Ransomware Prevention and Recovery Solutions Dayton

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that poses an existential danger for businesses poorly prepared for an assault. Different versions of crypto-ransomware such as CrySIS, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been out in the wild for a long time and continue to cause harm. Newer variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus daily unnamed malware, not only do encryption of online data but also infiltrate many available system backup. Data synched to the cloud can also be rendered useless. In a poorly designed environment, it can make automatic restore operations useless and effectively sets the network back to square one.

Getting back online applications and data following a ransomware event becomes a race against time as the targeted organization fights to contain and eradicate the crypto-ransomware and to resume business-critical operations. Due to the fact that ransomware needs time to spread, attacks are often sprung during weekends and nights, when penetrations may take more time to uncover. This compounds the difficulty of quickly mobilizing and orchestrating a qualified mitigation team.

Progent provides a range of services for securing Dayton organizations from crypto-ransomware penetrations. Among these are staff training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat defense to identify and suppress zero-day malware assaults. Progent also can provide the assistance of seasoned ransomware recovery engineers with the talent and commitment to restore a breached environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a ransomware attack, even paying the ransom in Bitcoin cryptocurrency does not provide any assurance that criminal gangs will respond with the codes to decipher any or all of your information. Kaspersky Labs ascertained that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is well above the usual crypto-ransomware demands, which ZDNET determined to be in the range of $13,000 for small organizations. The fallback is to setup from scratch the vital parts of your Information Technology environment. Absent access to full data backups, this calls for a wide range of skill sets, well-coordinated project management, and the willingness to work 24x7 until the recovery project is finished.

For twenty years, Progent has made available expert IT services for companies across the US and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have attained top certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized certifications including CISM, CISSP, ISACA CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent also has experience in financial management and ERP application software. This breadth of expertise gives Progent the capability to quickly determine necessary systems and integrate the surviving parts of your computer network system following a ransomware attack and rebuild them into an operational system.

Progent's ransomware team of experts has state-of-the-art project management systems to orchestrate the complex restoration process. Progent knows the urgency of acting swiftly and together with a client's management and Information Technology resources to assign priority to tasks and to put key systems back on line as fast as possible.

Client Story: A Successful Crypto-Ransomware Penetration Response
A client contacted Progent after their organization was taken over by Ryuk ransomware. Ryuk is thought to have been developed by Northern Korean state sponsored hackers, suspected of adopting strategies leaked from America's NSA organization. Ryuk seeks specific companies with little room for operational disruption and is among the most lucrative instances of crypto-ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing business based in the Chicago metro area and has around 500 workers. The Ryuk attack had paralyzed all essential operations and manufacturing capabilities. Most of the client's data protection had been online at the beginning of the attack and were destroyed. The client was pursuing financing for paying the ransom (exceeding $200,000) and praying for good luck, but in the end called Progent.

Progent worked together with the customer to rapidly get our arms around and prioritize the essential services that needed to be addressed in order to continue business functions:

• Active Directory (AD)
• Electronic Messaging
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then completed reinstallations and hard drive recovery of the most important systems. All Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to find non-encrypted OST data files (Outlook Email Off-Line Data Files) on various desktop computers and laptops in order to recover mail information. A recent offline backup of the customer's accounting/ERP systems made them able to restore these required applications back online. Although a large amount of work still had to be done to recover completely from the Ryuk event, essential systems were restored quickly:

Throughout the next month important milestones in the recovery process were achieved through close collaboration between Progent engineers and the client:

• Internal web applications were restored without losing any data.
• The MailStore Server containing more than four million archived messages was spun up and accessible to users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory Control capabilities were fully restored.
• A new Palo Alto Networks 850 security appliance was deployed.
• Ninety percent of the desktops and laptops were being used by staff.

Conclusion
A probable business extinction disaster was evaded by hard-working experts, a wide array of IT skills, and tight teamwork. Although in post mortem the ransomware virus incident detailed here would have been disabled with advanced cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and appropriate incident response procedures for data backup and proper patching controls, the fact is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware incursion, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, remediation, and file disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Dayton
For ransomware recovery consulting services in the Dayton area, call Progent at 800-462-8800 or see Contact Progent.