Ransomware Defense and Remediation Expertise The Woodlands

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that presents an extinction-level danger for organizations unprepared for an attack. Different versions of crypto-ransomware such as Reveton, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for a long time and still inflict havoc. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with more as yet unnamed malware, not only perform encryption of on-line information but also infiltrate all available system restores and backups. Information synched to cloud environments can also be ransomed. In a poorly designed system, this can make automatic restoration hopeless and basically knocks the entire system back to zero.

Getting back on-line programs and data following a crypto-ransomware event becomes a race against time as the targeted business struggles to contain the damage, remove the ransomware, and resume business-critical activity. Since crypto-ransomware takes time to spread throughout a network, assaults are frequently sprung on weekends and holidays, when successful penetrations are likely to take longer to notice. This multiplies the difficulty of promptly mobilizing and organizing a knowledgeable response team.

Progent makes available a range of solutions for protecting The Woodlands enterprises from ransomware events. These include staff training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to detect and quarantine day-zero modern malware attacks. Progent also provides the assistance of expert ransomware recovery professionals with the track record and commitment to reconstruct a breached environment as rapidly as possible.

Progent's Ransomware Restoration Help
After a crypto-ransomware event, paying the ransom demands in cryptocurrency does not guarantee that distant criminals will respond with the codes to decipher any of your data. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to piece back together the key parts of your IT environment. Absent the availability of essential information backups, this requires a broad range of skills, top notch project management, and the capability to work non-stop until the job is finished.

For twenty years, Progent has made available professional IT services for companies throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in accounting and ERP software solutions. This breadth of experience gives Progent the capability to efficiently identify necessary systems and consolidate the remaining parts of your IT environment after a ransomware penetration and assemble them into an operational system.

Progent's ransomware team of experts has top notch project management applications to coordinate the sophisticated recovery process. Progent appreciates the urgency of working quickly and together with a customer's management and Information Technology staff to assign priority to tasks and to get critical services back online as fast as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Virus Restoration
A customer sought out Progent after their network system was taken over by the Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored cybercriminals, suspected of adopting strategies exposed from the United States National Security Agency. Ryuk targets specific organizations with limited room for operational disruption and is one of the most profitable instances of ransomware viruses. Headline victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer based in the Chicago metro area and has around 500 employees. The Ryuk attack had brought down all essential operations and manufacturing processes. The majority of the client's information backups had been directly accessible at the time of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (exceeding $200K) and hoping for the best, but in the end engaged Progent.

Progent worked hand in hand the customer to rapidly understand and assign priority to the essential applications that needed to be restored in order to resume departmental operations:

• Active Directory
• Exchange Server
• MRP System

In less than two days, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then accomplished rebuilding and storage recovery on essential servers. All Exchange schema and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to assemble intact OST files (Microsoft Outlook Off-Line Data Files) on user workstations and laptops to recover mail data. A not too old offline backup of the client's accounting/ERP systems made them able to restore these essential applications back online. Although significant work still had to be done to recover completely from the Ryuk event, essential systems were recovered quickly:

Throughout the next couple of weeks key milestones in the recovery process were achieved in tight collaboration between Progent consultants and the customer:

• Self-hosted web sites were restored without losing any data.
• The MailStore Server exceeding four million historical messages was spun up and available for users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory functions were fully restored.
• A new Palo Alto Networks 850 security appliance was set up.
• 90% of the user PCs were fully operational.

Conclusion
A potential company-ending disaster was avoided with dedicated experts, a broad array of IT skills, and tight teamwork. Although in hindsight the crypto-ransomware penetration detailed here should have been identified and disabled with up-to-date security technology solutions and NIST Cybersecurity Framework best practices, team training, and well designed security procedures for data backup and proper patching controls, the reality remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware incursion, remember that Progent's team of professionals has proven experience in ransomware virus blocking, cleanup, and data restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in The Woodlands
For ransomware system restoration expertise in the The Woodlands metro area, phone Progent at 800-462-8800 or see Contact Progent.