Ransomware Defense and Recovery Expertise Mesa

Crypto-Ransomware : Your Feared IT Catastrophe
Ransomware has become a modern cyber pandemic that poses an extinction-level danger for businesses of all sizes unprepared for an assault. Different iterations of crypto-ransomware like the CryptoLocker, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been around for many years and continue to inflict damage. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with more as yet unnamed viruses, not only do encryption of on-line data but also infect all configured system protection mechanisms. Information synchronized to the cloud can also be rendered useless. In a poorly architected data protection solution, this can make automated restore operations impossible and effectively knocks the network back to zero.

Restoring applications and information after a ransomware attack becomes a race against time as the targeted business fights to stop lateral movement and eradicate the ransomware and to resume mission-critical operations. Because crypto-ransomware requires time to spread, assaults are often launched during nights and weekends, when successful penetrations typically take longer to notice. This compounds the difficulty of rapidly assembling and organizing an experienced response team.

Progent makes available a range of support services for protecting Mesa businesses from ransomware attacks. These include team member training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of the latest generation security solutions with machine learning capabilities to quickly identify and suppress new cyber threats. Progent also can provide the assistance of seasoned ransomware recovery engineers with the track record and perseverance to re-deploy a breached system as urgently as possible.

Progent's Ransomware Recovery Support Services
After a ransomware event, even paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will return the needed keys to decrypt any of your files. Kaspersky Labs determined that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is significantly higher than the usual ransomware demands, which ZDNET determined to be approximately $13,000 for smaller organizations. The other path is to piece back together the essential elements of your Information Technology environment. Without access to full information backups, this calls for a wide complement of skill sets, top notch team management, and the capability to work 24x7 until the job is complete.

For two decades, Progent has made available professional Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have attained advanced industry certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP application software. This breadth of expertise provides Progent the capability to quickly understand critical systems and re-organize the surviving components of your network environment following a ransomware event and assemble them into a functioning system.

Progent's recovery team of experts utilizes top notch project management applications to orchestrate the complex restoration process. Progent appreciates the importance of working rapidly and together with a client's management and IT team members to prioritize tasks and to get essential services back on-line as soon as possible.

Business Case Study: A Successful Ransomware Virus Restoration
A business sought out Progent after their company was penetrated by the Ryuk crypto-ransomware. Ryuk is generally considered to have been launched by North Korean government sponsored criminal gangs, possibly adopting strategies exposed from the U.S. National Security Agency. Ryuk goes after specific businesses with little or no room for operational disruption and is one of the most lucrative incarnations of ransomware malware. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in the Chicago metro area and has around 500 workers. The Ryuk intrusion had shut down all business operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the beginning of the intrusion and were damaged. The client was taking steps for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately utilized Progent.

Progent worked hand in hand the client to rapidly assess and assign priority to the critical systems that had to be restored to make it possible to resume departmental functions:

• Active Directory (AD)
• Exchange Server
• Accounting and Manufacturing Software

Within two days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then accomplished rebuilding and hard drive recovery of essential applications. All Microsoft Exchange Server schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to assemble intact OST data files (Outlook Email Offline Data Files) on user workstations and laptops in order to recover email messages. A not too old off-line backup of the businesses financials/ERP software made it possible to return these required applications back on-line. Although significant work was left to recover totally from the Ryuk virus, critical services were recovered rapidly:

Over the following few weeks critical milestones in the recovery process were made in tight cooperation between Progent consultants and the client:

• Internal web applications were returned to operation without losing any data.
• The MailStore Exchange Server exceeding 4 million archived messages was brought on-line and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory capabilities were 100% operational.
• A new Palo Alto 850 firewall was brought online.
• 90% of the user workstations were being used by staff.

Conclusion
A probable business catastrophe was avoided by results-oriented experts, a broad range of subject matter expertise, and tight collaboration. Although in retrospect the crypto-ransomware penetration described here could have been disabled with current cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and well designed security procedures for information protection and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's team of experts has substantial experience in ransomware virus defense, removal, and information systems disaster recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

File body_ransomware_recovery_contact_city.asp does not exist