Ransomware Prevention and Recovery Services Greensboro

Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become an escalating cyberplague that represents an existential threat for businesses vulnerable to an assault. Different versions of ransomware such as Reveton, Fusob, Locky, Syskey and MongoLock cryptoworms have been around for many years and still inflict harm. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, plus daily unnamed malware, not only encrypt on-line data files but also infiltrate many accessible system protection mechanisms. Data replicated to the cloud can also be rendered useless. In a poorly architected environment, this can render automated restoration impossible and effectively sets the network back to zero.

Getting back programs and information following a ransomware intrusion becomes a race against time as the targeted organization fights to contain, cleanup the ransomware, and resume enterprise-critical operations. Since ransomware needs time to move laterally throughout a targeted network, assaults are frequently launched during nights and weekends, when successful attacks are likely to take longer to discover. This compounds the difficulty of rapidly assembling and orchestrating an experienced response team.

Progent makes available a range of support services for securing Greensboro organizations from ransomware penetrations. Among these are team member training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat defense to identify and disable day-zero modern malware assaults. Progent also offers the services of experienced crypto-ransomware recovery consultants with the skills and commitment to reconstruct a breached system as soon as possible.

Progent's Ransomware Restoration Services
After a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not ensure that criminal gangs will provide the needed codes to decrypt any or all of your data. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files even after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The alternative is to setup from scratch the essential components of your Information Technology environment. Without access to full information backups, this calls for a wide complement of IT skills, well-coordinated project management, and the ability to work non-stop until the task is completed.

For two decades, Progent has offered certified expert Information Technology services for companies throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP applications. This breadth of expertise gives Progent the skills to rapidly determine important systems and organize the remaining components of your network environment after a ransomware event and configure them into an operational network.

Progent's ransomware team utilizes state-of-the-art project management applications to orchestrate the complicated restoration process. Progent appreciates the importance of acting quickly and in concert with a customer's management and Information Technology resources to assign priority to tasks and to get essential services back on line as soon as possible.

Business Case Study: A Successful Ransomware Attack Response
A customer escalated to Progent after their company was brought down by the Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean state sponsored hackers, possibly using technology exposed from the U.S. NSA organization. Ryuk goes after specific organizations with little tolerance for disruption and is among the most profitable examples of ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in the Chicago metro area with about 500 staff members. The Ryuk penetration had disabled all business operations and manufacturing processes. Most of the client's system backups had been online at the start of the intrusion and were eventually encrypted. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for the best, but in the end utilized Progent.

Progent worked with the client to quickly determine and prioritize the critical elements that had to be addressed in order to resume business operations:

• Active Directory
• Exchange Server
• Financials/MRP

In less than two days, Progent was able to recover Windows Active Directory to its pre-intrusion state. Progent then initiated setup and hard drive recovery of mission critical applications. All Exchange data and configuration information were intact, which facilitated the rebuild of Exchange. Progent was able to collect non-encrypted OST files (Outlook Email Off-Line Data Files) on various PCs in order to recover mail messages. A not too old offline backup of the businesses accounting systems made them able to restore these required programs back servicing users. Although significant work needed to be completed to recover fully from the Ryuk attack, critical services were restored quickly:

During the following couple of weeks important milestones in the recovery project were completed through close cooperation between Progent consultants and the customer:

• Internal web applications were restored with no loss of data.
• The MailStore Exchange Server exceeding 4 million historical messages was brought online and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/AR/Inventory Control functions were fully restored.
• A new Palo Alto Networks 850 firewall was installed and configured.
• 90% of the user desktops and notebooks were being used by staff.

Conclusion
A possible business extinction catastrophe was dodged by dedicated professionals, a broad spectrum of IT skills, and tight collaboration. Although in analyzing the event afterwards the ransomware incident described here would have been identified and disabled with current cyber security systems and ISO/IEC 27001 best practices, user and IT administrator training, and properly executed security procedures for information protection and applying software patches, the reality remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware attack, feel confident that Progent's team of experts has extensive experience in ransomware virus defense, mitigation, and data restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Greensboro
For ransomware system restoration consulting services in the Greensboro area, call Progent at 800-462-8800 or go to Contact Progent.