Ransomware Defense and Recovery Expertise Barra da Tijuca

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become an escalating cyberplague that represents an enterprise-level danger for businesses of all sizes vulnerable to an attack. Different versions of crypto-ransomware like the Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been around for a long time and continue to inflict damage. Newer strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as daily as yet unnamed malware, not only perform encryption of on-line information but also infiltrate any available system backup. Information synchronized to the cloud can also be ransomed. In a vulnerable system, this can render any recovery useless and effectively sets the network back to zero.

Retrieving applications and information following a ransomware outage becomes a sprint against time as the targeted business struggles to stop lateral movement, clear the ransomware, and restore mission-critical operations. Because crypto-ransomware takes time to move laterally throughout a network, attacks are often launched during nights and weekends, when successful penetrations are likely to take longer to uncover. This compounds the difficulty of promptly marshalling and coordinating a knowledgeable response team.

Progent has an assortment of solutions for protecting Barra da Tijuca enterprises from crypto-ransomware penetrations. Among these are staff education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to detect and suppress day-zero malware assaults. Progent in addition offers the services of veteran ransomware recovery professionals with the track record and commitment to re-deploy a compromised system as rapidly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware attack, even paying the ransom in cryptocurrency does not guarantee that distant criminals will provide the keys to unencrypt any of your files. Kaspersky Labs ascertained that seventeen percent of ransomware victims never restored their information even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to piece back together the key elements of your Information Technology environment. Without the availability of complete information backups, this calls for a broad complement of IT skills, well-coordinated team management, and the capability to work 24x7 until the job is finished.

For decades, Progent has made available expert IT services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of experience gives Progent the ability to rapidly understand necessary systems and organize the remaining parts of your computer network environment after a ransomware event and configure them into an operational network.

Progent's ransomware group has best of breed project management applications to coordinate the complicated recovery process. Progent understands the urgency of acting swiftly and together with a customer's management and Information Technology resources to assign priority to tasks and to get the most important applications back on line as fast as possible.

Customer Story: A Successful Ransomware Incident Recovery
A client hired Progent after their network system was penetrated by the Ryuk ransomware. Ryuk is thought to have been launched by North Korean government sponsored hackers, possibly adopting strategies leaked from the U.S. NSA organization. Ryuk attacks specific companies with limited tolerance for operational disruption and is one of the most lucrative incarnations of ransomware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business based in the Chicago metro area and has around 500 workers. The Ryuk event had shut down all company operations and manufacturing processes. The majority of the client's backups had been on-line at the time of the attack and were encrypted. The client considered paying the ransom (exceeding $200K) and wishfully thinking for the best, but ultimately made the decision to use Progent.

Progent worked with the customer to quickly get our arms around and prioritize the mission critical systems that had to be addressed in order to continue departmental functions:

• Microsoft Active Directory
• Exchange Server
• Accounting/MRP

In less than two days, Progent was able to restore Windows Active Directory to its pre-penetration state. Progent then charged ahead with reinstallations and storage recovery of mission critical applications. All Exchange data and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to collect non-encrypted OST data files (Outlook Offline Data Files) on staff desktop computers and laptops in order to recover mail messages. A not too old off-line backup of the customer's manufacturing systems made them able to return these essential programs back on-line. Although a large amount of work needed to be completed to recover completely from the Ryuk virus, the most important systems were recovered quickly:

Throughout the following couple of weeks critical milestones in the restoration process were completed through tight cooperation between Progent engineers and the client:

• Internal web applications were returned to operation with no loss of information.
• The MailStore Exchange Server containing more than 4 million historical messages was brought online and available for users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables/Inventory modules were completely recovered.
• A new Palo Alto 850 security appliance was brought online.
• Nearly all of the user PCs were fully operational.

Conclusion
A possible business disaster was avoided with hard-working experts, a broad spectrum of IT skills, and close teamwork. Although upon completion of forensics the ransomware virus penetration described here could have been blocked with current security solutions and best practices, user education, and properly executed incident response procedures for information backup and applying software patches, the reality remains that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware attack, remember that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and data recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Barra da Tijuca
For ransomware cleanup consulting services in the Barra da Tijuca metro area, call Progent at 800-462-8800 or visit Contact Progent.