Ransomware Filtering and Recovery Solutions Colorado Springs

Crypto-Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level danger for organizations vulnerable to an assault. Multiple generations of ransomware such as Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for years and continue to cause destruction. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, plus daily as yet unnamed malware, not only perform encryption of on-line data but also infiltrate all configured system protection. Information synched to the cloud can also be encrypted. In a vulnerable system, this can make automatic recovery impossible and basically knocks the entire system back to zero.

Recovering applications and information following a crypto-ransomware outage becomes a race against time as the targeted organization struggles to stop the spread, eradicate the ransomware, and resume business-critical operations. Due to the fact that ransomware requires time to move laterally across a targeted network, attacks are often sprung at night, when penetrations in many cases take longer to discover. This multiplies the difficulty of quickly mobilizing and coordinating a capable response team.

Progent provides an assortment of support services for securing Colorado Springs organizations from crypto-ransomware penetrations. Among these are staff training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to detect and extinguish day-zero modern malware attacks. Progent also can provide the services of expert crypto-ransomware recovery professionals with the talent and commitment to restore a breached environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a crypto-ransomware attack, paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will provide the needed keys to unencrypt any of your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The other path is to setup from scratch the mission-critical components of your IT environment. Without the availability of full system backups, this calls for a wide complement of skills, top notch team management, and the ability to work non-stop until the recovery project is complete.

For twenty years, Progent has made available professional Information Technology services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded top industry certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in accounting and ERP software solutions. This breadth of experience gives Progent the capability to knowledgably understand necessary systems and integrate the surviving pieces of your network system following a ransomware attack and assemble them into an operational system.

Progent's security group deploys top notch project management tools to coordinate the complicated recovery process. Progent appreciates the importance of working quickly and together with a customer's management and IT staff to assign priority to tasks and to put critical systems back on line as soon as possible.

Client Story: A Successful Crypto-Ransomware Virus Restoration
A customer sought out Progent after their network was taken over by the Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean state cybercriminals, suspected of using approaches leaked from America's National Security Agency. Ryuk seeks specific businesses with little or no ability to sustain operational disruption and is among the most lucrative incarnations of ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing business located in Chicago and has about 500 workers. The Ryuk event had frozen all business operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the beginning of the attack and were eventually encrypted. The client was taking steps for paying the ransom (more than two hundred thousand dollars) and hoping for good luck, but ultimately made the decision to use Progent.

Progent worked with the client to rapidly assess and assign priority to the critical applications that had to be addressed in order to continue departmental functions:

• Active Directory
• Exchange Server
• Financials/MRP

Within 48 hours, Progent was able to restore Active Directory services to its pre-penetration state. Progent then helped perform setup and storage recovery on the most important systems. All Exchange Server ties and attributes were intact, which facilitated the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Email Offline Folder Files) on team desktop computers to recover mail information. A not too old offline backup of the client's accounting software made them able to restore these vital programs back on-line. Although major work remained to recover totally from the Ryuk virus, critical services were returned to operations quickly:

Over the next few weeks important milestones in the restoration process were completed through close cooperation between Progent consultants and the client:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Exchange Server exceeding 4 million archived messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control functions were 100 percent recovered.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• Nearly all of the user desktops were functioning as before the incident.

Conclusion
A likely enterprise-killing disaster was averted through the efforts of dedicated professionals, a broad range of subject matter expertise, and tight collaboration. Although in hindsight the ransomware virus incident detailed here could have been identified and blocked with advanced cyber security solutions and ISO/IEC 27001 best practices, user and IT administrator education, and well thought out security procedures for backup and applying software patches, the reality remains that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's roster of experts has proven experience in ransomware virus blocking, remediation, and data recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Colorado Springs
For ransomware system recovery services in the Colorado Springs area, call Progent at 800-462-8800 or see Contact Progent.