Ransomware Protection and Recovery Solutions Aurora

Crypto-Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become a modern cyberplague that poses an existential danger for organizations vulnerable to an assault. Different iterations of ransomware like the Dharma, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for years and still inflict destruction. Newer versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as frequent unnamed viruses, not only encrypt online data but also infect all available system restores and backups. Data synched to off-premises disaster recovery sites can also be ransomed. In a vulnerable environment, it can make any recovery impossible and effectively knocks the network back to square one.

Getting back applications and data after a crypto-ransomware attack becomes a sprint against time as the targeted organization struggles to contain the damage, remove the ransomware, and resume enterprise-critical operations. Due to the fact that ransomware needs time to move laterally across a network, penetrations are frequently sprung at night, when successful attacks may take longer to detect. This multiplies the difficulty of rapidly assembling and coordinating a qualified mitigation team.

Progent offers an assortment of solutions for protecting Aurora organizations from crypto-ransomware events. These include team member education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to detect and quarantine zero-day modern malware attacks. Progent in addition provides the assistance of expert ransomware recovery engineers with the track record and commitment to restore a compromised system as soon as possible.

Progent's Crypto-Ransomware Recovery Help
Following a ransomware attack, sending the ransom demands in cryptocurrency does not ensure that distant criminals will provide the needed codes to decrypt any or all of your information. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to piece back together the essential elements of your Information Technology environment. Without access to essential data backups, this calls for a broad complement of skills, top notch project management, and the willingness to work continuously until the recovery project is completed.

For twenty years, Progent has made available expert IT services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded high-level certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of expertise affords Progent the skills to efficiently ascertain important systems and integrate the remaining parts of your network environment following a crypto-ransomware attack and configure them into a functioning network.

Progent's recovery group uses powerful project management applications to coordinate the sophisticated recovery process. Progent understands the urgency of acting swiftly and in unison with a client's management and Information Technology resources to prioritize tasks and to get essential systems back on line as soon as possible.

Client Case Study: A Successful Ransomware Virus Recovery
A client contacted Progent after their network system was taken over by Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored hackers, possibly using technology leaked from the United States NSA organization. Ryuk seeks specific businesses with little room for disruption and is among the most profitable iterations of ransomware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in Chicago and has about 500 staff members. The Ryuk penetration had frozen all company operations and manufacturing capabilities. Most of the client's backups had been online at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom (exceeding $200K) and praying for the best, but ultimately called Progent.

Progent worked hand in hand the client to rapidly understand and prioritize the mission critical services that had to be restored to make it possible to restart departmental operations:

• Windows Active Directory
• Exchange Server
• Accounting/MRP

In less than 48 hours, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then performed reinstallations and storage recovery on key systems. All Microsoft Exchange Server ties and attributes were intact, which facilitated the restore of Exchange. Progent was able to locate local OST files (Outlook Email Off-Line Data Files) on user workstations and laptops to recover mail data. A not too old off-line backup of the businesses accounting/MRP software made it possible to restore these essential applications back available to users. Although a lot of work was left to recover fully from the Ryuk event, critical systems were restored quickly:

Over the next month important milestones in the recovery project were accomplished in close collaboration between Progent team members and the client:

• Internal web applications were brought back up without losing any information.
• The MailStore Server with over 4 million historical emails was spun up and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control capabilities were 100% restored.
• A new Palo Alto 850 security appliance was brought online.
• Most of the user workstations were functioning as before the incident.

Conclusion
A probable company-ending disaster was evaded with dedicated experts, a wide range of subject matter expertise, and tight teamwork. Although in retrospect the ransomware attack detailed here could have been disabled with up-to-date cyber security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and properly executed security procedures for data backup and proper patching controls, the reality remains that state-sponsored cyber criminals from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incursion, feel confident that Progent's roster of professionals has a proven track record in ransomware virus blocking, remediation, and file recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Aurora
For ransomware recovery services in the Aurora area, call Progent at 800-462-8800 or visit Contact Progent.