Ransomware Filtering and Restoration Services Anaheim

Ransomware : Your Crippling IT Disaster
Ransomware has become a too-frequent cyberplague that presents an extinction-level threat for organizations poorly prepared for an assault. Different iterations of crypto-ransomware such as Dharma, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for a long time and continue to inflict harm. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, along with additional unnamed viruses, not only encrypt online files but also infect any available system restores and backups. Files replicated to off-premises disaster recovery sites can also be encrypted. In a poorly designed environment, this can render automated restore operations useless and basically knocks the network back to zero.

Recovering programs and data following a ransomware attack becomes a race against time as the targeted business tries its best to stop the spread, eradicate the crypto-ransomware, and restore enterprise-critical operations. Due to the fact that ransomware takes time to move laterally across a targeted network, attacks are usually sprung during weekends and nights, when successful attacks in many cases take longer to notice. This compounds the difficulty of quickly mobilizing and orchestrating a qualified response team.

Progent makes available a range of services for protecting Anaheim businesses from ransomware events. Among these are team education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat defense to detect and suppress zero-day malware assaults. Progent also can provide the services of veteran ransomware recovery engineers with the track record and commitment to re-deploy a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Services
Following a ransomware invasion, sending the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will provide the keys to decipher any of your data. Kaspersky Labs determined that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to re-install the critical parts of your Information Technology environment. Without the availability of complete data backups, this requires a wide complement of IT skills, professional team management, and the willingness to work continuously until the job is complete.

For twenty years, Progent has made available professional Information Technology services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned top industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of experience provides Progent the ability to quickly determine important systems and re-organize the surviving components of your IT system following a ransomware event and rebuild them into a functioning system.

Progent's ransomware group has best of breed project management tools to coordinate the sophisticated recovery process. Progent appreciates the importance of working rapidly and in concert with a client's management and Information Technology team members to assign priority to tasks and to put key applications back on-line as fast as humanly possible.

Client Story: A Successful Ransomware Penetration Recovery
A business escalated to Progent after their organization was brought down by Ryuk crypto-ransomware. Ryuk is believed to have been launched by North Korean state criminal gangs, possibly using technology exposed from America's NSA organization. Ryuk targets specific businesses with limited room for operational disruption and is among the most lucrative examples of ransomware. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company based in the Chicago metro area and has around 500 staff members. The Ryuk penetration had shut down all company operations and manufacturing capabilities. The majority of the client's backups had been online at the beginning of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately utilized Progent.

Progent worked with the client to rapidly assess and assign priority to the essential elements that needed to be restored to make it possible to continue company operations:

• Microsoft Active Directory
• Microsoft Exchange Email
• Financials/MRP

In less than 2 days, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then accomplished setup and hard drive recovery on essential systems. All Microsoft Exchange Server ties and attributes were usable, which accelerated the restore of Exchange. Progent was also able to collect local OST data files (Outlook Off-Line Folder Files) on team PCs in order to recover mail data. A recent off-line backup of the client's financials/MRP systems made it possible to return these vital applications back online for users. Although significant work remained to recover totally from the Ryuk virus, the most important services were returned to operations quickly:

Throughout the following month critical milestones in the restoration process were made in tight cooperation between Progent engineers and the customer:

• Internal web sites were restored without losing any information.
• The MailStore Exchange Server containing more than 4 million archived emails was spun up and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control capabilities were 100% restored.
• A new Palo Alto Networks 850 firewall was deployed.
• Nearly all of the desktop computers were back into operation.

Conclusion
A likely business catastrophe was dodged due to hard-working experts, a broad array of IT skills, and tight teamwork. Although upon completion of forensics the crypto-ransomware virus attack detailed here should have been prevented with advanced cyber security technology and recognized best practices, user training, and appropriate incident response procedures for information protection and proper patching controls, the reality is that state-sponsored cyber criminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's roster of experts has proven experience in ransomware virus blocking, mitigation, and file recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Anaheim
For ransomware cleanup services in the Anaheim area, call Progent at 800-462-8800 or visit Contact Progent.