Ransomware Prevention and Cleanup Solutions Los Angeles

Crypto-Ransomware : Your Worst IT Disaster
Ransomware has become a modern cyberplague that poses an existential threat for organizations vulnerable to an assault. Multiple generations of ransomware such as CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for many years and continue to inflict damage. Newer strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, along with additional as yet unnamed viruses, not only encrypt on-line data but also infiltrate any accessible system protection. Data synched to the cloud can also be ransomed. In a poorly architected environment, this can make automatic restoration impossible and effectively sets the datacenter back to square one.

Recovering programs and information after a ransomware attack becomes a sprint against the clock as the targeted organization struggles to stop lateral movement, eradicate the ransomware, and resume mission-critical activity. Because ransomware takes time to spread throughout a network, assaults are often launched on weekends and holidays, when attacks are likely to take longer to detect. This multiplies the difficulty of quickly marshalling and coordinating an experienced mitigation team.

Progent has a variety of solutions for securing Los Angeles enterprises from ransomware events. Among these are team education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based threat defense to discover and suppress zero-day malware attacks. Progent also offers the services of experienced ransomware recovery professionals with the skills and perseverance to reconstruct a compromised network as soon as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will provide the needed keys to unencrypt any of your data. Kaspersky determined that seventeen percent of crypto-ransomware victims never restored their data even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to re-install the critical elements of your Information Technology environment. Without the availability of complete data backups, this calls for a broad complement of IT skills, well-coordinated project management, and the ability to work non-stop until the recovery project is done.

For twenty years, Progent has provided certified expert IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have been awarded high-level industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of expertise affords Progent the skills to quickly determine critical systems and integrate the remaining parts of your IT environment after a crypto-ransomware event and configure them into a functioning system.

Progent's ransomware group uses state-of-the-art project management systems to orchestrate the complex recovery process. Progent knows the importance of acting swiftly and together with a customer's management and IT staff to prioritize tasks and to put the most important systems back on-line as soon as humanly possible.

Case Study: A Successful Crypto-Ransomware Attack Restoration
A customer sought out Progent after their company was taken over by Ryuk crypto-ransomware. Ryuk is thought to have been launched by North Korean state hackers, suspected of adopting approaches leaked from America's National Security Agency. Ryuk attacks specific organizations with little or no ability to sustain operational disruption and is among the most lucrative examples of ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company based in Chicago with around 500 employees. The Ryuk penetration had paralyzed all essential operations and manufacturing capabilities. Most of the client's data backups had been online at the beginning of the attack and were encrypted. The client was pursuing financing for paying the ransom demand (in excess of $200,000) and hoping for the best, but in the end engaged Progent.

Progent worked together with the customer to quickly get our arms around and prioritize the most important services that needed to be restored to make it possible to resume company operations:

• Microsoft Active Directory
• Electronic Messaging
• Financials/MRP

Within 2 days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then assisted with reinstallations and storage recovery of critical servers. All Exchange ties and configuration information were usable, which greatly helped the restore of Exchange. Progent was also able to find local OST files (Outlook Email Off-Line Data Files) on team desktop computers and laptops in order to recover email information. A not too old off-line backup of the client's financials/MRP software made them able to restore these essential programs back online for users. Although a large amount of work remained to recover fully from the Ryuk damage, critical systems were returned to operations rapidly:

Throughout the next month important milestones in the restoration process were completed in tight cooperation between Progent team members and the client:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Server with over 4 million archived messages was restored to operations and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory capabilities were 100% operational.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the user workstations were functioning as before the incident.

Conclusion
A likely business-ending disaster was evaded due to dedicated professionals, a wide array of technical expertise, and close teamwork. Although in hindsight the ransomware penetration described here could have been identified and disabled with current security systems and ISO/IEC 27001 best practices, user and IT administrator training, and appropriate incident response procedures for backup and applying software patches, the reality remains that government-sponsored cyber criminals from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware penetration, feel confident that Progent's roster of professionals has proven experience in crypto-ransomware virus blocking, mitigation, and file recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Los Angeles
For ransomware system restoration consulting in the Los Angeles area, call Progent at 800-462-8800 or go to Contact Progent.