. Information synched to cloud environments can also be ransomed. In a poorly designed data protection solution, this can render automated restoration useless and basically sets the entire system back to square one.

Retrieving services and information following a ransomware event becomes a sprint against the clock as the targeted organization struggles to stop the spread and eradicate the virus and to resume business-critical activity. Because ransomware requires time to move laterally, assaults are frequently launched at night, when penetrations tend to take longer to notice. This compounds the difficulty of quickly assembling and organizing an experienced response team.

Progent makes available an assortment of services for securing Charlotte organizations from ransomware penetrations. These include user training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat protection to detect and disable zero-day malware attacks. Progent in addition provides the assistance of expert crypto-ransomware recovery consultants with the track record and commitment to reconstruct a compromised system as quickly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware event, paying the ransom in Bitcoin cryptocurrency does not provide any assurance that distant criminals will return the keys to decrypt any or all of your files. Kaspersky estimated that seventeen percent of ransomware victims never restored their data after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is greatly above the typical ransomware demands, which ZDNET determined to be approximately $13,000 for small organizations. The other path is to piece back together the critical components of your Information Technology environment. Without access to complete information backups, this calls for a wide complement of IT skills, professional team management, and the capability to work non-stop until the job is completed.

For decades, Progent has made available expert Information Technology services for companies across the United States and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained top certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have garnered internationally-recognized certifications including CISA, CISSP, CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience affords Progent the skills to knowledgably ascertain important systems and integrate the surviving parts of your computer network environment after a ransomware penetration and assemble them into an operational network.

Progent's ransomware group utilizes top notch project management tools to orchestrate the complicated restoration process. Progent understands the importance of working swiftly and in unison with a customer's management and IT resources to assign priority to tasks and to put essential applications back on line as fast as possible.

Customer Case Study: A Successful Ransomware Intrusion Response
A small business contacted Progent after their network was crashed by Ryuk crypto-ransomware. Ryuk is thought to have been created by Northern Korean state cybercriminals, suspected of using algorithms exposed from America's National Security Agency. Ryuk targets specific organizations with little or no tolerance for operational disruption and is among the most profitable examples of ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in Chicago with about 500 workers. The Ryuk attack had shut down all company operations and manufacturing capabilities. The majority of the client's data backups had been online at the start of the intrusion and were damaged. The client considered paying the ransom (in excess of $200,000) and praying for the best, but ultimately reached out to Progent.

Progent worked together with the client to rapidly understand and prioritize the most important areas that had to be recovered to make it possible to continue company functions:

• Microsoft Active Directory
• Email
• MRP System

In less than 48 hours, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then charged ahead with rebuilding and storage recovery of critical servers. All Exchange schema and configuration information were intact, which greatly helped the restore of Exchange. Progent was also able to find local OST files (Outlook Email Offline Data Files) on team PCs in order to recover email data. A not too old offline backup of the businesses financials/ERP software made them able to restore these required applications back on-line. Although a large amount of work needed to be completed to recover fully from the Ryuk event, essential services were returned to operations rapidly:

During the following few weeks critical milestones in the restoration project were made through close collaboration between Progent engineers and the client:

• Internal web sites were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server exceeding 4 million archived emails was spun up and available for users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory functions were completely operational.
• A new Palo Alto Networks 850 security appliance was brought online.
• 90% of the desktops and laptops were back into operation.

Conclusion
A potential business extinction catastrophe was dodged due to hard-working experts, a broad array of technical expertise, and tight teamwork. Although in post mortem the ransomware penetration detailed here should have been shut down with modern security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and appropriate security procedures for data backup and proper patching controls, the fact is that state-sponsored hackers from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware attack, remember that Progent's team of experts has extensive experience in ransomware virus blocking, remediation, and data restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Charlotte
For ransomware cleanup services in the Charlotte metro area, call Progent at 800-462-8800 or see Contact Progent.