Ransomware Filtering and Restoration Consulting Baton Rouge

Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware has become an escalating cyberplague that represents an extinction-level danger for organizations unprepared for an assault. Multiple generations of crypto-ransomware such as CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for years and still inflict harm. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with frequent as yet unnamed viruses, not only encrypt on-line information but also infiltrate many accessible system protection mechanisms. Data replicated to off-premises disaster recovery sites can also be rendered useless. In a poorly architected system, it can make any recovery impossible and effectively knocks the datacenter back to square one.

Recovering services and data following a crypto-ransomware intrusion becomes a race against the clock as the targeted organization fights to contain, cleanup the crypto-ransomware, and restore enterprise-critical operations. Due to the fact that ransomware takes time to replicate throughout a network, attacks are often sprung on weekends and holidays, when successful attacks may take longer to uncover. This multiplies the difficulty of rapidly assembling and orchestrating a qualified mitigation team.

Progent offers a range of solutions for securing Baton Rouge organizations from crypto-ransomware attacks. Among these are staff education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to discover and suppress day-zero malware attacks. Progent in addition provides the services of expert ransomware recovery professionals with the talent and perseverance to re-deploy a breached network as rapidly as possible.

Progent's Ransomware Restoration Support Services
Soon after a crypto-ransomware event, paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will return the codes to unencrypt any of your information. Kaspersky Labs determined that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to re-install the key components of your IT environment. Absent access to essential data backups, this requires a wide range of IT skills, professional team management, and the willingness to work continuously until the job is over.

For twenty years, Progent has made available expert IT services for companies across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have been awarded advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with accounting and ERP application software. This breadth of expertise affords Progent the ability to efficiently identify important systems and integrate the surviving components of your IT environment following a ransomware attack and assemble them into an operational network.

Progent's ransomware team of experts has state-of-the-art project management systems to coordinate the sophisticated recovery process. Progent knows the importance of working swiftly and in unison with a customer's management and Information Technology team members to prioritize tasks and to get the most important applications back on-line as soon as possible.

Case Study: A Successful Ransomware Intrusion Response
A client sought out Progent after their organization was taken over by Ryuk ransomware virus. Ryuk is believed to have been developed by North Korean state cybercriminals, suspected of using technology exposed from America's NSA organization. Ryuk seeks specific businesses with little ability to sustain disruption and is among the most profitable versions of ransomware viruses. Headline targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in the Chicago metro area with around 500 workers. The Ryuk attack had shut down all business operations and manufacturing capabilities. The majority of the client's information backups had been online at the time of the intrusion and were damaged. The client considered paying the ransom (more than $200K) and praying for the best, but in the end called Progent.

Progent worked together with the client to rapidly assess and assign priority to the key elements that needed to be addressed in order to resume departmental operations:

• Windows Active Directory
• Electronic Mail
• Financials/MRP

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-virus state. Progent then charged ahead with setup and hard drive recovery of essential systems. All Exchange Server schema and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble local OST data files (Outlook Offline Data Files) on team PCs and laptops to recover mail information. A not too old offline backup of the businesses manufacturing software made it possible to recover these vital services back on-line. Although major work remained to recover completely from the Ryuk event, critical services were recovered quickly:

During the next couple of weeks critical milestones in the recovery process were completed through tight cooperation between Progent engineers and the client:

• Internal web applications were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control modules were fully recovered.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• 90% of the user PCs were operational.

Conclusion
A probable enterprise-killing catastrophe was averted due to top-tier experts, a wide range of technical expertise, and close collaboration. Although in post mortem the crypto-ransomware incident described here could have been prevented with up-to-date security technology and ISO/IEC 27001 best practices, staff training, and appropriate incident response procedures for information protection and keeping systems up to date with security patches, the reality remains that government-sponsored cyber criminals from China, North Korea and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware virus, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, cleanup, and file disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Baton Rouge
For ransomware cleanup expertise in the Baton Rouge area, call Progent at 800-462-8800 or go to Contact Progent.