Ransomware Filtering and Recovery Solutions Eugene

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a modern cyberplague that represents an extinction-level threat for organizations poorly prepared for an assault. Versions of ransomware like the CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for years and still inflict harm. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus frequent unnamed newcomers, not only perform encryption of online critical data but also infect many configured system backups. Information synchronized to cloud environments can also be rendered useless. In a vulnerable system, this can make automatic restoration impossible and effectively knocks the datacenter back to zero.

Getting back online programs and data after a crypto-ransomware outage becomes a race against the clock as the targeted organization struggles to stop lateral movement, remove the ransomware, and restore business-critical operations. Due to the fact that crypto-ransomware requires time to move laterally across a targeted network, attacks are usually sprung on weekends and holidays, when successful attacks tend to take more time to uncover. This compounds the difficulty of promptly marshalling and orchestrating an experienced mitigation team.

Progent has a variety of services for protecting Eugene enterprises from ransomware attacks. These include staff education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat defense to detect and suppress day-zero modern malware assaults. Progent in addition can provide the assistance of experienced ransomware recovery engineers with the track record and perseverance to re-deploy a breached system as rapidly as possible.

Progent's Ransomware Restoration Help
After a crypto-ransomware invasion, even paying the ransom in cryptocurrency does not ensure that merciless criminals will respond with the needed keys to decrypt all your data. Kaspersky Labs determined that 17% of ransomware victims never restored their data even after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to setup from scratch the vital components of your Information Technology environment. Without access to complete information backups, this requires a broad complement of skills, professional team management, and the willingness to work non-stop until the task is finished.

For two decades, Progent has offered professional IT services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in accounting and ERP application software. This breadth of experience affords Progent the capability to knowledgably determine necessary systems and organize the surviving pieces of your IT environment after a crypto-ransomware penetration and assemble them into an operational system.

Progent's ransomware team of experts uses powerful project management tools to orchestrate the sophisticated recovery process. Progent appreciates the importance of working rapidly and together with a client's management and IT team members to prioritize tasks and to put essential systems back on line as soon as possible.

Customer Story: A Successful Ransomware Intrusion Recovery
A client engaged Progent after their company was attacked by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state cybercriminals, suspected of using strategies exposed from the U.S. National Security Agency. Ryuk goes after specific companies with little tolerance for disruption and is one of the most lucrative incarnations of ransomware viruses. Headline victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturer located in the Chicago metro area with around 500 staff members. The Ryuk penetration had disabled all essential operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the beginning of the attack and were damaged. The client was actively seeking loans for paying the ransom (more than two hundred thousand dollars) and praying for good luck, but in the end engaged Progent.

Progent worked hand in hand the client to rapidly identify and prioritize the critical applications that had to be recovered to make it possible to resume company functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Accounting/MRP

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then initiated setup and hard drive recovery of mission critical systems. All Exchange Server schema and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to locate non-encrypted OST files (Microsoft Outlook Off-Line Folder Files) on various desktop computers to recover mail data. A recent offline backup of the client's accounting/ERP systems made it possible to return these vital programs back on-line. Although a lot of work was left to recover totally from the Ryuk virus, essential services were recovered rapidly:

During the following couple of weeks critical milestones in the recovery process were accomplished in tight cooperation between Progent consultants and the client:

• Internal web applications were returned to operation with no loss of data.
• The MailStore Exchange Server containing more than 4 million archived messages was restored to operations and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory functions were fully restored.
• A new Palo Alto 850 firewall was installed and configured.
• Most of the desktop computers were being used by staff.

Conclusion
A probable business-killing catastrophe was dodged through the efforts of results-oriented experts, a wide range of knowledge, and close collaboration. Although in retrospect the ransomware incident detailed here would have been disabled with current security solutions and security best practices, staff training, and appropriate incident response procedures for information backup and applying software patches, the fact is that state-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware virus, feel confident that Progent's team of professionals has proven experience in ransomware virus defense, remediation, and data restoration.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Eugene
For ransomware recovery expertise in the Eugene area, call Progent at 800-462-8800 or go to Contact Progent.