Ransomware Prevention and Cleanup Consulting

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become an escalating cyberplague that represents an enterprise-level threat for businesses of all sizes unprepared for an assault. Multiple generations of ransomware such as Reveton, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for a long time and still cause destruction. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as frequent unnamed newcomers, not only do encryption of on-line files but also infiltrate most available system protection mechanisms. Files synchronized to the cloud can also be encrypted. In a poorly architected system, it can make automated restore operations useless and basically knocks the datacenter back to square one.

Recovering applications and information after a crypto-ransomware event becomes a race against time as the targeted organization struggles to stop lateral movement and remove the ransomware and to resume mission-critical operations. Due to the fact that crypto-ransomware needs time to move laterally, assaults are usually sprung during weekends and nights, when successful penetrations are likely to take longer to identify. This multiplies the difficulty of promptly marshalling and orchestrating an experienced response team.

Progent offers a variety of solutions for protecting enterprises from crypto-ransomware penetrations. Among these are team education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus installation of modern security gateways with SentinelOne's artificial intelligence capabilities to identify and quarantine day-zero threats automatically. Progent in addition can provide the services of experienced crypto-ransomware recovery consultants with the talent and commitment to re-deploy a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Services
Subsequent to a crypto-ransomware event, paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will return the codes to decipher any of your data. Kaspersky ascertained that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is well above the average crypto-ransomware demands, which ZDNET determined to be approximately $13,000 for smaller organizations. The other path is to piece back together the critical parts of your IT environment. Absent the availability of essential information backups, this calls for a wide complement of skills, professional team management, and the ability to work non-stop until the job is finished.

For two decades, Progent has made available certified expert Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded high-level certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, and SANS GIAC. (See Progent's certifications). Progent also has expertise in financial management and ERP application software. This breadth of expertise provides Progent the skills to knowledgably ascertain necessary systems and consolidate the surviving components of your network environment following a ransomware attack and rebuild them into an operational network.

Progent's ransomware team of experts deploys state-of-the-art project management systems to coordinate the sophisticated restoration process. Progent understands the importance of working rapidly and together with a customer's management and Information Technology resources to assign priority to tasks and to get key systems back on line as fast as possible.

Client Case Study: A Successful Ransomware Incident Recovery
A client engaged Progent after their network system was brought down by Ryuk ransomware. Ryuk is thought to have been developed by North Korean state hackers, suspected of using approaches exposed from the U.S. National Security Agency. Ryuk goes after specific businesses with little or no room for disruption and is one of the most lucrative examples of ransomware viruses. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer located in Chicago with about 500 workers. The Ryuk penetration had paralyzed all essential operations and manufacturing processes. Most of the client's system backups had been online at the time of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (exceeding $200K) and wishfully thinking for the best, but ultimately utilized Progent.

Progent worked together with the client to rapidly understand and prioritize the key applications that had to be restored in order to resume departmental operations:

• Active Directory
• Microsoft Exchange Server
• Accounting/MRP

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then initiated reinstallations and storage recovery on mission critical applications. All Exchange data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to find non-encrypted OST data files (Outlook Offline Data Files) on staff desktop computers and laptops to recover mail messages. A not too old offline backup of the customer's accounting/MRP systems made them able to restore these vital services back on-line. Although a lot of work remained to recover fully from the Ryuk attack, critical systems were restored rapidly:

Over the next few weeks key milestones in the restoration project were accomplished through tight collaboration between Progent consultants and the customer:

• Internal web sites were returned to operation without losing any information.
• The MailStore Exchange Server with over four million archived emails was brought on-line and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control functions were completely recovered.
• A new Palo Alto Networks 850 security appliance was brought online.
• Ninety percent of the desktops and laptops were fully operational.

Conclusion
A potential business-killing catastrophe was averted by top-tier experts, a broad range of IT skills, and close collaboration. Although upon completion of forensics the ransomware virus incident detailed here should have been shut down with up-to-date cyber security technology and NIST Cybersecurity Framework best practices, user and IT administrator education, and well thought out security procedures for backup and keeping systems up to date with security patches, the fact is that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware penetration, remember that Progent's team of experts has a proven track record in ransomware virus blocking, remediation, and data recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Crypto-Ransomware Recovery Expertise
For 24-Hour ransomware repair services, contact Progent at 800-462-8800 or go to Contact Progent.