Ransomware Defense and Cleanup Expertise Honolulu

Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an existential danger for businesses poorly prepared for an assault. Different versions of ransomware like the CryptoLocker, Fusob, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for years and continue to inflict harm. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, along with additional as yet unnamed viruses, not only encrypt on-line information but also infect many configured system restores and backups. Information synchronized to off-premises disaster recovery sites can also be encrypted. In a vulnerable data protection solution, this can make automated restoration useless and effectively knocks the datacenter back to zero.

Retrieving services and information following a ransomware attack becomes a race against time as the targeted business tries its best to contain, cleanup the crypto-ransomware, and restore business-critical operations. Because ransomware needs time to move laterally throughout a network, penetrations are often sprung during weekends and nights, when penetrations may take longer to detect. This compounds the difficulty of promptly marshalling and organizing a capable mitigation team.

Progent provides an assortment of help services for securing Honolulu businesses from ransomware events. These include staff training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to detect and extinguish zero-day modern malware assaults. Progent also offers the services of expert crypto-ransomware recovery engineers with the track record and perseverance to reconstruct a compromised environment as urgently as possible.

Progent's Ransomware Restoration Help
Subsequent to a crypto-ransomware penetration, paying the ransom in cryptocurrency does not ensure that criminal gangs will respond with the codes to unencrypt all your information. Kaspersky Labs ascertained that 17% of ransomware victims never restored their data after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to piece back together the mission-critical elements of your Information Technology environment. Absent the availability of essential information backups, this requires a broad complement of skills, top notch team management, and the willingness to work 24x7 until the task is over.

For decades, Progent has provided professional Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained high-level certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of experience gives Progent the ability to rapidly ascertain necessary systems and integrate the surviving parts of your Information Technology system after a crypto-ransomware event and configure them into an operational system.

Progent's recovery team of experts deploys top notch project management tools to orchestrate the complex recovery process. Progent knows the urgency of acting swiftly and in unison with a customer's management and IT resources to assign priority to tasks and to put critical applications back on line as soon as humanly possible.

Customer Story: A Successful Crypto-Ransomware Intrusion Restoration
A client sought out Progent after their company was penetrated by the Ryuk crypto-ransomware. Ryuk is believed to have been created by North Korean state hackers, suspected of adopting strategies leaked from America's NSA organization. Ryuk goes after specific companies with little or no room for operational disruption and is one of the most profitable versions of ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in the Chicago metro area and has about 500 workers. The Ryuk attack had shut down all business operations and manufacturing capabilities. Most of the client's information backups had been online at the beginning of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom (more than $200,000) and wishfully thinking for the best, but in the end utilized Progent.

Progent worked hand in hand the customer to quickly identify and assign priority to the most important systems that needed to be restored to make it possible to restart company operations:

• Active Directory (AD)
• Microsoft Exchange
• MRP System

Within 48 hours, Progent was able to re-build Active Directory to its pre-attack state. Progent then assisted with rebuilding and storage recovery on essential servers. All Exchange Server schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to locate local OST data files (Outlook Off-Line Folder Files) on various workstations in order to recover mail data. A not too old off-line backup of the client's financials/MRP software made them able to recover these required applications back online. Although a large amount of work still had to be done to recover completely from the Ryuk event, critical systems were returned to operations rapidly:

Over the next few weeks key milestones in the recovery project were accomplished in tight cooperation between Progent engineers and the customer:

• Self-hosted web sites were brought back up without losing any data.
• The MailStore Exchange Server with over four million archived emails was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control modules were 100% restored.
• A new Palo Alto Networks 850 security appliance was set up.
• Ninety percent of the desktops and laptops were back into operation.

Conclusion
A probable business extinction disaster was averted by results-oriented professionals, a wide spectrum of knowledge, and tight teamwork. Although in retrospect the crypto-ransomware virus attack detailed here should have been identified and prevented with up-to-date security solutions and recognized best practices, staff education, and appropriate security procedures for data backup and keeping systems up to date with security patches, the fact remains that government-sponsored hackers from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's roster of professionals has a proven track record in ransomware virus blocking, removal, and file restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Honolulu
For ransomware system restoration consulting in the Honolulu metro area, call Progent at 800-462-8800 or see Contact Progent.