Ransomware Protection and Restoration Consulting Salem

Ransomware : Your Feared Information Technology Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that poses an extinction-level danger for businesses vulnerable to an attack. Different iterations of ransomware such as Dharma, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been around for years and still cause destruction. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as additional as yet unnamed newcomers, not only perform encryption of on-line files but also infiltrate many configured system protection mechanisms. Information synched to the cloud can also be corrupted. In a poorly architected data protection solution, it can render automated restore operations useless and effectively sets the network back to square one.

Recovering programs and data after a ransomware attack becomes a sprint against time as the targeted organization struggles to stop lateral movement, clear the virus, and resume mission-critical activity. Due to the fact that crypto-ransomware needs time to spread across a targeted network, assaults are frequently sprung on weekends, when attacks tend to take longer to identify. This multiplies the difficulty of quickly assembling and organizing an experienced response team.

Progent has an assortment of help services for protecting Salem organizations from ransomware attacks. Among these are team member education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based threat defense to identify and disable zero-day malware assaults. Progent also can provide the assistance of experienced crypto-ransomware recovery professionals with the track record and commitment to restore a compromised network as quickly as possible.

Progent's Ransomware Restoration Help
Soon after a ransomware event, paying the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will respond with the needed keys to decipher any or all of your data. Kaspersky Labs estimated that seventeen percent of ransomware victims never restored their files after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The alternative is to setup from scratch the mission-critical elements of your IT environment. Absent the availability of complete information backups, this calls for a wide complement of skill sets, professional team management, and the willingness to work continuously until the task is over.

For twenty years, Progent has provided expert IT services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded top industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-recognized industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of experience provides Progent the capability to efficiently understand necessary systems and organize the surviving pieces of your IT system following a ransomware attack and rebuild them into an operational network.

Progent's security team has best of breed project management applications to orchestrate the complicated recovery process. Progent appreciates the importance of working swiftly and in concert with a client's management and IT resources to assign priority to tasks and to get the most important applications back online as fast as possible.

Client Story: A Successful Ransomware Intrusion Response
A small business contacted Progent after their organization was crashed by Ryuk ransomware virus. Ryuk is believed to have been deployed by North Korean state cybercriminals, suspected of adopting approaches exposed from the United States NSA organization. Ryuk goes after specific companies with little room for operational disruption and is among the most lucrative instances of ransomware viruses. Major organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer located in Chicago with around 500 staff members. The Ryuk penetration had frozen all company operations and manufacturing processes. Most of the client's information backups had been directly accessible at the beginning of the attack and were destroyed. The client considered paying the ransom demand (exceeding $200,000) and hoping for good luck, but in the end made the decision to use Progent.

Progent worked together with the customer to quickly identify and prioritize the key areas that had to be restored to make it possible to continue company operations:

• Active Directory (AD)
• Microsoft Exchange Email
• Accounting/MRP

In less than two days, Progent was able to recover Active Directory to its pre-virus state. Progent then accomplished reinstallations and storage recovery of critical servers. All Exchange ties and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to collect local OST files (Microsoft Outlook Off-Line Data Files) on user workstations and laptops in order to recover email information. A not too old offline backup of the customer's financials/ERP systems made it possible to recover these required applications back servicing users. Although significant work still had to be done to recover completely from the Ryuk event, the most important services were recovered rapidly:

Throughout the following couple of weeks key milestones in the restoration project were accomplished in close collaboration between Progent team members and the customer:

• Self-hosted web applications were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server exceeding four million historical emails was brought online and available for users.
• CRM/Orders/Invoices/AP/Accounts Receivables/Inventory capabilities were completely operational.
• A new Palo Alto Networks 850 security appliance was set up.
• 90% of the user workstations were fully operational.

Conclusion
A potential business extinction catastrophe was evaded by top-tier professionals, a wide array of technical expertise, and tight collaboration. Although in analyzing the event afterwards the crypto-ransomware virus penetration detailed here would have been disabled with advanced security solutions and ISO/IEC 27001 best practices, staff education, and well thought out incident response procedures for backup and applying software patches, the reality remains that government-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware incursion, feel confident that Progent's team of experts has extensive experience in ransomware virus defense, cleanup, and information systems restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Salem
For ransomware recovery expertise in the Salem metro area, phone Progent at 800-462-8800 or visit Contact Progent.