Ransomware Defense and Cleanup Solutions Barueri-Alphaville

Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become an escalating cyberplague that presents an existential threat for businesses vulnerable to an assault. Multiple generations of crypto-ransomware like the CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for many years and still cause havoc. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus additional unnamed malware, not only encrypt online information but also infect any accessible system restores and backups. Information synched to the cloud can also be encrypted. In a poorly architected system, it can make automated recovery hopeless and basically sets the entire system back to square one.

Getting back on-line services and information after a ransomware attack becomes a sprint against time as the victim tries its best to contain, eradicate the virus, and restore enterprise-critical activity. Since ransomware requires time to replicate throughout a network, attacks are usually launched during weekends and nights, when successful attacks typically take more time to discover. This multiplies the difficulty of promptly marshalling and orchestrating a qualified response team.

Progent offers a range of solutions for securing Barueri-Alphaville enterprises from crypto-ransomware events. These include user education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat protection to discover and extinguish day-zero modern malware attacks. Progent also can provide the services of seasoned ransomware recovery professionals with the track record and commitment to reconstruct a compromised network as quickly as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will provide the codes to decipher all your files. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their data after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The fallback is to setup from scratch the mission-critical elements of your Information Technology environment. Absent the availability of essential information backups, this calls for a wide range of IT skills, well-coordinated project management, and the capability to work continuously until the recovery project is completed.

For two decades, Progent has provided certified expert Information Technology services for companies throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained high-level certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of experience affords Progent the capability to knowledgably determine critical systems and re-organize the remaining parts of your IT environment following a ransomware penetration and rebuild them into a functioning system.

Progent's security team of experts deploys best of breed project management systems to coordinate the sophisticated recovery process. Progent knows the importance of acting rapidly and in unison with a customer's management and IT resources to assign priority to tasks and to put key services back online as fast as humanly possible.

Customer Story: A Successful Crypto-Ransomware Incident Restoration
A business engaged Progent after their company was crashed by the Ryuk ransomware. Ryuk is thought to have been launched by North Korean state sponsored cybercriminals, suspected of adopting algorithms leaked from the U.S. National Security Agency. Ryuk attacks specific businesses with little room for operational disruption and is one of the most profitable iterations of ransomware malware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer located in Chicago with around 500 workers. The Ryuk intrusion had brought down all essential operations and manufacturing capabilities. Most of the client's information backups had been on-line at the time of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom (exceeding $200,000) and wishfully thinking for the best, but ultimately utilized Progent.

Progent worked together with the client to quickly assess and assign priority to the essential areas that had to be addressed in order to continue company functions:

• Microsoft Active Directory
• Microsoft Exchange Email
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then initiated rebuilding and hard drive recovery of essential servers. All Exchange data and attributes were intact, which accelerated the restore of Exchange. Progent was able to locate local OST data files (Microsoft Outlook Off-Line Folder Files) on various desktop computers and laptops to recover email messages. A not too old offline backup of the businesses accounting/MRP systems made them able to recover these essential applications back available to users. Although a large amount of work needed to be completed to recover fully from the Ryuk virus, essential services were recovered rapidly:

During the following couple of weeks key milestones in the recovery process were accomplished through tight cooperation between Progent team members and the customer:

• Internal web applications were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server containing more than 4 million archived emails was restored to operations and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were fully restored.
• A new Palo Alto Networks 850 security appliance was brought online.
• 90% of the desktop computers were fully operational.

Conclusion
A potential business extinction disaster was evaded by results-oriented professionals, a wide range of technical expertise, and tight collaboration. Although in post mortem the ransomware penetration described here should have been identified and stopped with advanced security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator education, and well designed incident response procedures for data protection and keeping systems up to date with security patches, the fact remains that government-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's roster of professionals has substantial experience in ransomware virus blocking, removal, and data disaster recovery.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Barueri-Alphaville
For ransomware recovery expertise in the Barueri-Alphaville area, call Progent at 800-462-8800 or go to Contact Progent.