Ransomware Protection and Remediation Expertise Fort Worth

Ransomware : Your Worst IT Catastrophe
Ransomware has become a modern cyber pandemic that presents an extinction-level threat for organizations vulnerable to an assault. Different versions of crypto-ransomware such as CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to cause havoc. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as daily as yet unnamed newcomers, not only perform encryption of on-line critical data but also infect all available system backup. Data synched to cloud environments can also be corrupted. In a poorly architected data protection solution, this can make any recovery useless and effectively sets the datacenter back to square one.

Getting back services and data after a crypto-ransomware outage becomes a sprint against the clock as the victim struggles to contain, eradicate the ransomware, and restore business-critical operations. Since ransomware requires time to move laterally across a targeted network, attacks are usually launched during weekends and nights, when penetrations are likely to take longer to discover. This multiplies the difficulty of quickly assembling and orchestrating a knowledgeable response team.

Progent has a range of support services for securing Fort Worth organizations from crypto-ransomware penetrations. Among these are team member training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat protection to discover and extinguish day-zero malware assaults. Progent in addition can provide the services of veteran crypto-ransomware recovery consultants with the talent and perseverance to rebuild a compromised environment as quickly as possible.

Progent's Ransomware Recovery Help
Subsequent to a ransomware invasion, even paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will respond with the keys to unencrypt any of your data. Kaspersky estimated that seventeen percent of crypto-ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to setup from scratch the vital elements of your Information Technology environment. Absent the availability of complete system backups, this requires a wide range of skill sets, top notch project management, and the willingness to work 24x7 until the task is complete.

For decades, Progent has offered certified expert Information Technology services for businesses across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned top industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in accounting and ERP applications. This breadth of expertise provides Progent the ability to quickly ascertain important systems and consolidate the remaining parts of your computer network system following a ransomware event and configure them into an operational network.

Progent's recovery team has best of breed project management tools to orchestrate the complex restoration process. Progent appreciates the importance of working swiftly and together with a customer's management and IT staff to assign priority to tasks and to put essential services back on line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Penetration Recovery
A business engaged Progent after their network system was penetrated by Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state hackers, suspected of adopting techniques exposed from America's National Security Agency. Ryuk goes after specific businesses with limited room for disruption and is among the most profitable examples of ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer based in the Chicago metro area and has around 500 workers. The Ryuk intrusion had brought down all business operations and manufacturing processes. The majority of the client's data protection had been directly accessible at the time of the intrusion and were destroyed. The client was pursuing financing for paying the ransom demand (exceeding $200,000) and praying for good luck, but ultimately brought in Progent.

Progent worked with the customer to rapidly understand and prioritize the critical systems that had to be addressed in order to restart company functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting/MRP

Within two days, Progent was able to recover Active Directory to its pre-virus state. Progent then performed rebuilding and storage recovery on essential servers. All Microsoft Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to find local OST files (Outlook Email Off-Line Data Files) on team PCs in order to recover mail information. A not too old off-line backup of the customer's accounting/MRP software made them able to restore these vital programs back available to users. Although a lot of work was left to recover fully from the Ryuk virus, critical systems were restored rapidly:

Throughout the next few weeks critical milestones in the restoration process were made in close cooperation between Progent consultants and the client:

• In-house web sites were restored with no loss of data.
• The MailStore Server with over 4 million historical emails was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory functions were fully recovered.
• A new Palo Alto Networks 850 firewall was deployed.
• Ninety percent of the user desktops were functioning as before the incident.

Conclusion
A possible business catastrophe was dodged by hard-working experts, a broad array of technical expertise, and tight teamwork. Although in hindsight the ransomware incident detailed here should have been blocked with advanced security technology and best practices, user training, and properly executed security procedures for data backup and applying software patches, the fact is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware incursion, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, cleanup, and information systems restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Fort Worth
For ransomware recovery consulting services in the Fort Worth area, phone Progent at 800-462-8800 or see Contact Progent.