Ransomware Defense and Remediation Solutions Alpharetta

Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become an escalating cyberplague that represents an enterprise-level danger for businesses unprepared for an attack. Versions of ransomware such as Dharma, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been running rampant for a long time and continue to inflict damage. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, along with daily unnamed viruses, not only perform encryption of online critical data but also infect all available system protection. Information replicated to cloud environments can also be ransomed. In a vulnerable environment, this can make automatic restore operations useless and basically sets the datacenter back to zero.

Getting back programs and information after a ransomware event becomes a race against the clock as the targeted business tries its best to contain, remove the ransomware, and resume business-critical operations. Due to the fact that crypto-ransomware requires time to replicate across a targeted network, penetrations are often launched on weekends and holidays, when penetrations may take more time to identify. This compounds the difficulty of quickly mobilizing and orchestrating a knowledgeable response team.

Progent offers an assortment of support services for protecting Alpharetta organizations from ransomware penetrations. These include team member education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to discover and quarantine day-zero malware assaults. Progent in addition provides the assistance of seasoned ransomware recovery consultants with the skills and perseverance to restore a compromised network as rapidly as possible.

Progent's Crypto-Ransomware Recovery Help
After a ransomware event, sending the ransom in cryptocurrency does not provide any assurance that cyber hackers will return the needed keys to unencrypt all your files. Kaspersky determined that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to piece back together the essential parts of your IT environment. Absent the availability of complete data backups, this requires a wide range of skills, well-coordinated team management, and the willingness to work 24x7 until the task is done.

For twenty years, Progent has made available certified expert Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded advanced certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of expertise gives Progent the ability to rapidly identify critical systems and integrate the surviving pieces of your network system after a ransomware penetration and assemble them into an operational system.

Progent's security team utilizes best of breed project management tools to orchestrate the complex restoration process. Progent knows the importance of working swiftly and in unison with a customer's management and IT staff to prioritize tasks and to put the most important services back online as fast as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Attack Response
A small business escalated to Progent after their company was penetrated by the Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored criminal gangs, suspected of using approaches leaked from the U.S. NSA organization. Ryuk seeks specific businesses with little or no room for operational disruption and is one of the most lucrative incarnations of ransomware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in the Chicago metro area and has around 500 staff members. The Ryuk event had shut down all essential operations and manufacturing capabilities. Most of the client's information backups had been directly accessible at the start of the intrusion and were eventually encrypted. The client was evaluating paying the ransom (exceeding $200,000) and praying for the best, but in the end called Progent.

Progent worked with the client to rapidly determine and prioritize the critical systems that had to be addressed in order to continue departmental functions:

• Windows Active Directory
• Email
• Accounting and Manufacturing Software

In less than two days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then performed setup and storage recovery of mission critical applications. All Exchange data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to assemble intact OST data files (Outlook Off-Line Folder Files) on staff desktop computers and laptops in order to recover email information. A recent offline backup of the client's manufacturing software made it possible to return these vital services back online. Although major work needed to be completed to recover completely from the Ryuk attack, critical services were restored rapidly:

Throughout the next month key milestones in the restoration project were achieved in tight cooperation between Progent engineers and the client:

• Self-hosted web applications were restored with no loss of information.
• The MailStore Server with over 4 million archived emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory modules were 100% restored.
• A new Palo Alto 850 security appliance was brought on-line.
• Ninety percent of the user workstations were functioning as before the incident.

Conclusion
A likely business catastrophe was dodged due to hard-working experts, a broad range of technical expertise, and close teamwork. Although in post mortem the crypto-ransomware incident detailed here would have been shut down with up-to-date security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and well thought out security procedures for backup and applying software patches, the reality remains that state-sponsored cybercriminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware incident, feel confident that Progent's roster of professionals has proven experience in ransomware virus defense, cleanup, and data recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Alpharetta
For ransomware recovery services in the Alpharetta area, phone Progent at 800-462-8800 or go to Contact Progent.