Ransomware Filtering and Restoration Expertise Barueri-Alphaville

Crypto-Ransomware : Your Worst IT Catastrophe
Crypto-Ransomware has become a too-frequent cyberplague that presents an existential threat for businesses of all sizes unprepared for an assault. Versions of crypto-ransomware like the CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been around for years and still inflict havoc. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, as well as additional as yet unnamed malware, not only encrypt on-line files but also infiltrate many configured system protection. Files replicated to off-premises disaster recovery sites can also be ransomed. In a poorly designed data protection solution, it can render any restore operations hopeless and basically sets the datacenter back to zero.

Recovering programs and information following a crypto-ransomware event becomes a race against time as the targeted business fights to stop lateral movement, remove the ransomware, and restore enterprise-critical activity. Since ransomware needs time to replicate across a network, attacks are frequently launched on weekends, when attacks are likely to take more time to discover. This compounds the difficulty of promptly marshalling and coordinating a knowledgeable response team.

Progent provides an assortment of support services for securing Barueri-Alphaville businesses from crypto-ransomware events. Among these are team training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat defense to discover and disable zero-day malware attacks. Progent also offers the assistance of experienced ransomware recovery engineers with the track record and commitment to rebuild a breached system as quickly as possible.

Progent's Ransomware Restoration Services
After a ransomware event, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will return the needed codes to decipher any of your files. Kaspersky Labs determined that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The fallback is to piece back together the vital components of your Information Technology environment. Absent access to essential system backups, this requires a wide complement of skill sets, well-coordinated team management, and the willingness to work non-stop until the recovery project is over.

For two decades, Progent has made available professional Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience provides Progent the ability to knowledgably understand necessary systems and consolidate the remaining pieces of your IT system following a ransomware penetration and configure them into an operational network.

Progent's recovery team of experts utilizes state-of-the-art project management applications to coordinate the sophisticated restoration process. Progent understands the urgency of acting swiftly and together with a client's management and Information Technology resources to prioritize tasks and to put critical services back online as fast as humanly possible.

Customer Story: A Successful Ransomware Virus Response
A customer escalated to Progent after their organization was penetrated by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state cybercriminals, possibly adopting techniques exposed from America's NSA organization. Ryuk goes after specific companies with little or no tolerance for disruption and is one of the most lucrative incarnations of ransomware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company based in the Chicago metro area with about 500 employees. The Ryuk attack had shut down all company operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the start of the intrusion and were damaged. The client was pursuing financing for paying the ransom (in excess of two hundred thousand dollars) and hoping for good luck, but ultimately brought in Progent.

Progent worked hand in hand the customer to quickly determine and prioritize the mission critical areas that needed to be addressed in order to resume departmental functions:

• Active Directory (AD)
• E-Mail
• Financials/MRP

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then assisted with reinstallations and hard drive recovery on critical servers. All Exchange data and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to assemble intact OST data files (Microsoft Outlook Off-Line Folder Files) on user workstations and laptops in order to recover email data. A not too old offline backup of the customer's accounting systems made them able to recover these vital programs back servicing users. Although significant work needed to be completed to recover completely from the Ryuk attack, essential systems were returned to operations quickly:

Over the next few weeks critical milestones in the restoration project were achieved in tight collaboration between Progent team members and the client:

• Internal web applications were returned to operation without losing any data.
• The MailStore Exchange Server containing more than four million archived emails was spun up and available for users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control modules were completely operational.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Ninety percent of the desktops and laptops were operational.

Conclusion
A possible business-killing catastrophe was avoided with hard-working experts, a wide range of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware attack detailed here should have been shut down with advanced security systems and NIST Cybersecurity Framework best practices, team training, and properly executed incident response procedures for data backup and keeping systems up to date with security patches, the reality is that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware attack, remember that Progent's roster of experts has extensive experience in ransomware virus defense, mitigation, and file disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Barueri-Alphaville
For ransomware system recovery consulting services in the Barueri-Alphaville metro area, call Progent at 800-462-8800 or visit Contact Progent.