Ransomware Defense and Recovery Solutions Los Angeles

Crypto-Ransomware : Your Feared IT Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an extinction-level threat for businesses vulnerable to an assault. Different versions of ransomware such as CrySIS, Fusob, Locky, SamSam and MongoLock cryptoworms have been out in the wild for years and still inflict havoc. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, as well as daily as yet unnamed newcomers, not only perform encryption of on-line data but also infect many accessible system backups. Data replicated to off-premises disaster recovery sites can also be ransomed. In a poorly architected environment, it can render automatic restore operations useless and basically sets the entire system back to square one.

Retrieving applications and information after a ransomware attack becomes a race against time as the targeted business struggles to stop lateral movement, eradicate the crypto-ransomware, and restore enterprise-critical operations. Since ransomware requires time to move laterally throughout a targeted network, assaults are often launched during nights and weekends, when attacks may take more time to notice. This compounds the difficulty of promptly marshalling and coordinating a qualified response team.

Progent provides a range of support services for protecting Los Angeles organizations from ransomware attacks. Among these are user training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to detect and quarantine day-zero malware attacks. Progent also provides the assistance of expert crypto-ransomware recovery professionals with the skills and commitment to reconstruct a breached system as quickly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a ransomware attack, sending the ransom in cryptocurrency does not guarantee that criminal gangs will return the needed keys to decipher any of your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to piece back together the key components of your Information Technology environment. Without the availability of essential information backups, this calls for a broad range of skill sets, well-coordinated team management, and the capability to work 24x7 until the task is finished.

For twenty years, Progent has provided expert IT services for companies across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded top industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial management and ERP application software. This breadth of experience affords Progent the skills to rapidly understand necessary systems and integrate the surviving pieces of your network environment after a ransomware event and configure them into a functioning network.

Progent's ransomware group has top notch project management applications to orchestrate the sophisticated recovery process. Progent appreciates the urgency of working rapidly and in concert with a client's management and IT staff to assign priority to tasks and to get critical systems back on-line as fast as humanly possible.

Case Study: A Successful Ransomware Intrusion Recovery
A business hired Progent after their network was crashed by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state criminal gangs, suspected of adopting approaches exposed from the U.S. National Security Agency. Ryuk goes after specific businesses with limited tolerance for operational disruption and is one of the most lucrative iterations of crypto-ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in Chicago and has about 500 employees. The Ryuk intrusion had paralyzed all essential operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the start of the attack and were eventually encrypted. The client was evaluating paying the ransom (more than two hundred thousand dollars) and praying for the best, but ultimately engaged Progent.

Progent worked hand in hand the client to rapidly determine and prioritize the essential elements that had to be addressed in order to restart departmental operations:

• Microsoft Active Directory
• Electronic Mail
• MRP System

In less than two days, Progent was able to recover Active Directory to its pre-virus state. Progent then initiated reinstallations and storage recovery on key applications. All Microsoft Exchange Server schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Microsoft Outlook Offline Data Files) on team PCs and laptops to recover mail information. A not too old offline backup of the client's accounting/ERP software made them able to recover these vital services back servicing users. Although major work still had to be done to recover totally from the Ryuk attack, critical services were recovered rapidly:

Throughout the following few weeks critical milestones in the recovery project were completed in close collaboration between Progent engineers and the client:

• Self-hosted web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million archived messages was brought online and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory functions were 100% operational.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Nearly all of the desktop computers were fully operational.

Conclusion
A likely business-ending catastrophe was avoided through the efforts of hard-working experts, a wide range of knowledge, and tight collaboration. Although upon completion of forensics the crypto-ransomware virus penetration detailed here would have been prevented with current security technology solutions and recognized best practices, team education, and well thought out incident response procedures for data backup and keeping systems up to date with security patches, the reality remains that government-sponsored cybercriminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware virus, feel confident that Progent's roster of experts has substantial experience in ransomware virus defense, mitigation, and file disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Los Angeles
For ransomware system restoration consulting in the Los Angeles metro area, phone Progent at 800-462-8800 or visit Contact Progent.