Ransomware Defense and Recovery Solutions Albany

Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become a modern cyber pandemic that represents an enterprise-level danger for businesses of all sizes unprepared for an attack. Different versions of ransomware such as CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for years and continue to inflict harm. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus additional unnamed malware, not only encrypt online critical data but also infect all available system backup. Data synched to the cloud can also be corrupted. In a poorly designed system, it can render automated restore operations useless and basically knocks the entire system back to square one.

Getting back on-line services and information after a ransomware outage becomes a race against the clock as the victim fights to stop the spread, eradicate the crypto-ransomware, and resume business-critical activity. Because ransomware takes time to spread across a network, assaults are often sprung on weekends and holidays, when successful attacks typically take more time to notice. This compounds the difficulty of rapidly mobilizing and coordinating a qualified mitigation team.

Progent makes available an assortment of support services for securing Albany organizations from ransomware penetrations. These include user education to help identify and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat defense to discover and quarantine zero-day modern malware attacks. Progent in addition can provide the services of veteran crypto-ransomware recovery consultants with the skills and commitment to reconstruct a compromised network as soon as possible.

Progent's Ransomware Recovery Support Services
Soon after a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the codes to decipher all your data. Kaspersky determined that seventeen percent of crypto-ransomware victims never restored their files even after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The other path is to piece back together the key parts of your Information Technology environment. Absent the availability of complete information backups, this requires a broad range of skill sets, professional team management, and the ability to work non-stop until the recovery project is finished.

For decades, Progent has offered expert Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have earned internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial management and ERP applications. This breadth of expertise provides Progent the skills to rapidly determine critical systems and re-organize the remaining parts of your Information Technology environment following a ransomware attack and assemble them into an operational system.

Progent's ransomware team has powerful project management applications to orchestrate the complicated restoration process. Progent appreciates the urgency of working rapidly and in unison with a client's management and IT team members to assign priority to tasks and to get critical services back on line as fast as humanly possible.

Customer Story: A Successful Ransomware Attack Response
A business hired Progent after their network was attacked by the Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean government sponsored cybercriminals, possibly using strategies exposed from America's NSA organization. Ryuk seeks specific companies with little tolerance for operational disruption and is among the most profitable examples of ransomware malware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in the Chicago metro area and has about 500 workers. The Ryuk event had disabled all business operations and manufacturing capabilities. Most of the client's information backups had been online at the start of the intrusion and were eventually encrypted. The client considered paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but ultimately utilized Progent.

Progent worked together with the customer to quickly identify and prioritize the essential areas that needed to be restored in order to continue company operations:

• Microsoft Active Directory
• Electronic Mail
• Accounting/MRP

In less than 48 hours, Progent was able to recover Active Directory services to its pre-virus state. Progent then assisted with reinstallations and storage recovery of the most important applications. All Microsoft Exchange Server ties and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to collect intact OST files (Outlook Offline Data Files) on staff workstations to recover email data. A not too old offline backup of the client's financials/MRP systems made it possible to return these vital applications back online for users. Although major work remained to recover completely from the Ryuk event, critical systems were restored rapidly:

During the following couple of weeks important milestones in the restoration process were achieved through tight cooperation between Progent engineers and the customer:

• Internal web sites were brought back up without losing any information.
• The MailStore Microsoft Exchange Server containing more than 4 million historical messages was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control functions were fully operational.
• A new Palo Alto 850 firewall was installed and configured.
• Ninety percent of the desktop computers were operational.

Conclusion
A potential company-ending catastrophe was avoided due to top-tier experts, a broad array of technical expertise, and tight collaboration. Although in hindsight the crypto-ransomware incident described here could have been shut down with advanced security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and appropriate security procedures for information backup and proper patching controls, the reality is that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware penetration, feel confident that Progent's team of experts has extensive experience in crypto-ransomware virus defense, remediation, and data disaster recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Albany
For ransomware cleanup consulting in the Albany area, call Progent at 800-462-8800 or visit Contact Progent.