Ransomware Filtering and Remediation Expertise Allen

Ransomware : Your Worst IT Nightmare
Ransomware has become a modern cyber pandemic that represents an existential threat for organizations poorly prepared for an attack. Multiple generations of crypto-ransomware like the CryptoLocker, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for years and still inflict harm. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, along with additional unnamed newcomers, not only perform encryption of on-line critical data but also infiltrate many available system backups. Data synched to off-premises disaster recovery sites can also be encrypted. In a poorly designed data protection solution, this can make any recovery useless and effectively sets the network back to zero.

Getting back on-line programs and information following a crypto-ransomware attack becomes a race against time as the victim struggles to contain the damage, cleanup the ransomware, and resume business-critical operations. Because ransomware takes time to spread across a targeted network, penetrations are frequently sprung at night, when attacks typically take more time to uncover. This multiplies the difficulty of quickly mobilizing and coordinating a knowledgeable mitigation team.

Progent provides a range of solutions for securing Allen organizations from ransomware penetrations. These include user education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat defense to identify and quarantine day-zero malware assaults. Progent in addition provides the assistance of expert ransomware recovery consultants with the talent and commitment to restore a compromised system as rapidly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a ransomware event, paying the ransom in cryptocurrency does not ensure that cyber hackers will provide the keys to decipher any or all of your data. Kaspersky Labs estimated that seventeen percent of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to re-install the vital parts of your IT environment. Absent the availability of complete data backups, this calls for a wide range of skills, well-coordinated team management, and the willingness to work non-stop until the job is completed.

For twenty years, Progent has offered certified expert Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have attained top certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with accounting and ERP software solutions. This breadth of expertise gives Progent the skills to knowledgably ascertain critical systems and integrate the surviving components of your Information Technology environment after a ransomware attack and assemble them into an operational network.

Progent's security group utilizes best of breed project management systems to coordinate the sophisticated restoration process. Progent knows the importance of acting swiftly and in concert with a client's management and Information Technology staff to assign priority to tasks and to put critical services back online as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Intrusion Response
A client hired Progent after their network system was crashed by the Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean state sponsored criminal gangs, suspected of adopting approaches leaked from the U.S. National Security Agency. Ryuk seeks specific organizations with little room for disruption and is among the most lucrative incarnations of ransomware viruses. Headline targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer headquartered in the Chicago metro area with around 500 employees. The Ryuk attack had disabled all business operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the start of the attack and were destroyed. The client was actively seeking loans for paying the ransom (in excess of two hundred thousand dollars) and hoping for the best, but in the end utilized Progent.

Progent worked together with the client to quickly understand and assign priority to the key services that needed to be recovered to make it possible to restart company operations:

• Microsoft Active Directory
• Exchange Server
• Accounting/MRP

In less than 48 hours, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then assisted with setup and storage recovery on critical applications. All Microsoft Exchange Server schema and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to locate non-encrypted OST files (Outlook Email Offline Data Files) on various desktop computers and laptops in order to recover email data. A not too old off-line backup of the client's financials/MRP software made it possible to restore these required programs back servicing users. Although a lot of work remained to recover fully from the Ryuk damage, critical services were recovered quickly:

Over the following couple of weeks key milestones in the recovery project were achieved in close collaboration between Progent engineers and the customer:

• Self-hosted web sites were restored without losing any data.
• The MailStore Exchange Server exceeding four million archived messages was spun up and accessible to users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory Control functions were completely recovered.
• A new Palo Alto 850 firewall was set up.
• Nearly all of the user workstations were operational.

Conclusion
A possible enterprise-killing disaster was averted by hard-working experts, a wide range of technical expertise, and tight collaboration. Although in hindsight the ransomware virus attack detailed here should have been identified and blocked with current security technology solutions and recognized best practices, staff education, and appropriate security procedures for data backup and applying software patches, the fact remains that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware virus, remember that Progent's team of professionals has extensive experience in ransomware virus blocking, mitigation, and information systems disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Allen
For ransomware system recovery consulting in the Allen area, phone Progent at 800-462-8800 or see Contact Progent.