Ransomware Protection and Remediation Solutions Reno

Crypto-Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become an escalating cyber pandemic that presents an enterprise-level danger for businesses of all sizes unprepared for an assault. Versions of ransomware such as CrySIS, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for a long time and continue to inflict destruction. Newer variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus more as yet unnamed viruses, not only perform encryption of on-line files but also infect any accessible system backup. Files replicated to the cloud can also be ransomed. In a poorly architected system, this can render any restore operations impossible and basically knocks the entire system back to zero.

Recovering services and information after a crypto-ransomware event becomes a sprint against time as the targeted organization struggles to contain, remove the ransomware, and restore mission-critical activity. Due to the fact that ransomware takes time to spread throughout a network, attacks are frequently launched on weekends and holidays, when attacks typically take more time to detect. This compounds the difficulty of rapidly assembling and orchestrating an experienced response team.

Progent provides a variety of solutions for securing Reno businesses from ransomware attacks. These include team member training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to identify and disable zero-day malware attacks. Progent also can provide the services of seasoned crypto-ransomware recovery engineers with the talent and commitment to reconstruct a breached network as quickly as possible.

Progent's Ransomware Recovery Support Services
After a ransomware event, paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will provide the needed codes to decrypt any or all of your data. Kaspersky estimated that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to piece back together the vital components of your IT environment. Without the availability of essential system backups, this requires a broad range of skill sets, professional project management, and the capability to work 24x7 until the task is finished.

For decades, Progent has provided certified expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned advanced certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-renowned certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of experience provides Progent the capability to efficiently identify important systems and organize the remaining parts of your computer network environment following a ransomware event and configure them into a functioning system.

Progent's recovery team of experts utilizes best of breed project management systems to coordinate the complicated recovery process. Progent appreciates the importance of working rapidly and in concert with a customer's management and IT team members to assign priority to tasks and to get essential services back online as soon as possible.

Business Case Study: A Successful Ransomware Intrusion Recovery
A client contacted Progent after their company was brought down by Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean state sponsored criminal gangs, possibly adopting algorithms leaked from America's NSA organization. Ryuk targets specific organizations with little ability to sustain operational disruption and is among the most profitable incarnations of ransomware malware. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business headquartered in Chicago and has about 500 employees. The Ryuk intrusion had brought down all company operations and manufacturing capabilities. Most of the client's backups had been online at the start of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (exceeding $200,000) and praying for good luck, but ultimately brought in Progent.

Progent worked together with the client to rapidly get our arms around and assign priority to the essential elements that needed to be addressed in order to resume business operations:

• Microsoft Active Directory
• E-Mail
• Accounting/MRP

Within 48 hours, Progent was able to re-build Active Directory to its pre-virus state. Progent then charged ahead with rebuilding and hard drive recovery on essential systems. All Exchange Server ties and attributes were intact, which accelerated the restore of Exchange. Progent was able to locate intact OST files (Outlook Email Offline Folder Files) on staff desktop computers and laptops to recover mail data. A not too old off-line backup of the customer's manufacturing systems made them able to recover these essential services back available to users. Although a lot of work needed to be completed to recover totally from the Ryuk event, the most important systems were restored rapidly:

During the following couple of weeks critical milestones in the restoration project were made in close collaboration between Progent consultants and the customer:

• In-house web applications were returned to operation without losing any data.
• The MailStore Server exceeding four million historical emails was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were 100 percent recovered.
• A new Palo Alto 850 security appliance was installed and configured.
• 90% of the desktop computers were fully operational.

Conclusion
A potential business extinction catastrophe was dodged due to top-tier professionals, a wide spectrum of IT skills, and close collaboration. Although in hindsight the ransomware virus incident described here should have been prevented with advanced security solutions and recognized best practices, user and IT administrator education, and properly executed security procedures for information protection and keeping systems up to date with security patches, the reality is that government-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a ransomware attack, feel confident that Progent's team of experts has extensive experience in ransomware virus defense, cleanup, and data restoration.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Reno
For ransomware recovery consulting in the Reno metro area, call Progent at 800-462-8800 or go to Contact Progent.