Ransomware Filtering and Restoration Services Thousand Oaks

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that poses an existential threat for organizations poorly prepared for an attack. Multiple generations of ransomware like the Dharma, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for years and still cause harm. More recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, along with daily unnamed newcomers, not only perform encryption of on-line data but also infiltrate many accessible system protection mechanisms. Data replicated to the cloud can also be corrupted. In a poorly architected system, this can render automatic recovery useless and basically sets the datacenter back to zero.

Getting back on-line applications and information following a ransomware attack becomes a race against the clock as the victim tries its best to stop lateral movement, remove the ransomware, and resume business-critical activity. Because crypto-ransomware requires time to move laterally throughout a targeted network, assaults are frequently sprung during nights and weekends, when successful attacks may take longer to notice. This multiplies the difficulty of rapidly marshalling and coordinating a qualified mitigation team.

Progent makes available an assortment of solutions for protecting Thousand Oaks organizations from ransomware penetrations. These include team training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat protection to detect and quarantine zero-day malware assaults. Progent also provides the assistance of experienced ransomware recovery engineers with the talent and perseverance to reconstruct a compromised environment as quickly as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will respond with the codes to decrypt any or all of your files. Kaspersky estimated that seventeen percent of ransomware victims never recovered their information even after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to setup from scratch the critical parts of your Information Technology environment. Without access to complete information backups, this calls for a broad range of skills, well-coordinated team management, and the ability to work non-stop until the job is over.

For twenty years, Progent has made available expert Information Technology services for companies across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have earned advanced industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of experience gives Progent the skills to efficiently identify critical systems and organize the surviving components of your IT environment after a crypto-ransomware penetration and assemble them into an operational network.

Progent's security group uses state-of-the-art project management applications to coordinate the complicated recovery process. Progent knows the importance of acting swiftly and in concert with a client's management and IT resources to assign priority to tasks and to put essential systems back on line as fast as humanly possible.

Client Story: A Successful Ransomware Incident Restoration
A small business contacted Progent after their company was penetrated by the Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored cybercriminals, suspected of adopting techniques exposed from the United States National Security Agency. Ryuk seeks specific organizations with little tolerance for disruption and is one of the most profitable examples of ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in Chicago and has around 500 workers. The Ryuk attack had brought down all business operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the start of the attack and were encrypted. The client was taking steps for paying the ransom demand (in excess of $200,000) and praying for good luck, but ultimately engaged Progent.

Progent worked hand in hand the customer to rapidly identify and assign priority to the essential applications that had to be addressed to make it possible to continue company operations:

• Microsoft Active Directory
• Exchange Server
• Financials/MRP

In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then helped perform reinstallations and storage recovery of mission critical applications. All Microsoft Exchange Server schema and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to assemble non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on various desktop computers and laptops to recover email messages. A recent off-line backup of the businesses accounting/MRP software made it possible to return these required services back servicing users. Although a lot of work was left to recover totally from the Ryuk event, the most important services were recovered quickly:

Over the following couple of weeks critical milestones in the restoration project were made through tight collaboration between Progent team members and the client:

• In-house web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server exceeding four million archived messages was spun up and available for users.
• CRM/Orders/Invoicing/AP/AR/Inventory Control functions were 100 percent recovered.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the user desktops were being used by staff.

Conclusion
A possible company-ending disaster was avoided by top-tier experts, a broad spectrum of technical expertise, and tight collaboration. Although in retrospect the ransomware attack detailed here would have been identified and disabled with current security solutions and NIST Cybersecurity Framework best practices, team education, and properly executed incident response procedures for information protection and keeping systems up to date with security patches, the fact is that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware attack, feel confident that Progent's roster of professionals has extensive experience in ransomware virus defense, mitigation, and file recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Thousand Oaks
For ransomware system restoration services in the Thousand Oaks area, call Progent at 800-462-8800 or see Contact Progent.