Ransomware Prevention and Restoration Services Honolulu

Crypto-Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become an escalating cyber pandemic that presents an existential danger for businesses vulnerable to an attack. Multiple generations of ransomware like the Reveton, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been replicating for a long time and still cause harm. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as daily as yet unnamed malware, not only perform encryption of on-line data files but also infiltrate most configured system protection mechanisms. Files synchronized to the cloud can also be ransomed. In a poorly designed data protection solution, this can make automatic restore operations hopeless and effectively sets the datacenter back to zero.

Getting back online programs and information following a crypto-ransomware outage becomes a sprint against the clock as the victim tries its best to stop the spread, cleanup the virus, and resume enterprise-critical activity. Because ransomware takes time to spread across a targeted network, assaults are frequently sprung on weekends, when successful penetrations in many cases take more time to detect. This compounds the difficulty of rapidly marshalling and orchestrating a capable response team.

Progent provides a variety of solutions for securing Honolulu organizations from crypto-ransomware penetrations. Among these are team member education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to detect and suppress zero-day modern malware attacks. Progent in addition can provide the assistance of experienced crypto-ransomware recovery consultants with the track record and commitment to re-deploy a compromised network as urgently as possible.

Progent's Crypto-Ransomware Recovery Services
Subsequent to a ransomware attack, paying the ransom demands in cryptocurrency does not ensure that cyber hackers will respond with the needed keys to decipher all your files. Kaspersky determined that 17% of ransomware victims never recovered their files even after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to re-install the key parts of your Information Technology environment. Without access to full system backups, this requires a wide complement of skill sets, professional project management, and the ability to work continuously until the job is completed.

For twenty years, Progent has made available certified expert Information Technology services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have been awarded high-level certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial management and ERP application software. This breadth of expertise gives Progent the skills to knowledgably identify critical systems and re-organize the surviving components of your network environment after a ransomware event and rebuild them into a functioning system.

Progent's security team deploys state-of-the-art project management systems to coordinate the sophisticated restoration process. Progent appreciates the importance of working quickly and together with a customer's management and IT resources to prioritize tasks and to get key services back on-line as fast as humanly possible.

Business Case Study: A Successful Ransomware Penetration Response
A client escalated to Progent after their network was attacked by the Ryuk ransomware virus. Ryuk is generally considered to have been created by North Korean government sponsored cybercriminals, possibly adopting approaches exposed from the U.S. National Security Agency. Ryuk goes after specific organizations with limited room for operational disruption and is one of the most profitable incarnations of crypto-ransomware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturer located in Chicago with around 500 employees. The Ryuk attack had frozen all company operations and manufacturing capabilities. The majority of the client's data backups had been online at the beginning of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (more than $200,000) and wishfully thinking for the best, but in the end engaged Progent.

Progent worked together with the client to rapidly understand and prioritize the most important systems that needed to be addressed in order to restart business operations:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to restore Active Directory services to its pre-virus state. Progent then assisted with reinstallations and hard drive recovery of critical servers. All Exchange data and attributes were intact, which accelerated the restore of Exchange. Progent was also able to assemble local OST files (Outlook Offline Folder Files) on various desktop computers and laptops in order to recover email data. A not too old off-line backup of the client's accounting/ERP software made it possible to recover these essential services back online for users. Although significant work still had to be done to recover completely from the Ryuk event, essential services were returned to operations quickly:

During the next month important milestones in the recovery process were made through tight cooperation between Progent team members and the client:

• Self-hosted web sites were restored with no loss of information.
• The MailStore Exchange Server with over 4 million historical emails was brought online and accessible to users.
• CRM/Customer Orders/Invoices/AP/AR/Inventory functions were completely functional.
• A new Palo Alto 850 firewall was installed and configured.
• 90% of the user desktops and notebooks were back into operation.

Conclusion
A potential business-killing disaster was dodged with top-tier experts, a wide spectrum of subject matter expertise, and tight collaboration. Although upon completion of forensics the crypto-ransomware penetration detailed here should have been identified and stopped with current cyber security technology and security best practices, user education, and properly executed incident response procedures for backup and keeping systems up to date with security patches, the fact remains that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incident, remember that Progent's team of professionals has extensive experience in ransomware virus blocking, remediation, and information systems recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Honolulu
For ransomware cleanup expertise in the Honolulu area, call Progent at 800-462-8800 or visit Contact Progent.