Ransomware Defense and Remediation Solutions Uberlândia

Crypto-Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyber pandemic that represents an extinction-level threat for businesses of all sizes poorly prepared for an assault. Different versions of crypto-ransomware like the Dharma, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for years and continue to inflict destruction. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, as well as more unnamed malware, not only do encryption of online data files but also infect any accessible system protection mechanisms. Information synchronized to cloud environments can also be encrypted. In a poorly designed system, it can render automated recovery impossible and basically sets the datacenter back to square one.

Getting back online applications and data after a ransomware attack becomes a race against time as the targeted organization struggles to stop the spread and clear the crypto-ransomware and to restore enterprise-critical operations. Since ransomware needs time to move laterally, penetrations are usually sprung on weekends, when successful attacks in many cases take longer to identify. This multiplies the difficulty of quickly mobilizing and orchestrating an experienced response team.

Progent offers an assortment of support services for protecting Uberlândia businesses from crypto-ransomware penetrations. These include user education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to identify and suppress zero-day malware attacks. Progent also provides the assistance of seasoned ransomware recovery consultants with the talent and commitment to re-deploy a breached system as soon as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a ransomware attack, sending the ransom demands in Bitcoin cryptocurrency does not provide any assurance that cyber criminals will return the needed keys to decipher all your files. Kaspersky determined that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms frequently range from fifteen to forty BTC ($120,000 and $400,000). This is greatly higher than the typical crypto-ransomware demands, which ZDNET estimated to be around $13,000 for small organizations. The alternative is to piece back together the critical components of your IT environment. Without access to full data backups, this calls for a broad complement of skill sets, well-coordinated project management, and the capability to work 24x7 until the job is over.

For two decades, Progent has offered certified expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have earned high-level certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned certifications including CISA, CISSP, CRISC, and SANS GIAC. (See Progent's certifications). Progent also has expertise in accounting and ERP application software. This breadth of experience provides Progent the skills to quickly ascertain necessary systems and integrate the remaining pieces of your computer network system following a ransomware event and assemble them into a functioning system.

Progent's ransomware team of experts has best of breed project management applications to orchestrate the sophisticated recovery process. Progent appreciates the importance of acting rapidly and together with a customer's management and IT team members to assign priority to tasks and to put the most important systems back on-line as fast as humanly possible.

Case Study: A Successful Crypto-Ransomware Incident Recovery
A customer escalated to Progent after their company was brought down by Ryuk crypto-ransomware. Ryuk is believed to have been launched by Northern Korean state sponsored hackers, possibly using approaches exposed from the U.S. National Security Agency. Ryuk seeks specific organizations with little ability to sustain operational disruption and is among the most lucrative versions of ransomware malware. Headline victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in Chicago and has about 500 staff members. The Ryuk attack had shut down all essential operations and manufacturing processes. Most of the client's data backups had been directly accessible at the beginning of the attack and were encrypted. The client considered paying the ransom (exceeding $200K) and hoping for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the client to rapidly assess and assign priority to the key services that had to be recovered in order to continue departmental operations:

• Active Directory
• Electronic Mail
• MRP System

In less than 48 hours, Progent was able to re-build Active Directory to its pre-virus state. Progent then performed reinstallations and hard drive recovery of mission critical applications. All Exchange Server schema and attributes were intact, which greatly helped the restore of Exchange. Progent was also able to find intact OST data files (Outlook Email Off-Line Folder Files) on staff desktop computers in order to recover email messages. A not too old offline backup of the client's financials/MRP software made it possible to restore these essential applications back online for users. Although significant work still had to be done to recover fully from the Ryuk event, essential services were returned to operations rapidly:

Over the following couple of weeks key milestones in the recovery process were made in close cooperation between Progent consultants and the customer:

• Internal web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million historical emails was brought online and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control capabilities were 100% recovered.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Most of the user workstations were operational.

Conclusion
A probable business-ending catastrophe was dodged with dedicated professionals, a broad range of knowledge, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware virus incident described here would have been identified and prevented with up-to-date security solutions and NIST Cybersecurity Framework best practices, user training, and well designed incident response procedures for data protection and proper patching controls, the fact remains that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a crypto-ransomware incident, feel confident that Progent's roster of professionals has extensive experience in ransomware virus defense, removal, and file disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Uberlândia
For ransomware cleanup services in the Uberlândia area, call Progent at 800-462-8800 or see Contact Progent.