Ransomware Protection and Remediation Services Alpharetta

Ransomware : Your Feared Information Technology Catastrophe
Crypto-Ransomware has become a modern cyberplague that poses an extinction-level danger for businesses vulnerable to an attack. Different versions of ransomware like the Dharma, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for a long time and still inflict damage. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, as well as additional unnamed viruses, not only encrypt on-line data but also infect any available system protection. Files synchronized to off-premises disaster recovery sites can also be ransomed. In a poorly architected system, this can render automated restore operations useless and basically sets the datacenter back to square one.

Restoring programs and data following a ransomware outage becomes a race against time as the targeted business struggles to contain, clear the virus, and restore mission-critical operations. Since crypto-ransomware requires time to replicate throughout a network, attacks are usually sprung during nights and weekends, when successful penetrations tend to take longer to detect. This multiplies the difficulty of rapidly mobilizing and coordinating a qualified mitigation team.

Progent provides an assortment of help services for securing Alpharetta businesses from ransomware penetrations. Among these are team member education to help identify and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat protection to discover and disable zero-day malware assaults. Progent in addition offers the services of expert ransomware recovery professionals with the talent and commitment to re-deploy a breached environment as quickly as possible.

Progent's Ransomware Recovery Support Services
Following a ransomware event, paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will return the keys to decrypt all your files. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their data after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The fallback is to setup from scratch the mission-critical components of your IT environment. Without access to full data backups, this calls for a broad complement of skill sets, well-coordinated team management, and the willingness to work non-stop until the recovery project is over.

For twenty years, Progent has made available expert IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of expertise gives Progent the capability to rapidly understand necessary systems and organize the remaining components of your network environment following a crypto-ransomware event and rebuild them into an operational system.

Progent's ransomware team uses top notch project management applications to coordinate the complex recovery process. Progent knows the importance of acting swiftly and in unison with a customer's management and IT staff to assign priority to tasks and to put key systems back online as fast as possible.

Case Study: A Successful Ransomware Penetration Recovery
A customer engaged Progent after their organization was taken over by the Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean government sponsored cybercriminals, suspected of using technology leaked from the United States National Security Agency. Ryuk attacks specific companies with little ability to sustain disruption and is one of the most profitable iterations of crypto-ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company located in the Chicago metro area and has around 500 workers. The Ryuk attack had shut down all business operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the time of the intrusion and were eventually encrypted. The client considered paying the ransom (in excess of two hundred thousand dollars) and hoping for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the client to rapidly identify and assign priority to the critical services that needed to be addressed to make it possible to continue departmental operations:

• Active Directory
• Email
• MRP System

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then completed reinstallations and hard drive recovery on key applications. All Exchange Server data and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to locate local OST data files (Microsoft Outlook Off-Line Folder Files) on team desktop computers to recover email data. A not too old off-line backup of the client's financials/ERP software made them able to recover these essential programs back online for users. Although a lot of work remained to recover completely from the Ryuk attack, the most important systems were recovered quickly:

Over the following month critical milestones in the recovery process were accomplished through close cooperation between Progent consultants and the client:

• Internal web applications were restored without losing any data.
• The MailStore Server with over four million historical messages was spun up and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control modules were completely recovered.
• A new Palo Alto Networks 850 security appliance was set up.
• 90% of the user desktops were functioning as before the incident.

Conclusion
A probable business-ending disaster was dodged with top-tier professionals, a broad array of IT skills, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration described here could have been identified and disabled with current security solutions and ISO/IEC 27001 best practices, staff education, and appropriate incident response procedures for data backup and keeping systems up to date with security patches, the reality is that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware penetration, feel confident that Progent's team of experts has extensive experience in ransomware virus defense, remediation, and file recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Alpharetta
For ransomware cleanup services in the Alpharetta metro area, call Progent at 800-462-8800 or go to Contact Progent.