Ransomware Protection and Restoration Solutions Edison

Ransomware : Your Crippling IT Disaster
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level danger for businesses unprepared for an attack. Multiple generations of ransomware such as CrySIS, Fusob, Locky, Syskey and MongoLock cryptoworms have been replicating for years and continue to inflict havoc. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, along with frequent as yet unnamed newcomers, not only encrypt on-line files but also infect any accessible system protection mechanisms. Data synchronized to off-site disaster recovery sites can also be rendered useless. In a poorly architected environment, this can render any restore operations hopeless and basically sets the network back to zero.

Retrieving programs and data following a ransomware event becomes a race against the clock as the targeted organization tries its best to contain the damage and cleanup the virus and to restore enterprise-critical activity. Due to the fact that ransomware needs time to spread, attacks are frequently launched on weekends and holidays, when attacks tend to take more time to discover. This compounds the difficulty of rapidly mobilizing and organizing a capable mitigation team.

Progent has a range of solutions for protecting Edison organizations from ransomware events. These include team member training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to discover and extinguish zero-day malware attacks. Progent also can provide the assistance of seasoned crypto-ransomware recovery consultants with the talent and commitment to reconstruct a compromised environment as soon as possible.

Progent's Ransomware Recovery Help
Soon after a crypto-ransomware event, sending the ransom in cryptocurrency does not provide any assurance that cyber criminals will provide the keys to unencrypt any or all of your data. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is significantly higher than the usual ransomware demands, which ZDNET estimated to be approximately $13,000 for smaller businesses. The other path is to re-install the essential components of your IT environment. Without the availability of full system backups, this requires a broad complement of IT skills, well-coordinated project management, and the willingness to work continuously until the job is completed.

For twenty years, Progent has provided expert IT services for companies throughout the US and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained advanced certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, and GIAC. (Visit Progent's certifications). Progent also has experience in accounting and ERP applications. This breadth of experience provides Progent the ability to knowledgably determine important systems and consolidate the surviving components of your Information Technology environment after a ransomware penetration and configure them into a functioning system.

Progent's recovery team of experts has best of breed project management applications to orchestrate the complex restoration process. Progent knows the urgency of acting rapidly and in concert with a client's management and IT resources to assign priority to tasks and to get essential services back on-line as fast as possible.

Business Case Study: A Successful Ransomware Intrusion Recovery
A small business contacted Progent after their network system was crashed by the Ryuk crypto-ransomware. Ryuk is thought to have been developed by Northern Korean state criminal gangs, suspected of using approaches exposed from America's National Security Agency. Ryuk seeks specific organizations with limited ability to sustain operational disruption and is among the most profitable examples of crypto-ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing business based in Chicago and has around 500 workers. The Ryuk attack had shut down all company operations and manufacturing processes. Most of the client's backups had been online at the start of the intrusion and were eventually encrypted. The client considered paying the ransom (exceeding $200K) and hoping for good luck, but in the end reached out to Progent.

Progent worked with the customer to quickly understand and assign priority to the key services that needed to be restored in order to resume company functions:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

Within two days, Progent was able to restore Active Directory to its pre-penetration state. Progent then charged ahead with setup and storage recovery of essential servers. All Exchange Server ties and configuration information were intact, which accelerated the restore of Exchange. Progent was able to find non-encrypted OST data files (Outlook Email Offline Folder Files) on team PCs to recover email data. A not too old offline backup of the businesses accounting/ERP systems made it possible to recover these essential services back on-line. Although major work was left to recover totally from the Ryuk virus, core systems were restored quickly:

During the next few weeks key milestones in the restoration project were completed in close cooperation between Progent engineers and the customer:

• Internal web sites were returned to operation without losing any information.
• The MailStore Exchange Server exceeding 4 million archived messages was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory Control capabilities were fully operational.
• A new Palo Alto Networks 850 firewall was installed.
• Most of the desktops and laptops were back into operation.

Conclusion
A potential business extinction catastrophe was averted through the efforts of hard-working experts, a wide spectrum of IT skills, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware incident detailed here would have been identified and stopped with current cyber security solutions and recognized best practices, user education, and well designed security procedures for information backup and proper patching controls, the fact remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's roster of experts has extensive experience in crypto-ransomware virus blocking, mitigation, and file restoration.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Edison
For ransomware system restoration consulting services in the Edison metro area, phone Progent at 800-462-8800 or go to Contact Progent.