Ransomware Protection and Cleanup Solutions Aurora

Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become an escalating cyberplague that presents an existential danger for businesses unprepared for an attack. Multiple generations of ransomware like the CryptoLocker, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for years and continue to cause destruction. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, along with more unnamed viruses, not only encrypt on-line files but also infiltrate most available system protection. Data replicated to the cloud can also be corrupted. In a poorly designed data protection solution, it can make automatic recovery impossible and basically sets the datacenter back to square one.

Getting back on-line services and data after a crypto-ransomware intrusion becomes a sprint against time as the targeted organization tries its best to contain the damage, cleanup the ransomware, and resume enterprise-critical operations. Since crypto-ransomware needs time to spread across a network, penetrations are frequently launched during weekends and nights, when successful penetrations tend to take longer to detect. This compounds the difficulty of promptly mobilizing and coordinating a qualified mitigation team.

Progent makes available an assortment of help services for securing Aurora enterprises from ransomware penetrations. Among these are staff training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to detect and extinguish day-zero modern malware attacks. Progent also offers the assistance of expert crypto-ransomware recovery consultants with the track record and perseverance to restore a compromised system as urgently as possible.

Progent's Ransomware Restoration Services
Soon after a crypto-ransomware attack, paying the ransom in cryptocurrency does not ensure that merciless criminals will respond with the codes to decipher any of your data. Kaspersky ascertained that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The alternative is to piece back together the key parts of your IT environment. Without the availability of complete data backups, this requires a broad complement of skills, well-coordinated project management, and the capability to work 24x7 until the task is finished.

For twenty years, Progent has offered professional IT services for companies throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in accounting and ERP applications. This breadth of expertise provides Progent the ability to knowledgably determine necessary systems and consolidate the surviving pieces of your network environment following a ransomware event and assemble them into an operational network.

Progent's recovery team of experts deploys state-of-the-art project management applications to coordinate the complicated restoration process. Progent knows the urgency of acting quickly and in unison with a client's management and IT staff to assign priority to tasks and to put critical applications back on line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Virus Restoration
A client hired Progent after their network was penetrated by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state sponsored criminal gangs, suspected of using techniques leaked from the U.S. NSA organization. Ryuk seeks specific organizations with little or no ability to sustain operational disruption and is among the most lucrative iterations of ransomware viruses. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business located in the Chicago metro area and has about 500 workers. The Ryuk event had frozen all business operations and manufacturing capabilities. Most of the client's data backups had been on-line at the beginning of the intrusion and were damaged. The client considered paying the ransom demand (more than two hundred thousand dollars) and praying for good luck, but in the end made the decision to use Progent.

Progent worked with the client to quickly identify and assign priority to the essential services that had to be restored in order to continue company operations:

• Microsoft Active Directory
• Electronic Mail
• Accounting/MRP

Within 2 days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then charged ahead with reinstallations and hard drive recovery on mission critical servers. All Microsoft Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to find local OST data files (Outlook Offline Data Files) on various workstations and laptops to recover mail information. A not too old off-line backup of the customer's financials/MRP software made them able to recover these essential services back online. Although a lot of work remained to recover totally from the Ryuk event, core services were restored quickly:

During the next couple of weeks critical milestones in the recovery project were made in tight collaboration between Progent consultants and the client:

• Internal web applications were returned to operation without losing any data.
• The MailStore Server containing more than four million historical emails was brought online and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control functions were fully restored.
• A new Palo Alto 850 firewall was set up and programmed.
• Ninety percent of the user PCs were fully operational.

Conclusion
A potential business disaster was dodged due to results-oriented professionals, a wide spectrum of IT skills, and tight collaboration. Although upon completion of forensics the ransomware virus incident described here could have been identified and prevented with up-to-date security systems and NIST Cybersecurity Framework best practices, staff education, and well designed security procedures for data backup and proper patching controls, the fact is that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's team of experts has a proven track record in ransomware virus defense, remediation, and data restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Aurora
For ransomware system restoration consulting in the Aurora metro area, phone Progent at 800-462-8800 or see Contact Progent.