Ransomware Filtering and Cleanup Solutions Birmingham

Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become an escalating cyberplague that presents an enterprise-level danger for businesses poorly prepared for an attack. Different iterations of crypto-ransomware such as CrySIS, Fusob, Locky, SamSam and MongoLock cryptoworms have been around for a long time and continue to inflict harm. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, along with daily unnamed newcomers, not only encrypt on-line data files but also infect any accessible system backups. Files replicated to off-premises disaster recovery sites can also be corrupted. In a poorly designed environment, it can make automated recovery impossible and effectively sets the entire system back to square one.

Restoring services and information following a ransomware event becomes a sprint against time as the targeted organization struggles to stop lateral movement, cleanup the ransomware, and resume mission-critical operations. Because ransomware requires time to replicate across a targeted network, penetrations are often sprung during weekends and nights, when successful penetrations may take longer to recognize. This compounds the difficulty of promptly mobilizing and orchestrating a qualified mitigation team.

Progent makes available an assortment of support services for securing Birmingham businesses from crypto-ransomware penetrations. Among these are team member training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat defense to discover and quarantine day-zero malware assaults. Progent also offers the services of experienced ransomware recovery engineers with the talent and perseverance to restore a breached environment as quickly as possible.

Progent's Ransomware Recovery Services
Following a ransomware attack, sending the ransom demands in cryptocurrency does not ensure that cyber hackers will provide the codes to unencrypt any or all of your information. Kaspersky determined that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to re-install the vital elements of your IT environment. Without access to full system backups, this calls for a broad range of skill sets, professional team management, and the capability to work continuously until the recovery project is completed.

For decades, Progent has offered certified expert Information Technology services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned high-level certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of expertise affords Progent the capability to quickly understand important systems and re-organize the remaining components of your Information Technology system after a crypto-ransomware penetration and rebuild them into an operational network.

Progent's recovery group uses powerful project management systems to orchestrate the sophisticated restoration process. Progent understands the importance of acting quickly and together with a client's management and Information Technology team members to prioritize tasks and to put critical applications back on-line as fast as humanly possible.

Customer Story: A Successful Ransomware Attack Response
A customer engaged Progent after their network was crashed by the Ryuk ransomware. Ryuk is believed to have been developed by North Korean government sponsored hackers, suspected of adopting technology exposed from the United States National Security Agency. Ryuk attacks specific businesses with little or no tolerance for disruption and is among the most profitable instances of ransomware viruses. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in the Chicago metro area with around 500 staff members. The Ryuk event had paralyzed all company operations and manufacturing processes. Most of the client's system backups had been online at the start of the attack and were eventually encrypted. The client was taking steps for paying the ransom demand (in excess of $200K) and hoping for good luck, but in the end utilized Progent.

Progent worked with the client to quickly assess and prioritize the mission critical areas that needed to be recovered to make it possible to resume departmental operations:

• Windows Active Directory
• Email
• Financials/MRP

In less than 2 days, Progent was able to rebuild Active Directory to its pre-attack state. Progent then assisted with setup and hard drive recovery on the most important applications. All Exchange Server schema and attributes were usable, which greatly helped the restore of Exchange. Progent was also able to assemble non-encrypted OST data files (Outlook Off-Line Folder Files) on team workstations and laptops to recover email data. A recent off-line backup of the client's financials/ERP systems made them able to restore these required programs back online for users. Although major work was left to recover fully from the Ryuk attack, core systems were recovered rapidly:

Throughout the following couple of weeks important milestones in the restoration project were achieved in close collaboration between Progent consultants and the client:

• Self-hosted web applications were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server with over four million archived messages was restored to operations and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control capabilities were 100 percent operational.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the desktops and laptops were back into operation.

Conclusion
A possible business catastrophe was dodged through the efforts of dedicated experts, a wide array of subject matter expertise, and tight collaboration. Although upon completion of forensics the crypto-ransomware incident detailed here would have been prevented with advanced security systems and best practices, user and IT administrator training, and well designed incident response procedures for information protection and applying software patches, the fact remains that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware virus, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, cleanup, and information systems disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Birmingham
For ransomware system restoration expertise in the Birmingham metro area, call Progent at 800-462-8800 or go to Contact Progent.