Ransomware Protection and Remediation Expertise Hialeah

Ransomware : Your Feared IT Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that poses an existential danger for businesses unprepared for an assault. Versions of ransomware such as Reveton, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been around for years and still inflict destruction. More recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, plus daily unnamed malware, not only perform encryption of on-line critical data but also infect many accessible system protection mechanisms. Data synchronized to cloud environments can also be rendered useless. In a poorly designed system, this can make automatic restoration hopeless and effectively knocks the datacenter back to square one.

Retrieving services and information following a ransomware attack becomes a sprint against time as the targeted business fights to contain the damage, clear the virus, and restore mission-critical operations. Due to the fact that ransomware requires time to move laterally throughout a network, assaults are frequently launched on weekends and holidays, when attacks may take longer to uncover. This compounds the difficulty of rapidly assembling and coordinating a qualified response team.

Progent offers a range of support services for securing Hialeah enterprises from ransomware events. These include team training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to identify and suppress zero-day modern malware attacks. Progent in addition provides the services of expert ransomware recovery engineers with the skills and perseverance to rebuild a compromised network as rapidly as possible.

Progent's Crypto-Ransomware Recovery Help
After a ransomware penetration, even paying the ransom demands in cryptocurrency does not ensure that cyber hackers will provide the needed codes to decrypt any or all of your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their information after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to re-install the key components of your Information Technology environment. Absent access to essential system backups, this calls for a wide range of skills, well-coordinated team management, and the capability to work continuously until the recovery project is completed.

For decades, Progent has provided professional IT services for businesses across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have been awarded high-level certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial systems and ERP application software. This breadth of expertise affords Progent the skills to knowledgably understand important systems and consolidate the surviving pieces of your Information Technology environment following a crypto-ransomware event and configure them into an operational network.

Progent's recovery team deploys best of breed project management systems to coordinate the sophisticated recovery process. Progent appreciates the importance of working swiftly and in unison with a client's management and IT resources to assign priority to tasks and to put critical services back on-line as soon as humanly possible.

Case Study: A Successful Crypto-Ransomware Penetration Response
A client hired Progent after their company was brought down by the Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean state cybercriminals, suspected of using techniques leaked from the U.S. NSA organization. Ryuk attacks specific companies with little room for operational disruption and is among the most profitable examples of crypto-ransomware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer headquartered in Chicago with about 500 staff members. The Ryuk event had paralyzed all business operations and manufacturing processes. Most of the client's data backups had been directly accessible at the beginning of the intrusion and were destroyed. The client was pursuing financing for paying the ransom (in excess of two hundred thousand dollars) and hoping for the best, but ultimately brought in Progent.

Progent worked with the customer to quickly identify and assign priority to the mission critical applications that had to be recovered to make it possible to restart departmental operations:

• Active Directory (AD)
• Microsoft Exchange
• MRP System

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-virus state. Progent then helped perform setup and hard drive recovery of mission critical servers. All Microsoft Exchange Server ties and configuration information were usable, which facilitated the restore of Exchange. Progent was also able to collect local OST data files (Microsoft Outlook Offline Folder Files) on team workstations to recover email messages. A not too old offline backup of the businesses accounting/MRP software made it possible to recover these vital services back servicing users. Although a large amount of work still had to be done to recover fully from the Ryuk event, essential systems were restored rapidly:

Throughout the next couple of weeks important milestones in the restoration project were accomplished in tight cooperation between Progent consultants and the customer:

• Self-hosted web applications were brought back up with no loss of information.
• The MailStore Server with over 4 million archived messages was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/AP/Accounts Receivables/Inventory modules were fully recovered.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the user workstations were being used by staff.

Conclusion
A likely business disaster was averted due to top-tier experts, a wide range of subject matter expertise, and close teamwork. Although upon completion of forensics the ransomware penetration described here would have been blocked with advanced cyber security technology and ISO/IEC 27001 best practices, user education, and properly executed security procedures for data protection and proper patching controls, the fact is that state-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware attack, remember that Progent's roster of professionals has substantial experience in ransomware virus defense, cleanup, and data recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Hialeah
For ransomware system restoration consulting in the Hialeah metro area, call Progent at 800-462-8800 or go to Contact Progent.