Ransomware Protection and Remediation Consulting Birmingham

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level danger for businesses of all sizes vulnerable to an assault. Multiple generations of ransomware like the CryptoLocker, WannaCry, Locky, SamSam and MongoLock cryptoworms have been around for a long time and continue to cause harm. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, as well as daily unnamed viruses, not only encrypt on-line data but also infiltrate most accessible system protection. Data synched to the cloud can also be rendered useless. In a vulnerable system, it can make automatic restoration useless and effectively knocks the datacenter back to zero.

Recovering programs and information after a crypto-ransomware outage becomes a race against time as the victim struggles to contain the damage, remove the virus, and resume mission-critical operations. Due to the fact that ransomware requires time to spread throughout a network, penetrations are frequently launched at night, when successful attacks tend to take longer to uncover. This multiplies the difficulty of promptly mobilizing and orchestrating a qualified mitigation team.

Progent offers a variety of services for securing Birmingham businesses from crypto-ransomware attacks. Among these are user training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to identify and extinguish zero-day malware attacks. Progent in addition can provide the assistance of experienced ransomware recovery consultants with the skills and perseverance to restore a compromised environment as rapidly as possible.

Progent's Ransomware Restoration Support Services
Following a ransomware penetration, even paying the ransom in cryptocurrency does not ensure that merciless criminals will provide the keys to decipher any or all of your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to piece back together the essential elements of your Information Technology environment. Without the availability of full data backups, this calls for a wide range of skill sets, professional team management, and the willingness to work 24x7 until the task is completed.

For two decades, Progent has provided expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have earned top certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-recognized certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of expertise affords Progent the skills to rapidly understand necessary systems and integrate the remaining parts of your computer network system after a ransomware penetration and rebuild them into a functioning network.

Progent's recovery team of experts has powerful project management systems to coordinate the sophisticated recovery process. Progent understands the urgency of working swiftly and in concert with a client's management and Information Technology team members to prioritize tasks and to put key systems back on-line as soon as humanly possible.

Case Study: A Successful Ransomware Incident Restoration
A client contacted Progent after their organization was attacked by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state criminal gangs, possibly adopting algorithms leaked from the U.S. NSA organization. Ryuk goes after specific businesses with little ability to sustain operational disruption and is among the most profitable versions of ransomware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in the Chicago metro area and has around 500 employees. The Ryuk penetration had brought down all essential operations and manufacturing processes. The majority of the client's data protection had been online at the beginning of the intrusion and were damaged. The client was pursuing financing for paying the ransom (exceeding $200K) and wishfully thinking for good luck, but in the end brought in Progent.

Progent worked with the customer to quickly identify and assign priority to the critical elements that had to be addressed in order to restart business operations:

• Microsoft Active Directory
• Electronic Mail
• Financials/MRP

In less than 2 days, Progent was able to restore Active Directory services to its pre-attack state. Progent then helped perform setup and hard drive recovery of mission critical systems. All Exchange ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to collect intact OST data files (Outlook Off-Line Data Files) on team desktop computers to recover email messages. A not too old offline backup of the customer's accounting/ERP software made them able to recover these vital services back on-line. Although major work was left to recover completely from the Ryuk virus, essential services were restored quickly:

Throughout the following month key milestones in the recovery project were accomplished in tight collaboration between Progent engineers and the customer:

• In-house web sites were returned to operation without losing any data.
• The MailStore Server exceeding four million historical emails was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory capabilities were 100 percent functional.
• A new Palo Alto Networks 850 security appliance was deployed.
• 90% of the user workstations were fully operational.

Conclusion
A probable enterprise-killing catastrophe was averted by dedicated experts, a broad range of technical expertise, and tight collaboration. Although in retrospect the crypto-ransomware virus attack described here could have been prevented with current cyber security technology solutions and security best practices, user and IT administrator training, and properly executed incident response procedures for data protection and proper patching controls, the reality remains that government-sponsored cybercriminals from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware incursion, remember that Progent's roster of experts has substantial experience in ransomware virus defense, remediation, and file recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Birmingham
For ransomware recovery services in the Birmingham metro area, phone Progent at 800-462-8800 or see Contact Progent.