Ransomware Defense and Recovery Solutions Fort Collins

Crypto-Ransomware : Your Crippling IT Disaster
Ransomware has become a modern cyberplague that presents an enterprise-level threat for businesses of all sizes vulnerable to an attack. Different versions of ransomware such as CrySIS, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been replicating for many years and still inflict havoc. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, plus daily as yet unnamed viruses, not only perform encryption of online data files but also infect most configured system protection mechanisms. Information synchronized to cloud environments can also be rendered useless. In a vulnerable system, this can make automatic restore operations hopeless and basically sets the network back to square one.

Getting back services and information after a ransomware attack becomes a sprint against time as the targeted business struggles to stop lateral movement, remove the ransomware, and resume business-critical operations. Due to the fact that ransomware takes time to move laterally across a network, attacks are frequently sprung during nights and weekends, when attacks typically take more time to discover. This multiplies the difficulty of quickly mobilizing and organizing a qualified mitigation team.

Progent provides an assortment of help services for protecting Fort Collins organizations from ransomware penetrations. These include staff training to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat protection to identify and extinguish day-zero malware attacks. Progent in addition can provide the assistance of expert ransomware recovery professionals with the talent and commitment to re-deploy a breached system as soon as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware event, paying the ransom demands in cryptocurrency does not ensure that merciless criminals will provide the needed codes to unencrypt any or all of your files. Kaspersky determined that seventeen percent of ransomware victims never restored their files even after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The alternative is to re-install the key elements of your Information Technology environment. Without the availability of full information backups, this requires a wide complement of IT skills, professional project management, and the ability to work 24x7 until the task is over.

For twenty years, Progent has provided expert IT services for companies across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have been awarded advanced industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP application software. This breadth of expertise gives Progent the skills to efficiently determine critical systems and re-organize the remaining pieces of your network environment after a ransomware attack and configure them into an operational system.

Progent's ransomware team of experts deploys best of breed project management applications to orchestrate the complicated recovery process. Progent understands the importance of working rapidly and in concert with a customer's management and Information Technology resources to prioritize tasks and to get critical services back on-line as fast as humanly possible.

Client Story: A Successful Ransomware Virus Restoration
A small business hired Progent after their company was crashed by the Ryuk ransomware virus. Ryuk is believed to have been developed by North Korean state sponsored cybercriminals, suspected of adopting technology leaked from the United States National Security Agency. Ryuk targets specific organizations with little or no tolerance for operational disruption and is one of the most profitable examples of ransomware malware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer located in the Chicago metro area and has around 500 employees. The Ryuk attack had brought down all company operations and manufacturing processes. Most of the client's information backups had been on-line at the start of the intrusion and were eventually encrypted. The client was evaluating paying the ransom (in excess of two hundred thousand dollars) and hoping for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the client to quickly identify and prioritize the most important applications that had to be restored to make it possible to continue business operations:

• Active Directory (AD)
• Microsoft Exchange Server
• Financials/MRP

Within two days, Progent was able to re-build Active Directory services to its pre-attack state. Progent then accomplished reinstallations and storage recovery of essential applications. All Exchange Server schema and attributes were intact, which accelerated the restore of Exchange. Progent was able to find local OST data files (Outlook Off-Line Folder Files) on various PCs in order to recover mail information. A not too old off-line backup of the businesses accounting systems made it possible to return these required applications back on-line. Although a lot of work remained to recover completely from the Ryuk attack, critical systems were recovered rapidly:

During the following couple of weeks important milestones in the restoration project were made in tight cooperation between Progent consultants and the customer:

• Internal web sites were brought back up without losing any data.
• The MailStore Server exceeding four million archived emails was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory functions were fully functional.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Ninety percent of the desktop computers were operational.

Conclusion
A likely business catastrophe was averted through the efforts of results-oriented experts, a broad array of IT skills, and tight collaboration. Although in retrospect the crypto-ransomware incident described here should have been prevented with modern cyber security systems and security best practices, user and IT administrator training, and appropriate security procedures for data backup and proper patching controls, the reality remains that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's team of experts has extensive experience in crypto-ransomware virus defense, removal, and information systems restoration.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Fort Collins
For ransomware system recovery consulting services in the Fort Collins metro area, phone Progent at 800-462-8800 or go to Contact Progent.