Ransomware Prevention and Recovery Consulting Schaumburg

Crypto-Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Versions of ransomware such as Dharma, Fusob, Locky, NotPetya and MongoLock cryptoworms have been running rampant for many years and still inflict harm. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as additional unnamed viruses, not only encrypt on-line data files but also infiltrate any configured system protection mechanisms. Data replicated to cloud environments can also be rendered useless. In a poorly designed environment, this can render automatic restoration hopeless and effectively knocks the datacenter back to square one.

Recovering services and information following a ransomware intrusion becomes a sprint against the clock as the targeted organization tries its best to stop lateral movement, eradicate the crypto-ransomware, and restore enterprise-critical activity. Due to the fact that crypto-ransomware needs time to replicate across a network, attacks are frequently sprung during nights and weekends, when successful attacks tend to take more time to identify. This compounds the difficulty of promptly assembling and orchestrating an experienced response team.

Progent makes available a range of solutions for protecting Schaumburg businesses from ransomware penetrations. Among these are team training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to discover and quarantine day-zero malware attacks. Progent in addition provides the assistance of expert crypto-ransomware recovery engineers with the track record and perseverance to rebuild a compromised environment as urgently as possible.

Progent's Ransomware Restoration Help
Soon after a crypto-ransomware penetration, sending the ransom in cryptocurrency does not ensure that cyber hackers will provide the codes to decipher all your files. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their information after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The other path is to piece back together the essential parts of your Information Technology environment. Absent the availability of full system backups, this calls for a broad complement of skill sets, professional project management, and the capability to work continuously until the task is done.

For twenty years, Progent has offered expert Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained high-level certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of experience provides Progent the ability to rapidly identify important systems and integrate the surviving pieces of your computer network system following a ransomware attack and configure them into a functioning system.

Progent's security group uses state-of-the-art project management applications to orchestrate the complicated recovery process. Progent appreciates the urgency of acting swiftly and in concert with a customer's management and IT team members to assign priority to tasks and to get key services back online as fast as humanly possible.

Customer Case Study: A Successful Ransomware Penetration Restoration
A small business hired Progent after their network was taken over by Ryuk crypto-ransomware. Ryuk is believed to have been deployed by North Korean state criminal gangs, suspected of adopting technology exposed from the United States National Security Agency. Ryuk goes after specific companies with little or no tolerance for operational disruption and is one of the most lucrative versions of ransomware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturer located in the Chicago metro area and has around 500 workers. The Ryuk event had paralyzed all essential operations and manufacturing capabilities. The majority of the client's backups had been directly accessible at the beginning of the intrusion and were encrypted. The client considered paying the ransom (more than two hundred thousand dollars) and praying for good luck, but ultimately brought in Progent.

Progent worked with the customer to rapidly get our arms around and assign priority to the mission critical applications that had to be addressed to make it possible to resume departmental operations:

• Windows Active Directory
• E-Mail
• Financials/MRP

Within two days, Progent was able to recover Active Directory to its pre-attack state. Progent then helped perform setup and hard drive recovery of the most important servers. All Microsoft Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Off-Line Data Files) on team workstations and laptops in order to recover mail data. A recent off-line backup of the client's accounting/ERP software made it possible to return these essential programs back online. Although significant work remained to recover totally from the Ryuk event, critical services were returned to operations rapidly:

Over the following month important milestones in the recovery process were completed through close collaboration between Progent engineers and the customer:

• Self-hosted web applications were returned to operation without losing any information.
• The MailStore Server with over four million archived emails was spun up and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory modules were 100% recovered.
• A new Palo Alto Networks 850 security appliance was installed.
• 90% of the user PCs were functioning as before the incident.

Conclusion
A probable enterprise-killing catastrophe was avoided due to results-oriented experts, a broad range of knowledge, and close collaboration. Although in retrospect the ransomware virus penetration detailed here should have been blocked with advanced cyber security systems and recognized best practices, staff education, and appropriate security procedures for information backup and proper patching controls, the fact is that government-sponsored hackers from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware penetration, feel confident that Progent's team of experts has substantial experience in crypto-ransomware virus blocking, remediation, and information systems recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Schaumburg
For ransomware recovery services in the Schaumburg metro area, call Progent at 800-462-8800 or visit Contact Progent.