Ransomware Protection and Recovery Services Des Moines

Crypto-Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyberplague that represents an existential danger for organizations poorly prepared for an assault. Different iterations of ransomware like the Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been replicating for years and continue to cause destruction. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, along with additional as yet unnamed newcomers, not only encrypt on-line files but also infect all accessible system backups. Data synched to the cloud can also be encrypted. In a poorly architected environment, this can render any restoration hopeless and basically sets the network back to zero.

Restoring applications and information following a crypto-ransomware attack becomes a race against the clock as the targeted organization fights to stop the spread, cleanup the ransomware, and resume mission-critical activity. Because ransomware takes time to move laterally across a network, assaults are usually launched during nights and weekends, when successful penetrations typically take more time to detect. This compounds the difficulty of promptly assembling and coordinating a capable mitigation team.

Progent makes available a variety of help services for protecting Des Moines enterprises from ransomware attacks. Among these are team education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to discover and suppress day-zero malware attacks. Progent in addition provides the services of veteran ransomware recovery professionals with the talent and commitment to rebuild a breached system as urgently as possible.

Progent's Ransomware Recovery Services
Soon after a ransomware event, even paying the ransom demands in cryptocurrency does not ensure that merciless criminals will return the codes to decrypt any or all of your files. Kaspersky Labs estimated that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The fallback is to re-install the vital components of your Information Technology environment. Absent access to full system backups, this calls for a wide range of skills, top notch project management, and the willingness to work 24x7 until the task is done.

For decades, Progent has made available certified expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained top certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with accounting and ERP application software. This breadth of experience provides Progent the capability to quickly determine critical systems and re-organize the remaining components of your IT system after a ransomware attack and configure them into a functioning network.

Progent's security team of experts uses best of breed project management tools to orchestrate the sophisticated restoration process. Progent appreciates the urgency of working rapidly and together with a client's management and Information Technology team members to prioritize tasks and to get essential applications back on line as fast as possible.

Client Case Study: A Successful Crypto-Ransomware Virus Response
A business engaged Progent after their network system was penetrated by Ryuk ransomware virus. Ryuk is believed to have been deployed by North Korean state sponsored criminal gangs, possibly using techniques leaked from the United States National Security Agency. Ryuk goes after specific organizations with little tolerance for disruption and is one of the most lucrative incarnations of ransomware viruses. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business based in Chicago and has about 500 employees. The Ryuk penetration had frozen all company operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the beginning of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom (more than $200,000) and hoping for good luck, but in the end called Progent.

Progent worked hand in hand the client to rapidly assess and prioritize the essential elements that had to be addressed to make it possible to resume company operations:

• Windows Active Directory
• Exchange Server
• Financials/MRP

In less than 48 hours, Progent was able to recover Active Directory to its pre-virus state. Progent then initiated reinstallations and storage recovery of key systems. All Exchange ties and attributes were usable, which greatly helped the restore of Exchange. Progent was able to find local OST files (Outlook Offline Data Files) on various desktop computers in order to recover email messages. A not too old offline backup of the businesses accounting software made it possible to recover these required applications back available to users. Although a lot of work still had to be done to recover completely from the Ryuk damage, essential systems were restored quickly:

Over the next couple of weeks important milestones in the recovery project were accomplished in close collaboration between Progent engineers and the client:

• Self-hosted web sites were returned to operation without losing any data.
• The MailStore Exchange Server with over 4 million historical messages was restored to operations and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were 100 percent restored.
• A new Palo Alto Networks 850 security appliance was brought online.
• Most of the desktop computers were operational.

Conclusion
A likely business-ending catastrophe was dodged by top-tier professionals, a broad range of technical expertise, and close collaboration. Although in analyzing the event afterwards the ransomware incident detailed here could have been identified and disabled with modern security technology solutions and security best practices, user education, and well thought out incident response procedures for information protection and keeping systems up to date with security patches, the fact is that government-sponsored cybercriminals from China, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware incursion, remember that Progent's roster of professionals has extensive experience in ransomware virus defense, mitigation, and data disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Des Moines
For ransomware recovery consulting services in the Des Moines metro area, phone Progent at 800-462-8800 or go to Contact Progent.