Ransomware Prevention and Restoration Solutions Clearwater

Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware has become a modern cyber pandemic that presents an existential threat for businesses of all sizes poorly prepared for an assault. Different versions of ransomware such as Reveton, Fusob, Locky, NotPetya and MongoLock cryptoworms have been circulating for many years and still cause harm. Modern variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as additional unnamed newcomers, not only encrypt online data but also infiltrate many configured system backups. Files synched to off-premises disaster recovery sites can also be corrupted. In a poorly designed environment, this can render automated recovery useless and effectively knocks the datacenter back to square one.

Getting back on-line programs and data following a ransomware event becomes a race against the clock as the victim tries its best to contain, clear the crypto-ransomware, and resume business-critical activity. Due to the fact that ransomware requires time to spread throughout a network, attacks are frequently launched during nights and weekends, when penetrations are likely to take more time to identify. This multiplies the difficulty of quickly assembling and coordinating a capable response team.

Progent has an assortment of support services for protecting Clearwater enterprises from ransomware penetrations. Among these are team member training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to detect and quarantine day-zero malware assaults. Progent in addition can provide the assistance of expert ransomware recovery consultants with the track record and perseverance to re-deploy a compromised system as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a crypto-ransomware penetration, sending the ransom in cryptocurrency does not provide any assurance that criminal gangs will return the codes to decipher any or all of your files. Kaspersky Labs determined that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to piece back together the mission-critical parts of your Information Technology environment. Without the availability of complete system backups, this requires a wide complement of IT skills, well-coordinated project management, and the capability to work non-stop until the job is complete.

For decades, Progent has made available professional Information Technology services for businesses throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with financial management and ERP application software. This breadth of expertise provides Progent the capability to knowledgably identify necessary systems and organize the remaining components of your computer network system after a crypto-ransomware penetration and assemble them into an operational network.

Progent's recovery team of experts utilizes state-of-the-art project management applications to orchestrate the complex restoration process. Progent understands the urgency of working quickly and together with a client's management and Information Technology staff to assign priority to tasks and to put critical applications back on-line as fast as humanly possible.

Client Story: A Successful Ransomware Virus Response
A small business escalated to Progent after their network was crashed by the Ryuk ransomware. Ryuk is believed to have been created by North Korean government sponsored criminal gangs, suspected of adopting algorithms leaked from America's NSA organization. Ryuk goes after specific companies with little or no ability to sustain disruption and is one of the most lucrative versions of ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in the Chicago metro area with around 500 employees. The Ryuk attack had disabled all business operations and manufacturing capabilities. The majority of the client's backups had been on-line at the beginning of the intrusion and were destroyed. The client was pursuing financing for paying the ransom (in excess of $200,000) and praying for good luck, but ultimately utilized Progent.

Progent worked hand in hand the client to rapidly identify and prioritize the essential elements that needed to be restored to make it possible to restart departmental functions:

• Windows Active Directory
• Email
• MRP System

In less than two days, Progent was able to recover Active Directory services to its pre-penetration state. Progent then helped perform reinstallations and storage recovery of essential applications. All Exchange schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to locate local OST data files (Outlook Email Off-Line Data Files) on team desktop computers and laptops in order to recover email data. A recent offline backup of the businesses accounting/ERP systems made it possible to restore these required applications back available to users. Although a lot of work needed to be completed to recover fully from the Ryuk virus, critical services were recovered quickly:

Throughout the following few weeks key milestones in the recovery process were accomplished through tight collaboration between Progent team members and the client:

• Internal web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million historical emails was restored to operations and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control capabilities were completely restored.
• A new Palo Alto 850 firewall was brought online.
• Nearly all of the desktops and laptops were functioning as before the incident.

Conclusion
A possible business-ending catastrophe was averted with dedicated experts, a broad spectrum of knowledge, and close teamwork. Although in analyzing the event afterwards the ransomware attack described here would have been identified and stopped with up-to-date cyber security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and properly executed incident response procedures for information protection and proper patching controls, the reality remains that state-sponsored cybercriminals from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, removal, and file restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Clearwater
For ransomware system recovery consulting in the Clearwater metro area, call Progent at 800-462-8800 or see Contact Progent.