Ransomware Protection and Removal Solutions Houston

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for organizations poorly prepared for an assault. Different versions of crypto-ransomware such as Dharma, Fusob, Locky, SamSam and MongoLock cryptoworms have been circulating for a long time and still cause havoc. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as additional as yet unnamed newcomers, not only encrypt online files but also infect many accessible system restores and backups. Information synched to off-premises disaster recovery sites can also be rendered useless. In a poorly designed system, it can make automated recovery impossible and basically sets the network back to zero.

Restoring applications and information after a crypto-ransomware attack becomes a race against the clock as the targeted business fights to stop lateral movement, clear the ransomware, and restore mission-critical operations. Because crypto-ransomware requires time to spread across a network, assaults are frequently sprung on weekends and holidays, when penetrations in many cases take more time to detect. This compounds the difficulty of promptly marshalling and orchestrating a knowledgeable mitigation team.

Progent provides an assortment of services for protecting Houston enterprises from crypto-ransomware events. Among these are team member education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat protection to detect and suppress zero-day malware assaults. Progent in addition offers the services of expert ransomware recovery consultants with the track record and commitment to reconstruct a breached system as soon as possible.

Progent's Crypto-Ransomware Recovery Services
Soon after a ransomware invasion, even paying the ransom in cryptocurrency does not ensure that merciless criminals will respond with the keys to decipher any of your data. Kaspersky determined that 17% of ransomware victims never recovered their information even after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to re-install the key parts of your IT environment. Absent access to essential system backups, this calls for a wide range of skills, professional team management, and the willingness to work 24x7 until the job is done.

For decades, Progent has made available certified expert IT services for businesses throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded top certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of expertise affords Progent the skills to knowledgably understand critical systems and organize the remaining components of your Information Technology environment following a crypto-ransomware event and assemble them into an operational network.

Progent's recovery group uses state-of-the-art project management tools to orchestrate the sophisticated restoration process. Progent knows the urgency of acting quickly and in concert with a customer's management and IT resources to prioritize tasks and to put key services back on-line as fast as humanly possible.

Case Study: A Successful Ransomware Intrusion Response
A customer contacted Progent after their network was penetrated by the Ryuk crypto-ransomware. Ryuk is believed to have been created by North Korean government sponsored cybercriminals, possibly adopting techniques leaked from the U.S. National Security Agency. Ryuk seeks specific companies with little room for operational disruption and is among the most profitable versions of ransomware. Headline targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturer based in the Chicago metro area with about 500 staff members. The Ryuk attack had frozen all essential operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the time of the intrusion and were damaged. The client considered paying the ransom demand (in excess of $200K) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked with the client to rapidly understand and prioritize the mission critical elements that had to be recovered in order to restart business operations:

• Windows Active Directory
• E-Mail
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to rebuild Active Directory to its pre-virus state. Progent then completed rebuilding and storage recovery of critical applications. All Exchange Server data and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to locate intact OST files (Microsoft Outlook Off-Line Data Files) on staff PCs in order to recover mail information. A recent offline backup of the businesses accounting software made it possible to return these vital applications back on-line. Although major work remained to recover fully from the Ryuk virus, the most important services were recovered rapidly:

Over the following month critical milestones in the recovery project were completed in tight cooperation between Progent consultants and the client:

• In-house web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server exceeding 4 million archived messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory functions were 100% recovered.
• A new Palo Alto 850 security appliance was brought online.
• Ninety percent of the desktops and laptops were fully operational.

Conclusion
A possible business extinction catastrophe was dodged through the efforts of results-oriented experts, a wide range of IT skills, and close collaboration. Although in hindsight the crypto-ransomware penetration detailed here would have been stopped with current cyber security technology solutions and NIST Cybersecurity Framework best practices, user and IT administrator training, and well designed incident response procedures for information backup and proper patching controls, the reality is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware incursion, remember that Progent's roster of experts has a proven track record in ransomware virus defense, remediation, and data recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Houston
For ransomware cleanup expertise in the Houston area, phone Progent at 800-462-8800 or see Contact Progent.