Ransomware Filtering and Recovery Consulting Thousand Oaks

Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become an escalating cyberplague that poses an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Different iterations of ransomware such as Reveton, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for a long time and continue to cause destruction. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as frequent as yet unnamed newcomers, not only do encryption of on-line data files but also infect many accessible system restores and backups. Files synched to cloud environments can also be ransomed. In a poorly designed data protection solution, it can render automatic restoration impossible and basically sets the datacenter back to zero.

Retrieving applications and information after a ransomware intrusion becomes a sprint against the clock as the targeted business tries its best to stop lateral movement and clear the ransomware and to restore enterprise-critical operations. Due to the fact that ransomware takes time to replicate, attacks are frequently launched during nights and weekends, when attacks may take more time to uncover. This compounds the difficulty of quickly mobilizing and orchestrating a capable response team.

Progent offers a variety of services for securing Thousand Oaks businesses from ransomware attacks. These include team member education to help identify and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of modern security gateways with artificial intelligence capabilities to automatically identify and extinguish day-zero cyber threats. Progent in addition offers the services of seasoned ransomware recovery engineers with the skills and perseverance to rebuild a breached environment as quickly as possible.

Progent's Crypto-Ransomware Restoration Support Services
After a crypto-ransomware event, even paying the ransom in Bitcoin cryptocurrency does not provide any assurance that criminal gangs will respond with the keys to decipher any of your files. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms commonly range from fifteen to forty BTC ($120,000 and $400,000). This is significantly above the average ransomware demands, which ZDNET determined to be in the range of $13,000 for small businesses. The fallback is to piece back together the vital parts of your IT environment. Without access to full information backups, this requires a broad complement of skills, professional project management, and the ability to work continuously until the task is over.

For decades, Progent has made available expert IT services for companies throughout the United States and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have earned high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, and GIAC. (Visit Progent's certifications). Progent also has expertise in financial systems and ERP application software. This breadth of expertise gives Progent the ability to efficiently identify necessary systems and organize the remaining components of your computer network environment following a ransomware penetration and assemble them into an operational system.

Progent's ransomware group uses state-of-the-art project management applications to orchestrate the sophisticated recovery process. Progent knows the importance of working swiftly and together with a client's management and IT resources to prioritize tasks and to get essential services back on-line as fast as possible.

Customer Story: A Successful Ransomware Intrusion Response
A business engaged Progent after their network system was brought down by the Ryuk ransomware virus. Ryuk is believed to have been deployed by Northern Korean state cybercriminals, suspected of using approaches leaked from America’s NSA organization. Ryuk seeks specific businesses with little tolerance for disruption and is among the most profitable incarnations of ransomware viruses. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in Chicago and has around 500 workers. The Ryuk penetration had disabled all essential operations and manufacturing capabilities. The majority of the client's system backups had been on-line at the beginning of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but in the end engaged Progent.

Progent worked hand in hand the customer to rapidly identify and prioritize the mission critical applications that needed to be recovered to make it possible to resume departmental functions:

• Active Directory
• Electronic Mail
• Accounting/MRP

Within 2 days, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then accomplished rebuilding and storage recovery of essential servers. All Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to assemble intact OST data files (Microsoft Outlook Off-Line Data Files) on user PCs in order to recover mail information. A recent off-line backup of the client's accounting/MRP systems made it possible to return these vital applications back on-line. Although significant work needed to be completed to recover fully from the Ryuk virus, essential services were restored quickly:

Throughout the following month key milestones in the recovery project were accomplished in close cooperation between Progent engineers and the client:

• Internal web sites were brought back up with no loss of information.
• The MailStore Exchange Server containing more than four million historical messages was spun up and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were 100 percent functional.
• A new Palo Alto 850 firewall was installed and configured.
• Nearly all of the user PCs were back into operation.

Conclusion
A potential business-killing disaster was evaded due to hard-working professionals, a wide spectrum of subject matter expertise, and tight teamwork. Although in post mortem the ransomware penetration described here could have been blocked with current security technology solutions and ISO/IEC 27001 best practices, team education, and appropriate incident response procedures for information backup and proper patching controls, the reality remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware penetration, remember that Progent's team of professionals has a proven track record in ransomware virus defense, remediation, and file restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Thousand Oaks
For ransomware system recovery consulting in the Thousand Oaks metro area, call Progent at 800-462-8800 or see Contact Progent.