Ransomware Protection and Removal Solutions Oklahoma CIty

Crypto-Ransomware : Your Feared IT Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that poses an extinction-level danger for organizations unprepared for an attack. Different iterations of ransomware like the Dharma, WannaCry, Locky, SamSam and MongoLock cryptoworms have been out in the wild for years and still cause damage. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, as well as daily as yet unnamed newcomers, not only encrypt on-line files but also infiltrate any configured system restores and backups. Information synchronized to the cloud can also be encrypted. In a poorly designed system, it can render automated restore operations useless and effectively knocks the entire system back to square one.

Restoring applications and information following a crypto-ransomware outage becomes a sprint against the clock as the victim tries its best to stop the spread, cleanup the ransomware, and restore enterprise-critical operations. Since ransomware takes time to replicate throughout a targeted network, attacks are usually launched at night, when successful attacks are likely to take more time to notice. This compounds the difficulty of quickly mobilizing and coordinating an experienced mitigation team.

Progent offers a variety of services for securing Oklahoma CIty businesses from ransomware penetrations. Among these are user training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to detect and extinguish day-zero modern malware attacks. Progent also offers the assistance of experienced crypto-ransomware recovery engineers with the skills and commitment to reconstruct a breached system as soon as possible.

Progent's Crypto-Ransomware Restoration Services
Soon after a crypto-ransomware event, paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will respond with the needed codes to decrypt all your files. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files after having paid the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The alternative is to piece back together the essential components of your Information Technology environment. Without access to full system backups, this requires a broad complement of skill sets, well-coordinated project management, and the willingness to work 24x7 until the task is done.

For decades, Progent has offered certified expert IT services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained advanced certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP applications. This breadth of experience provides Progent the ability to quickly ascertain critical systems and consolidate the remaining components of your computer network system after a crypto-ransomware penetration and assemble them into an operational system.

Progent's security team deploys powerful project management tools to orchestrate the sophisticated restoration process. Progent understands the urgency of working swiftly and in unison with a client's management and Information Technology staff to prioritize tasks and to put essential services back online as fast as humanly possible.

Case Study: A Successful Crypto-Ransomware Incident Recovery
A business hired Progent after their network was attacked by Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean government sponsored hackers, possibly adopting techniques exposed from the U.S. National Security Agency. Ryuk targets specific companies with little ability to sustain operational disruption and is among the most lucrative versions of ransomware. Major targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company based in the Chicago metro area and has about 500 workers. The Ryuk intrusion had brought down all company operations and manufacturing processes. The majority of the client's data backups had been on-line at the time of the intrusion and were damaged. The client was pursuing financing for paying the ransom demand (exceeding $200,000) and wishfully thinking for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the customer to rapidly identify and assign priority to the critical elements that needed to be restored in order to restart business functions:

• Microsoft Active Directory
• Electronic Messaging
• Accounting/MRP

In less than two days, Progent was able to re-build Windows Active Directory to its pre-penetration state. Progent then performed rebuilding and storage recovery of essential servers. All Exchange Server ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Off-Line Data Files) on team PCs and laptops in order to recover mail messages. A recent offline backup of the businesses financials/MRP systems made them able to return these required applications back available to users. Although a large amount of work was left to recover totally from the Ryuk attack, critical services were returned to operations rapidly:

Throughout the next month critical milestones in the restoration project were made in close cooperation between Progent team members and the client:

• In-house web applications were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server exceeding 4 million historical messages was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were 100 percent operational.
• A new Palo Alto 850 firewall was deployed.
• Nearly all of the user PCs were fully operational.

Conclusion
A likely business extinction disaster was averted through the efforts of dedicated professionals, a broad array of IT skills, and tight teamwork. Although in retrospect the crypto-ransomware virus incident detailed here could have been identified and blocked with modern cyber security systems and ISO/IEC 27001 best practices, user training, and appropriate security procedures for information backup and applying software patches, the fact is that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware incursion, feel confident that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, cleanup, and data disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Oklahoma CIty
For ransomware system recovery consulting in the Oklahoma CIty metro area, phone Progent at 800-462-8800 or see Contact Progent.