Ransomware Defense and Cleanup Solutions Allentown

Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a modern cyberplague that represents an existential threat for businesses vulnerable to an assault. Different versions of crypto-ransomware such as CryptoLocker, Fusob, Locky, SamSam and MongoLock cryptoworms have been out in the wild for a long time and continue to cause harm. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, along with more as yet unnamed malware, not only encrypt on-line data files but also infect many configured system restores and backups. Files synched to cloud environments can also be corrupted. In a vulnerable system, it can make any recovery hopeless and effectively sets the datacenter back to zero.

Getting back programs and data after a ransomware outage becomes a sprint against the clock as the targeted business tries its best to stop lateral movement, remove the virus, and restore enterprise-critical activity. Since ransomware needs time to replicate across a network, penetrations are usually sprung on weekends and holidays, when penetrations may take more time to discover. This multiplies the difficulty of promptly mobilizing and organizing a knowledgeable mitigation team.

Progent offers a variety of services for securing Allentown businesses from crypto-ransomware penetrations. These include team member education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat protection to identify and suppress zero-day malware attacks. Progent also offers the assistance of experienced crypto-ransomware recovery professionals with the skills and perseverance to restore a breached system as quickly as possible.

Progent's Ransomware Restoration Services
Following a ransomware invasion, paying the ransom demands in cryptocurrency does not ensure that merciless criminals will provide the keys to decipher any or all of your files. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their files after having paid the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The alternative is to piece back together the key elements of your IT environment. Absent access to full data backups, this requires a wide complement of skills, well-coordinated team management, and the ability to work non-stop until the job is done.

For decades, Progent has offered expert IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded high-level certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP software solutions. This breadth of expertise provides Progent the skills to quickly understand important systems and consolidate the remaining parts of your network environment after a crypto-ransomware attack and assemble them into a functioning network.

Progent's recovery team uses powerful project management applications to coordinate the complex restoration process. Progent knows the urgency of acting swiftly and in concert with a client's management and IT team members to prioritize tasks and to get key services back on-line as fast as humanly possible.

Client Case Study: A Successful Ransomware Intrusion Recovery
A customer engaged Progent after their network was crashed by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state sponsored hackers, possibly adopting strategies leaked from America's National Security Agency. Ryuk goes after specific companies with little ability to sustain disruption and is among the most lucrative instances of ransomware. Headline victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturer located in the Chicago metro area with around 500 workers. The Ryuk event had disabled all essential operations and manufacturing capabilities. Most of the client's data backups had been online at the beginning of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom (in excess of $200K) and hoping for the best, but in the end called Progent.

Progent worked with the customer to quickly determine and prioritize the critical elements that needed to be restored in order to continue business operations:

• Windows Active Directory
• Microsoft Exchange Server
• Financials/MRP

Within 2 days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then accomplished setup and storage recovery on essential applications. All Exchange ties and attributes were intact, which accelerated the restore of Exchange. Progent was able to locate non-encrypted OST files (Microsoft Outlook Off-Line Folder Files) on user PCs and laptops in order to recover email messages. A not too old off-line backup of the businesses accounting/ERP systems made them able to return these vital applications back online for users. Although major work remained to recover fully from the Ryuk attack, essential services were returned to operations rapidly:

Throughout the next couple of weeks important milestones in the recovery process were accomplished in close collaboration between Progent consultants and the client:

• In-house web applications were returned to operation without losing any data.
• The MailStore Exchange Server containing more than four million historical messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control modules were 100% operational.
• A new Palo Alto Networks 850 security appliance was installed.
• 90% of the user workstations were being used by staff.

Conclusion
A possible company-ending catastrophe was avoided with results-oriented experts, a broad range of technical expertise, and tight teamwork. Although in hindsight the ransomware virus penetration described here would have been prevented with up-to-date cyber security solutions and security best practices, team education, and appropriate incident response procedures for data backup and proper patching controls, the reality is that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a crypto-ransomware incursion, feel confident that Progent's team of experts has extensive experience in ransomware virus blocking, remediation, and file disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Allentown
For ransomware cleanup expertise in the Allentown metro area, phone Progent at 800-462-8800 or visit Contact Progent.