Ransomware Defense and Restoration Expertise Raleigh

Ransomware : Your Worst IT Disaster
Ransomware has become an escalating cyber pandemic that represents an existential danger for organizations poorly prepared for an assault. Different iterations of ransomware like the Dharma, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been circulating for years and still cause havoc. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with frequent as yet unnamed viruses, not only perform encryption of on-line data files but also infiltrate any configured system backups. Files synched to cloud environments can also be encrypted. In a poorly architected data protection solution, it can make automatic restore operations useless and effectively sets the network back to zero.

Recovering applications and information following a crypto-ransomware attack becomes a sprint against time as the targeted business tries its best to contain the damage, clear the virus, and resume mission-critical activity. Since crypto-ransomware requires time to replicate throughout a targeted network, penetrations are frequently launched at night, when penetrations may take longer to notice. This multiplies the difficulty of quickly marshalling and organizing a capable response team.

Progent has an assortment of support services for protecting Raleigh enterprises from crypto-ransomware attacks. These include team training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat defense to detect and quarantine zero-day modern malware assaults. Progent in addition provides the services of veteran crypto-ransomware recovery consultants with the talent and commitment to restore a compromised system as quickly as possible.

Progent's Crypto-Ransomware Recovery Support Services
After a ransomware invasion, even paying the ransom in cryptocurrency does not guarantee that distant criminals will return the needed codes to decrypt all your data. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to re-install the vital components of your Information Technology environment. Without access to essential information backups, this requires a wide complement of IT skills, professional project management, and the ability to work non-stop until the recovery project is completed.

For twenty years, Progent has provided certified expert Information Technology services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained top industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have earned internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of experience provides Progent the capability to knowledgably identify critical systems and consolidate the remaining pieces of your computer network system after a crypto-ransomware penetration and configure them into an operational system.

Progent's ransomware group has powerful project management applications to orchestrate the complicated recovery process. Progent knows the importance of working rapidly and in unison with a client's management and IT staff to assign priority to tasks and to get the most important services back on-line as fast as possible.

Client Case Study: A Successful Crypto-Ransomware Virus Recovery
A customer hired Progent after their network system was attacked by the Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored cybercriminals, possibly adopting technology leaked from the U.S. National Security Agency. Ryuk goes after specific businesses with limited ability to sustain disruption and is among the most lucrative instances of crypto-ransomware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in Chicago with around 500 workers. The Ryuk intrusion had disabled all business operations and manufacturing processes. The majority of the client's system backups had been online at the time of the attack and were destroyed. The client was evaluating paying the ransom (exceeding two hundred thousand dollars) and praying for good luck, but in the end utilized Progent.

Progent worked together with the customer to rapidly determine and prioritize the essential services that needed to be restored to make it possible to restart departmental functions:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

Within two days, Progent was able to recover Active Directory to its pre-penetration state. Progent then performed setup and storage recovery on needed servers. All Exchange ties and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to assemble intact OST files (Outlook Email Offline Folder Files) on various desktop computers and laptops to recover mail information. A recent off-line backup of the customer's financials/MRP software made them able to restore these essential programs back available to users. Although a lot of work needed to be completed to recover totally from the Ryuk damage, the most important services were returned to operations rapidly:

Throughout the next few weeks key milestones in the restoration project were completed through close cooperation between Progent engineers and the client:

• Self-hosted web sites were restored without losing any data.
• The MailStore Exchange Server with over 4 million archived messages was brought online and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory capabilities were completely operational.
• A new Palo Alto Networks 850 security appliance was deployed.
• Ninety percent of the user desktops were back into operation.

Conclusion
A likely business-ending disaster was averted by hard-working experts, a wide array of IT skills, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration detailed here would have been blocked with advanced security technology solutions and security best practices, user and IT administrator training, and well designed incident response procedures for data protection and proper patching controls, the fact remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are not going away. If you do get hit by a ransomware virus, feel confident that Progent's team of experts has substantial experience in crypto-ransomware virus defense, removal, and data disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Raleigh
For ransomware system restoration consulting services in the Raleigh metro area, call Progent at 800-462-8800 or visit Contact Progent.