Ransomware Protection and Restoration Solutions Fort Myers

Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level danger for organizations poorly prepared for an attack. Multiple generations of ransomware like the Dharma, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been replicating for years and still cause damage. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as additional unnamed viruses, not only encrypt on-line information but also infect all accessible system protection. Data synched to cloud environments can also be rendered useless. In a poorly architected data protection solution, this can make automated recovery hopeless and basically knocks the network back to zero.

Getting back online applications and information following a ransomware attack becomes a race against the clock as the victim tries its best to stop the spread, clear the ransomware, and resume mission-critical operations. Because ransomware requires time to replicate across a network, attacks are usually launched during weekends and nights, when attacks typically take more time to discover. This compounds the difficulty of rapidly mobilizing and organizing a capable response team.

Progent makes available a range of services for protecting Fort Myers organizations from ransomware events. Among these are team member training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat defense to detect and disable day-zero malware attacks. Progent also offers the services of experienced crypto-ransomware recovery engineers with the talent and perseverance to reconstruct a compromised environment as quickly as possible.

Progent's Crypto-Ransomware Recovery Services
Subsequent to a crypto-ransomware event, even paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will respond with the needed keys to decipher any of your files. Kaspersky estimated that 17% of ransomware victims never recovered their files even after having paid the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to piece back together the critical elements of your Information Technology environment. Absent access to complete information backups, this requires a broad range of skills, top notch team management, and the willingness to work continuously until the task is completed.

For twenty years, Progent has offered expert IT services for businesses throughout the U.S. and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned top certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial systems and ERP application software. This breadth of expertise affords Progent the skills to efficiently understand critical systems and integrate the remaining pieces of your Information Technology environment after a ransomware event and configure them into a functioning network.

Progent's security group deploys powerful project management systems to orchestrate the complex recovery process. Progent understands the importance of acting rapidly and in unison with a client's management and Information Technology staff to assign priority to tasks and to put key applications back on-line as fast as possible.

Business Case Study: A Successful Crypto-Ransomware Penetration Response
A small business hired Progent after their network was crashed by Ryuk ransomware. Ryuk is believed to have been created by North Korean government sponsored hackers, possibly using algorithms leaked from the United States NSA organization. Ryuk attacks specific organizations with little room for operational disruption and is among the most lucrative versions of ransomware malware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer located in Chicago with about 500 employees. The Ryuk penetration had frozen all company operations and manufacturing processes. The majority of the client's backups had been directly accessible at the start of the attack and were encrypted. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and praying for good luck, but in the end made the decision to use Progent.

Progent worked together with the client to quickly get our arms around and prioritize the key elements that needed to be restored to make it possible to restart departmental functions:

• Windows Active Directory
• Microsoft Exchange Server
• Financials/MRP

In less than 2 days, Progent was able to re-build Active Directory services to its pre-virus state. Progent then charged ahead with setup and hard drive recovery on mission critical servers. All Exchange Server data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to find non-encrypted OST files (Microsoft Outlook Offline Data Files) on various workstations in order to recover mail data. A recent offline backup of the customer's manufacturing systems made it possible to restore these required applications back available to users. Although major work still had to be done to recover fully from the Ryuk attack, the most important services were returned to operations quickly:

Over the next couple of weeks important milestones in the restoration project were accomplished in tight collaboration between Progent consultants and the client:

• Internal web applications were returned to operation without losing any information.
• The MailStore Server exceeding four million archived messages was spun up and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control modules were fully operational.
• A new Palo Alto 850 firewall was deployed.
• Ninety percent of the user workstations were fully operational.

Conclusion
A likely enterprise-killing catastrophe was avoided with hard-working professionals, a broad spectrum of subject matter expertise, and close teamwork. Although upon completion of forensics the crypto-ransomware attack detailed here should have been shut down with advanced security technology and ISO/IEC 27001 best practices, team training, and well thought out incident response procedures for data protection and keeping systems up to date with security patches, the reality is that state-sponsored hackers from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's roster of professionals has extensive experience in ransomware virus blocking, mitigation, and file recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Fort Myers
For ransomware cleanup consulting services in the Fort Myers area, call Progent at 800-462-8800 or see Contact Progent.