Ransomware Filtering and Removal Consulting Yonkers

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an existential threat for businesses unprepared for an attack. Versions of crypto-ransomware like the CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for many years and still cause harm. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as frequent unnamed viruses, not only do encryption of on-line information but also infect many available system protection mechanisms. Files synched to the cloud can also be encrypted. In a poorly architected system, this can render any restoration useless and basically knocks the entire system back to square one.

Getting back online applications and data after a ransomware intrusion becomes a race against the clock as the targeted organization tries its best to contain and eradicate the virus and to resume mission-critical activity. Because ransomware requires time to replicate, penetrations are usually launched on weekends and holidays, when attacks tend to take more time to uncover. This compounds the difficulty of promptly mobilizing and organizing a knowledgeable mitigation team.

Progent provides an assortment of services for securing Yonkers organizations from ransomware attacks. Among these are team education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of modern security solutions with AI technology to quickly identify and suppress zero-day cyber attacks. Progent in addition can provide the services of veteran crypto-ransomware recovery professionals with the talent and commitment to re-deploy a breached environment as soon as possible.

Progent's Ransomware Restoration Help
Soon after a crypto-ransomware attack, sending the ransom in cryptocurrency does not ensure that cyber criminals will respond with the codes to decrypt any of your information. Kaspersky Labs determined that 17% of crypto-ransomware victims never recovered their files after having paid the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is well higher than the usual ransomware demands, which ZDNET determined to be in the range of $13,000 for small businesses. The alternative is to piece back together the critical elements of your Information Technology environment. Without the availability of complete system backups, this calls for a wide complement of skills, top notch team management, and the capability to work continuously until the recovery project is over.

For twenty years, Progent has made available certified expert IT services for companies across the United States and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have earned top certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, and SANS GIAC. (See Progent's certifications). Progent also has expertise with accounting and ERP software solutions. This breadth of experience gives Progent the capability to rapidly ascertain critical systems and organize the remaining components of your computer network environment after a crypto-ransomware event and rebuild them into a functioning network.

Progent's security group uses top notch project management tools to coordinate the complicated recovery process. Progent knows the importance of working quickly and in unison with a customer's management and IT resources to prioritize tasks and to put key applications back online as fast as possible.

Customer Story: A Successful Ransomware Penetration Restoration
A small business contacted Progent after their network system was penetrated by the Ryuk ransomware. Ryuk is generally considered to have been deployed by Northern Korean government sponsored hackers, suspected of using techniques leaked from America's NSA organization. Ryuk targets specific businesses with little room for disruption and is among the most lucrative examples of ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in the Chicago metro area with about 500 workers. The Ryuk attack had shut down all business operations and manufacturing capabilities. The majority of the client's data backups had been online at the time of the intrusion and were destroyed. The client was taking steps for paying the ransom (in excess of $200K) and praying for good luck, but ultimately engaged Progent.

Progent worked together with the customer to quickly understand and assign priority to the critical elements that had to be recovered to make it possible to resume departmental operations:

• Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to restore Active Directory to its pre-virus state. Progent then helped perform setup and storage recovery of mission critical servers. All Exchange Server schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to collect non-encrypted OST data files (Outlook Email Off-Line Data Files) on staff workstations and laptops in order to recover mail messages. A recent offline backup of the businesses accounting/ERP software made them able to recover these essential services back online for users. Although significant work still had to be done to recover totally from the Ryuk attack, essential systems were restored quickly:

During the following month critical milestones in the restoration process were completed in tight collaboration between Progent consultants and the client:

• Self-hosted web sites were restored without losing any data.
• The MailStore Microsoft Exchange Server containing more than 4 million historical emails was brought online and available for users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control capabilities were fully restored.
• A new Palo Alto 850 security appliance was set up and programmed.
• Most of the desktop computers were fully operational.

Conclusion
A potential enterprise-killing disaster was evaded through the efforts of dedicated experts, a wide range of technical expertise, and close collaboration. Although upon completion of forensics the ransomware virus attack described here could have been identified and stopped with current cyber security systems and NIST Cybersecurity Framework best practices, user and IT administrator training, and well designed incident response procedures for backup and applying software patches, the reality remains that state-sponsored cybercriminals from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware virus, feel confident that Progent's team of experts has a proven track record in crypto-ransomware virus defense, removal, and file recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Yonkers
For ransomware system restoration consulting services in the Yonkers area, phone Progent at 800-462-8800 or go to Contact Progent.