Ransomware Protection and Removal Consulting Southfield

Ransomware : Your Feared IT Disaster
Ransomware has become a modern cyberplague that poses an existential danger for businesses poorly prepared for an attack. Different iterations of crypto-ransomware like the Reveton, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been replicating for many years and continue to inflict damage. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, plus daily unnamed viruses, not only encrypt on-line information but also infiltrate most accessible system backup. Information synched to the cloud can also be ransomed. In a vulnerable system, this can render any recovery useless and effectively knocks the network back to zero.

Recovering programs and data following a ransomware event becomes a sprint against time as the targeted organization fights to stop the spread, remove the crypto-ransomware, and resume business-critical operations. Due to the fact that ransomware needs time to move laterally across a network, attacks are usually sprung on weekends, when successful attacks typically take longer to recognize. This multiplies the difficulty of rapidly assembling and organizing a capable response team.

Progent makes available a range of services for protecting Southfield organizations from ransomware events. Among these are staff training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to detect and quarantine zero-day malware attacks. Progent in addition can provide the assistance of seasoned ransomware recovery engineers with the talent and commitment to rebuild a compromised system as quickly as possible.

Progent's Ransomware Restoration Services
Soon after a ransomware penetration, even paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will respond with the keys to decrypt all your files. Kaspersky estimated that seventeen percent of crypto-ransomware victims never restored their data even after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The other path is to setup from scratch the essential parts of your IT environment. Absent access to full data backups, this requires a broad complement of skill sets, professional team management, and the willingness to work non-stop until the task is finished.

For decades, Progent has provided professional Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have been awarded top industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-recognized certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of expertise provides Progent the ability to efficiently understand important systems and integrate the remaining components of your network environment after a ransomware penetration and assemble them into a functioning network.

Progent's security team of experts deploys best of breed project management tools to orchestrate the complicated restoration process. Progent understands the urgency of acting rapidly and in unison with a client's management and Information Technology staff to prioritize tasks and to get the most important services back on line as soon as possible.

Client Case Study: A Successful Ransomware Incident Restoration
A client hired Progent after their network system was attacked by the Ryuk ransomware virus. Ryuk is generally considered to have been launched by North Korean state sponsored criminal gangs, possibly adopting techniques exposed from the U.S. NSA organization. Ryuk attacks specific companies with little room for disruption and is among the most profitable examples of crypto-ransomware. Headline victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago and has around 500 staff members. The Ryuk attack had brought down all essential operations and manufacturing processes. Most of the client's backups had been on-line at the beginning of the attack and were encrypted. The client considered paying the ransom (more than $200,000) and praying for the best, but in the end made the decision to use Progent.

Progent worked with the customer to rapidly get our arms around and prioritize the most important applications that had to be recovered to make it possible to continue departmental operations:

• Windows Active Directory
• E-Mail
• Financials/MRP

In less than 2 days, Progent was able to re-build Active Directory services to its pre-virus state. Progent then performed setup and storage recovery on needed applications. All Exchange data and attributes were usable, which accelerated the restore of Exchange. Progent was able to find local OST data files (Outlook Off-Line Folder Files) on team PCs in order to recover mail information. A not too old offline backup of the client's accounting/ERP software made them able to recover these required programs back servicing users. Although a large amount of work was left to recover completely from the Ryuk attack, critical systems were returned to operations quickly:

Over the following month key milestones in the restoration process were accomplished through tight collaboration between Progent team members and the client:

• In-house web applications were restored with no loss of information.
• The MailStore Exchange Server with over four million historical emails was restored to operations and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control modules were 100% restored.
• A new Palo Alto 850 security appliance was installed and configured.
• 90% of the desktop computers were back into operation.

Conclusion
A probable company-ending catastrophe was dodged with hard-working professionals, a wide spectrum of technical expertise, and tight teamwork. Although in post mortem the ransomware penetration detailed here would have been identified and stopped with advanced cyber security solutions and security best practices, user and IT administrator education, and well thought out security procedures for data protection and proper patching controls, the fact is that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware attack, remember that Progent's team of experts has extensive experience in ransomware virus blocking, mitigation, and information systems recovery.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Southfield
For ransomware system recovery expertise in the Southfield area, phone Progent at 800-462-8800 or see Contact Progent.