Ransomware Prevention and Removal Solutions Buffalo

Ransomware : Your Worst IT Nightmare
Crypto-Ransomware has become a modern cyber pandemic that presents an enterprise-level danger for businesses of all sizes poorly prepared for an assault. Multiple generations of crypto-ransomware such as Reveton, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for a long time and still inflict havoc. More recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as more as yet unnamed newcomers, not only perform encryption of online files but also infect any accessible system protection. Data replicated to off-premises disaster recovery sites can also be corrupted. In a vulnerable environment, it can render automatic restore operations useless and effectively sets the entire system back to zero.

Getting back applications and information after a ransomware intrusion becomes a race against the clock as the targeted business tries its best to stop lateral movement, eradicate the crypto-ransomware, and resume business-critical operations. Since ransomware takes time to move laterally throughout a targeted network, assaults are frequently launched on weekends, when penetrations typically take longer to uncover. This compounds the difficulty of quickly marshalling and orchestrating a knowledgeable mitigation team.

Progent provides a variety of solutions for securing Buffalo enterprises from ransomware events. These include team education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat defense to discover and extinguish day-zero modern malware assaults. Progent in addition provides the assistance of veteran ransomware recovery consultants with the talent and commitment to rebuild a breached system as rapidly as possible.

Progent's Ransomware Recovery Help
Soon after a crypto-ransomware invasion, sending the ransom in cryptocurrency does not provide any assurance that criminal gangs will respond with the keys to unencrypt all your files. Kaspersky Labs determined that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to piece back together the essential elements of your IT environment. Without access to complete system backups, this requires a wide range of skill sets, top notch team management, and the capability to work non-stop until the job is completed.

For twenty years, Progent has made available certified expert Information Technology services for businesses across the U.S. and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained high-level industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in accounting and ERP applications. This breadth of expertise gives Progent the skills to knowledgably identify necessary systems and integrate the remaining components of your computer network system after a ransomware penetration and rebuild them into a functioning system.

Progent's security team deploys powerful project management tools to orchestrate the complex restoration process. Progent understands the importance of acting quickly and in concert with a customer's management and Information Technology resources to prioritize tasks and to get the most important services back online as soon as humanly possible.

Customer Case Study: A Successful Ransomware Penetration Recovery
A customer escalated to Progent after their network was crashed by Ryuk ransomware. Ryuk is thought to have been launched by North Korean government sponsored criminal gangs, possibly adopting strategies leaked from the United States National Security Agency. Ryuk attacks specific businesses with limited ability to sustain disruption and is among the most lucrative iterations of ransomware viruses. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in the Chicago metro area and has about 500 workers. The Ryuk penetration had brought down all essential operations and manufacturing capabilities. The majority of the client's backups had been on-line at the start of the intrusion and were eventually encrypted. The client was evaluating paying the ransom demand (more than two hundred thousand dollars) and praying for good luck, but in the end brought in Progent.

Progent worked together with the client to rapidly get our arms around and prioritize the most important areas that had to be restored in order to continue company operations:

• Windows Active Directory
• Microsoft Exchange Server
• MRP System

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-attack state. Progent then completed setup and storage recovery on key systems. All Exchange schema and attributes were usable, which accelerated the restore of Exchange. Progent was able to collect intact OST files (Microsoft Outlook Off-Line Data Files) on team workstations and laptops in order to recover mail messages. A recent offline backup of the client's financials/ERP software made it possible to recover these required programs back online. Although significant work was left to recover completely from the Ryuk damage, the most important services were recovered quickly:

Over the next few weeks key milestones in the recovery project were achieved in tight collaboration between Progent consultants and the client:

• Self-hosted web applications were returned to operation with no loss of information.
• The MailStore Exchange Server containing more than 4 million archived messages was brought on-line and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory modules were completely restored.
• A new Palo Alto 850 security appliance was installed and configured.
• Ninety percent of the user desktops were being used by staff.

Conclusion
A likely company-ending catastrophe was averted by dedicated professionals, a wide array of IT skills, and tight collaboration. Although in hindsight the ransomware virus incident detailed here would have been shut down with current security technology and best practices, user training, and appropriate incident response procedures for information protection and keeping systems up to date with security patches, the fact remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and will continue. If you do get hit by a ransomware incident, remember that Progent's team of professionals has extensive experience in ransomware virus defense, remediation, and file restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Buffalo
For ransomware system recovery expertise in the Buffalo area, phone Progent at 800-462-8800 or see Contact Progent.