Ransomware Filtering and Removal Solutions Valencia

Ransomware : Your Feared IT Disaster
Ransomware has become a modern cyberplague that presents an enterprise-level danger for businesses vulnerable to an attack. Versions of ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and still cause havoc. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus frequent as yet unnamed newcomers, not only perform encryption of on-line data files but also infiltrate any accessible system protection. Data synchronized to off-premises disaster recovery sites can also be corrupted. In a vulnerable data protection solution, this can make automated restore operations hopeless and basically knocks the entire system back to square one.

Getting back applications and data following a crypto-ransomware intrusion becomes a race against the clock as the victim tries its best to stop lateral movement, eradicate the ransomware, and resume enterprise-critical activity. Due to the fact that ransomware takes time to move laterally across a targeted network, penetrations are often sprung on weekends and holidays, when successful attacks typically take more time to detect. This compounds the difficulty of quickly marshalling and orchestrating a knowledgeable response team.

Progent offers a variety of services for protecting Valencia businesses from ransomware events. Among these are staff training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to discover and extinguish zero-day malware assaults. Progent in addition can provide the assistance of veteran crypto-ransomware recovery engineers with the track record and perseverance to re-deploy a compromised environment as soon as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will provide the codes to decipher any or all of your files. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to setup from scratch the critical elements of your IT environment. Absent access to complete data backups, this requires a broad range of IT skills, well-coordinated project management, and the ability to work 24x7 until the task is complete.

For two decades, Progent has provided certified expert Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained advanced certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-recognized certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP software solutions. This breadth of expertise provides Progent the ability to knowledgably determine critical systems and consolidate the remaining parts of your network system after a ransomware attack and assemble them into a functioning system.

Progent's security team of experts utilizes state-of-the-art project management tools to coordinate the sophisticated restoration process. Progent understands the importance of working swiftly and in unison with a client's management and IT staff to assign priority to tasks and to get key applications back online as soon as possible.

Client Story: A Successful Crypto-Ransomware Attack Restoration
A client escalated to Progent after their organization was crashed by Ryuk ransomware virus. Ryuk is believed to have been deployed by North Korean state sponsored hackers, suspected of using technology exposed from America's National Security Agency. Ryuk targets specific companies with little ability to sustain operational disruption and is among the most lucrative examples of crypto-ransomware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in the Chicago metro area with about 500 staff members. The Ryuk event had disabled all business operations and manufacturing processes. The majority of the client's data protection had been online at the beginning of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (exceeding $200,000) and wishfully thinking for good luck, but ultimately brought in Progent.

Progent worked with the client to quickly identify and assign priority to the most important systems that needed to be recovered in order to resume departmental operations:

• Active Directory (AD)
• Microsoft Exchange Server
• MRP System

In less than two days, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then charged ahead with rebuilding and storage recovery of the most important servers. All Exchange Server ties and attributes were usable, which greatly helped the restore of Exchange. Progent was able to find non-encrypted OST files (Outlook Email Offline Data Files) on user workstations in order to recover mail messages. A not too old off-line backup of the businesses financials/ERP systems made them able to return these required services back available to users. Although a lot of work needed to be completed to recover fully from the Ryuk virus, the most important systems were recovered quickly:

Throughout the following month key milestones in the restoration project were made in close collaboration between Progent engineers and the client:

• Self-hosted web applications were brought back up without losing any information.
• The MailStore Exchange Server exceeding four million archived emails was restored to operations and accessible to users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables/Inventory capabilities were fully recovered.
• A new Palo Alto 850 security appliance was installed and configured.
• Nearly all of the desktops and laptops were fully operational.

Conclusion
A possible business extinction disaster was dodged with hard-working professionals, a wide range of knowledge, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware virus attack detailed here could have been identified and prevented with advanced security systems and security best practices, user and IT administrator education, and well designed incident response procedures for data backup and proper patching controls, the reality remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's team of experts has a proven track record in ransomware virus defense, mitigation, and file disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Valencia
For ransomware recovery consulting services in the Valencia area, call Progent at 800-462-8800 or go to Contact Progent.