Ransomware Protection and Recovery Expertise Greensboro

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an existential threat for businesses of all sizes unprepared for an assault. Different iterations of ransomware such as CryptoLocker, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for years and still cause harm. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, plus more as yet unnamed viruses, not only encrypt online data files but also infect all accessible system protection. Files synched to cloud environments can also be rendered useless. In a vulnerable data protection solution, this can render automatic restoration impossible and effectively knocks the entire system back to zero.

Recovering applications and information after a ransomware attack becomes a sprint against time as the victim fights to stop the spread, remove the virus, and resume mission-critical activity. Since crypto-ransomware requires time to replicate throughout a network, penetrations are frequently launched on weekends, when successful attacks in many cases take more time to detect. This multiplies the difficulty of quickly marshalling and orchestrating a qualified mitigation team.

Progent has a variety of support services for securing Greensboro enterprises from ransomware events. Among these are staff training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to detect and disable day-zero malware attacks. Progent also provides the assistance of expert crypto-ransomware recovery engineers with the talent and perseverance to re-deploy a compromised network as urgently as possible.

Progent's Ransomware Recovery Support Services
After a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that cyber criminals will respond with the keys to decrypt all your information. Kaspersky ascertained that 17% of ransomware victims never restored their data even after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to piece back together the key parts of your IT environment. Absent access to full system backups, this requires a broad range of skill sets, professional project management, and the ability to work continuously until the task is finished.

For two decades, Progent has made available expert IT services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have been awarded high-level industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with financial management and ERP application software. This breadth of expertise affords Progent the skills to knowledgably determine critical systems and re-organize the surviving parts of your IT environment following a ransomware penetration and rebuild them into an operational system.

Progent's recovery group deploys top notch project management applications to orchestrate the complicated restoration process. Progent understands the urgency of acting rapidly and together with a customer's management and Information Technology team members to prioritize tasks and to get key applications back on-line as fast as humanly possible.

Customer Case Study: A Successful Ransomware Penetration Recovery
A client sought out Progent after their network was attacked by Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean state sponsored hackers, possibly using strategies leaked from America's NSA organization. Ryuk targets specific companies with limited tolerance for disruption and is among the most profitable iterations of ransomware malware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company based in Chicago and has about 500 workers. The Ryuk event had brought down all business operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the beginning of the intrusion and were damaged. The client was evaluating paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but ultimately reached out to Progent.

Progent worked with the customer to quickly determine and assign priority to the essential applications that needed to be recovered in order to resume business functions:

• Microsoft Active Directory
• Exchange Server
• MRP System

In less than 48 hours, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then charged ahead with rebuilding and hard drive recovery on key systems. All Microsoft Exchange Server data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on various PCs in order to recover email information. A not too old offline backup of the client's accounting/MRP systems made them able to restore these required programs back servicing users. Although a large amount of work needed to be completed to recover fully from the Ryuk damage, core systems were recovered rapidly:

During the next couple of weeks critical milestones in the recovery process were made in close cooperation between Progent team members and the customer:

• Internal web applications were brought back up without losing any information.
• The MailStore Exchange Server containing more than 4 million historical messages was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 security appliance was brought online.
• Most of the user workstations were fully operational.

Conclusion
A probable business-ending disaster was evaded with top-tier experts, a wide spectrum of technical expertise, and tight teamwork. Although upon completion of forensics the ransomware penetration described here would have been stopped with advanced security technology solutions and ISO/IEC 27001 best practices, team education, and appropriate incident response procedures for information backup and proper patching controls, the fact remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware attack, remember that Progent's team of professionals has proven experience in ransomware virus blocking, removal, and information systems restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Greensboro
For ransomware system recovery consulting services in the Greensboro area, call Progent at 800-462-8800 or visit Contact Progent.