Ransomware Prevention and Restoration Services Barueri-Alphaville

Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level threat for businesses of all sizes vulnerable to an assault. Different iterations of ransomware such as CryptoLocker, WannaCry, Locky, SamSam and MongoLock cryptoworms have been out in the wild for many years and still cause havoc. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, plus additional unnamed malware, not only perform encryption of on-line files but also infiltrate most available system backups. Information replicated to off-premises disaster recovery sites can also be corrupted. In a vulnerable environment, it can render automated recovery useless and basically knocks the entire system back to square one.

Getting back online services and information after a ransomware outage becomes a sprint against the clock as the targeted organization tries its best to stop lateral movement, remove the crypto-ransomware, and resume enterprise-critical operations. Since crypto-ransomware needs time to move laterally across a network, penetrations are frequently launched on weekends, when attacks may take more time to recognize. This multiplies the difficulty of quickly assembling and orchestrating a knowledgeable response team.

Progent has an assortment of solutions for securing Barueri-Alphaville enterprises from ransomware attacks. These include team member education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to detect and quarantine zero-day malware assaults. Progent also provides the assistance of seasoned crypto-ransomware recovery professionals with the track record and commitment to restore a compromised system as soon as possible.

Progent's Crypto-Ransomware Recovery Services
After a crypto-ransomware event, paying the ransom in cryptocurrency does not ensure that merciless criminals will respond with the needed codes to decipher any of your data. Kaspersky ascertained that seventeen percent of ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to piece back together the mission-critical components of your IT environment. Absent the availability of complete data backups, this requires a wide range of IT skills, well-coordinated project management, and the ability to work continuously until the task is completed.

For decades, Progent has made available professional Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of expertise affords Progent the skills to knowledgably understand important systems and integrate the surviving pieces of your Information Technology system following a ransomware attack and rebuild them into a functioning network.

Progent's ransomware group has state-of-the-art project management applications to coordinate the sophisticated recovery process. Progent understands the importance of working swiftly and in unison with a customer's management and IT team members to assign priority to tasks and to put critical services back on line as fast as possible.

Client Case Study: A Successful Ransomware Incident Response
A small business engaged Progent after their organization was crashed by Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state criminal gangs, possibly adopting approaches leaked from the United States NSA organization. Ryuk goes after specific companies with little or no tolerance for operational disruption and is among the most profitable examples of ransomware viruses. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in the Chicago metro area and has about 500 workers. The Ryuk penetration had brought down all essential operations and manufacturing processes. The majority of the client's data backups had been online at the beginning of the attack and were destroyed. The client was pursuing financing for paying the ransom (exceeding $200K) and praying for good luck, but in the end utilized Progent.

Progent worked hand in hand the client to rapidly determine and prioritize the key elements that had to be recovered in order to restart departmental operations:

• Active Directory (AD)
• Email
• Financials/MRP

Within two days, Progent was able to re-build Active Directory to its pre-virus state. Progent then assisted with rebuilding and hard drive recovery on the most important servers. All Exchange ties and attributes were usable, which facilitated the restore of Exchange. Progent was able to assemble local OST data files (Outlook Offline Data Files) on various workstations to recover email messages. A recent off-line backup of the client's accounting/ERP software made it possible to restore these essential services back on-line. Although a large amount of work needed to be completed to recover fully from the Ryuk attack, essential systems were restored quickly:

Over the next couple of weeks critical milestones in the recovery process were completed through tight collaboration between Progent team members and the client:

• Self-hosted web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was brought online and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were 100% recovered.
• A new Palo Alto 850 security appliance was set up.
• Ninety percent of the desktops and laptops were operational.

Conclusion
A potential company-ending catastrophe was averted through the efforts of top-tier professionals, a wide spectrum of IT skills, and tight collaboration. Although in hindsight the ransomware attack described here could have been prevented with up-to-date security technology solutions and ISO/IEC 27001 best practices, staff education, and well designed security procedures for backup and applying software patches, the reality remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware attack, remember that Progent's roster of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and data recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Barueri-Alphaville
For ransomware cleanup expertise in the Barueri-Alphaville metro area, call Progent at 800-462-8800 or visit Contact Progent.