Ransomware Protection and Cleanup Solutions Bellevue

Ransomware : Your Worst IT Nightmare
Ransomware has become a modern cyber pandemic that poses an existential threat for organizations poorly prepared for an assault. Different iterations of ransomware such as Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been around for many years and continue to inflict damage. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as daily unnamed malware, not only encrypt on-line critical data but also infiltrate most available system backups. Information synchronized to the cloud can also be ransomed. In a vulnerable data protection solution, this can make automated recovery hopeless and basically knocks the datacenter back to square one.

Getting back on-line applications and information following a ransomware attack becomes a race against time as the victim fights to contain the damage, remove the crypto-ransomware, and restore business-critical activity. Due to the fact that ransomware needs time to spread across a targeted network, penetrations are usually launched during weekends and nights, when attacks typically take more time to uncover. This compounds the difficulty of quickly mobilizing and organizing an experienced mitigation team.

Progent has an assortment of solutions for securing Bellevue businesses from crypto-ransomware attacks. Among these are team member training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to discover and extinguish day-zero malware assaults. Progent also can provide the assistance of experienced ransomware recovery engineers with the skills and perseverance to restore a breached system as quickly as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware attack, paying the ransom in cryptocurrency does not ensure that criminal gangs will return the codes to unencrypt any or all of your files. Kaspersky determined that seventeen percent of ransomware victims never restored their information after having paid the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The fallback is to piece back together the key components of your Information Technology environment. Without the availability of full system backups, this requires a broad range of skill sets, professional project management, and the ability to work non-stop until the task is over.

For twenty years, Progent has provided professional Information Technology services for companies across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of expertise affords Progent the capability to efficiently determine necessary systems and integrate the remaining parts of your IT environment after a ransomware penetration and rebuild them into an operational network.

Progent's security team has state-of-the-art project management systems to orchestrate the complicated recovery process. Progent knows the urgency of working swiftly and in unison with a client's management and IT team members to assign priority to tasks and to get the most important systems back on line as fast as possible.

Client Case Study: A Successful Ransomware Penetration Recovery
A customer engaged Progent after their network system was taken over by Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored hackers, possibly adopting approaches leaked from the United States NSA organization. Ryuk attacks specific companies with limited tolerance for operational disruption and is one of the most profitable versions of ransomware. Major targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing business located in the Chicago metro area and has about 500 employees. The Ryuk penetration had disabled all business operations and manufacturing capabilities. The majority of the client's backups had been online at the start of the intrusion and were destroyed. The client considered paying the ransom (exceeding $200K) and wishfully thinking for good luck, but ultimately reached out to Progent.

Progent worked with the customer to rapidly determine and prioritize the mission critical services that needed to be restored to make it possible to resume departmental functions:

• Active Directory
• Microsoft Exchange Email
• Accounting/MRP

In less than 48 hours, Progent was able to re-build Active Directory to its pre-virus state. Progent then completed rebuilding and storage recovery on mission critical systems. All Microsoft Exchange Server data and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to assemble local OST files (Outlook Offline Data Files) on team PCs and laptops in order to recover email information. A not too old offline backup of the businesses financials/ERP software made it possible to return these essential programs back servicing users. Although major work needed to be completed to recover fully from the Ryuk virus, core services were restored quickly:

Throughout the following couple of weeks critical milestones in the restoration project were completed in tight cooperation between Progent consultants and the customer:

• In-house web sites were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was spun up and accessible to users.
• CRM/Orders/Invoicing/AP/AR/Inventory Control modules were 100% operational.
• A new Palo Alto 850 security appliance was set up and programmed.
• Most of the desktop computers were fully operational.

Conclusion
A possible enterprise-killing catastrophe was dodged through the efforts of dedicated experts, a broad range of subject matter expertise, and tight teamwork. Although in retrospect the crypto-ransomware penetration described here could have been prevented with advanced cyber security technology and security best practices, user and IT administrator training, and properly executed incident response procedures for information backup and proper patching controls, the fact remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incursion, remember that Progent's team of professionals has substantial experience in ransomware virus blocking, cleanup, and information systems restoration.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Bellevue
For ransomware cleanup consulting in the Bellevue area, call Progent at 800-462-8800 or visit Contact Progent.