Ransomware Defense and Cleanup Solutions Chatsworth

Crypto-Ransomware : Your Worst IT Catastrophe
Ransomware has become a modern cyber pandemic that presents an enterprise-level threat for businesses poorly prepared for an attack. Versions of ransomware like the Dharma, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for many years and continue to cause damage. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as more as yet unnamed malware, not only perform encryption of online critical data but also infect most accessible system protection. Information synchronized to cloud environments can also be corrupted. In a poorly designed environment, this can render any restore operations hopeless and effectively sets the entire system back to zero.

Retrieving services and information following a ransomware intrusion becomes a sprint against time as the targeted business tries its best to contain, eradicate the ransomware, and resume mission-critical activity. Due to the fact that ransomware requires time to spread across a network, attacks are usually launched on weekends, when attacks typically take more time to detect. This multiplies the difficulty of promptly assembling and orchestrating an experienced mitigation team.

Progent makes available a range of services for protecting Chatsworth enterprises from crypto-ransomware attacks. These include team member training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to discover and extinguish zero-day malware attacks. Progent in addition provides the assistance of expert ransomware recovery professionals with the skills and perseverance to re-deploy a breached network as urgently as possible.

Progent's Crypto-Ransomware Restoration Services
Following a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that distant criminals will provide the codes to decrypt any or all of your files. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The fallback is to piece back together the critical parts of your IT environment. Without the availability of full data backups, this requires a wide range of IT skills, professional project management, and the capability to work non-stop until the recovery project is completed.

For decades, Progent has offered certified expert Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have attained advanced certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial management and ERP application software. This breadth of expertise affords Progent the ability to quickly ascertain necessary systems and re-organize the remaining components of your IT system following a crypto-ransomware attack and rebuild them into an operational network.

Progent's recovery team utilizes top notch project management applications to coordinate the complicated recovery process. Progent knows the urgency of working rapidly and in concert with a customer's management and Information Technology resources to assign priority to tasks and to put key systems back online as fast as possible.

Customer Case Study: A Successful Ransomware Attack Recovery
A business escalated to Progent after their network was penetrated by Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state hackers, suspected of using algorithms leaked from the U.S. NSA organization. Ryuk seeks specific businesses with little or no ability to sustain disruption and is one of the most profitable instances of crypto-ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing business headquartered in Chicago and has about 500 employees. The Ryuk attack had frozen all essential operations and manufacturing processes. The majority of the client's system backups had been online at the beginning of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom demand (more than two hundred thousand dollars) and praying for the best, but in the end called Progent.

Progent worked with the client to rapidly assess and assign priority to the most important areas that had to be restored to make it possible to resume departmental functions:

• Windows Active Directory
• Microsoft Exchange Server
• MRP System

In less than 2 days, Progent was able to restore Windows Active Directory to its pre-attack state. Progent then helped perform rebuilding and hard drive recovery on essential applications. All Exchange Server data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to locate intact OST files (Outlook Email Off-Line Folder Files) on team PCs and laptops to recover email data. A recent off-line backup of the client's accounting/ERP systems made them able to return these vital applications back online. Although significant work still had to be done to recover totally from the Ryuk event, core systems were restored quickly:

Over the following couple of weeks key milestones in the restoration process were achieved through tight collaboration between Progent consultants and the customer:

• Internal web applications were returned to operation without losing any data.
• The MailStore Server containing more than four million archived messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control functions were 100% functional.
• A new Palo Alto Networks 850 firewall was brought online.
• Most of the user desktops were functioning as before the incident.

Conclusion
A probable business-ending disaster was averted by hard-working experts, a broad range of subject matter expertise, and close teamwork. Although in analyzing the event afterwards the ransomware attack detailed here would have been identified and prevented with up-to-date cyber security technology solutions and security best practices, user training, and properly executed incident response procedures for backup and applying software patches, the reality is that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's roster of professionals has extensive experience in ransomware virus blocking, mitigation, and data recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Chatsworth
For ransomware cleanup consulting services in the Chatsworth metro area, call Progent at 800-462-8800 or go to Contact Progent.