Ransomware Filtering and Removal Solutions Parsippany

Ransomware : Your Feared IT Nightmare
Crypto-Ransomware has become a modern cyber pandemic that represents an existential threat for businesses of all sizes vulnerable to an assault. Multiple generations of ransomware such as CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for many years and still cause harm. Modern variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, along with more as yet unnamed malware, not only perform encryption of on-line data files but also infiltrate all available system backups. Data replicated to cloud environments can also be encrypted. In a vulnerable system, it can make automated restore operations useless and effectively knocks the network back to square one.

Restoring applications and information following a ransomware intrusion becomes a sprint against the clock as the targeted business tries its best to contain the damage, clear the crypto-ransomware, and restore enterprise-critical operations. Due to the fact that ransomware requires time to move laterally throughout a network, assaults are often sprung during nights and weekends, when attacks tend to take longer to uncover. This multiplies the difficulty of rapidly assembling and organizing a capable mitigation team.

Progent has a variety of services for protecting Parsippany organizations from ransomware events. These include team member training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to discover and quarantine zero-day modern malware assaults. Progent in addition offers the services of experienced ransomware recovery consultants with the track record and commitment to rebuild a breached system as urgently as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will return the keys to unencrypt any or all of your information. Kaspersky determined that 17% of crypto-ransomware victims never restored their files even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The other path is to re-install the key parts of your Information Technology environment. Without access to full information backups, this calls for a wide complement of IT skills, professional team management, and the willingness to work 24x7 until the job is completed.

For two decades, Progent has provided certified expert Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained advanced industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of expertise provides Progent the ability to quickly understand important systems and organize the surviving parts of your Information Technology environment following a crypto-ransomware attack and rebuild them into a functioning system.

Progent's recovery team utilizes powerful project management applications to coordinate the complex restoration process. Progent knows the importance of acting swiftly and in concert with a client's management and IT resources to prioritize tasks and to get key systems back online as soon as humanly possible.

Client Case Study: A Successful Ransomware Virus Response
A client hired Progent after their network system was attacked by Ryuk ransomware. Ryuk is believed to have been launched by North Korean state hackers, possibly adopting strategies exposed from the United States National Security Agency. Ryuk goes after specific organizations with limited ability to sustain operational disruption and is one of the most lucrative examples of ransomware. Major targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in Chicago and has about 500 workers. The Ryuk penetration had disabled all essential operations and manufacturing processes. The majority of the client's backups had been on-line at the start of the attack and were damaged. The client was evaluating paying the ransom demand (more than $200K) and praying for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the customer to rapidly assess and assign priority to the essential areas that had to be recovered to make it possible to continue business functions:

• Microsoft Active Directory
• Email
• MRP System

In less than 2 days, Progent was able to re-build Active Directory services to its pre-virus state. Progent then assisted with rebuilding and storage recovery of key servers. All Exchange schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was able to locate intact OST files (Outlook Email Off-Line Data Files) on staff PCs in order to recover email information. A recent offline backup of the client's accounting/MRP software made it possible to recover these required services back available to users. Although a large amount of work was left to recover fully from the Ryuk virus, core services were restored quickly:

During the next month important milestones in the restoration project were accomplished in close cooperation between Progent engineers and the client:

• Internal web applications were restored without losing any information.
• The MailStore Microsoft Exchange Server with over four million archived emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/AR/Inventory modules were fully recovered.
• A new Palo Alto Networks 850 security appliance was installed.
• 90% of the user desktops were being used by staff.

Conclusion
A possible business disaster was avoided due to dedicated experts, a broad range of technical expertise, and close teamwork. Although in post mortem the crypto-ransomware virus attack detailed here should have been prevented with current security systems and ISO/IEC 27001 best practices, user education, and well designed incident response procedures for data backup and proper patching controls, the reality is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has substantial experience in ransomware virus blocking, remediation, and data restoration.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Parsippany
For ransomware recovery services in the Parsippany metro area, call Progent at 800-462-8800 or visit Contact Progent.