Ransomware Prevention and Removal Expertise Denver

Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become a modern cyberplague that poses an enterprise-level danger for businesses unprepared for an attack. Different versions of crypto-ransomware such as CryptoLocker, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for many years and continue to inflict damage. More recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, plus more as yet unnamed malware, not only encrypt on-line data files but also infect any accessible system protection mechanisms. Data replicated to off-premises disaster recovery sites can also be rendered useless. In a poorly designed system, it can render automatic restoration impossible and effectively knocks the network back to square one.

Getting back on-line services and data following a ransomware attack becomes a sprint against time as the targeted organization struggles to contain, eradicate the crypto-ransomware, and resume mission-critical activity. Due to the fact that crypto-ransomware takes time to spread across a targeted network, attacks are frequently sprung during weekends and nights, when successful attacks are likely to take more time to recognize. This multiplies the difficulty of quickly marshalling and orchestrating a knowledgeable mitigation team.

Progent offers a range of solutions for protecting Denver organizations from ransomware penetrations. These include user training to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat protection to discover and extinguish zero-day malware assaults. Progent in addition offers the services of experienced ransomware recovery consultants with the track record and perseverance to re-deploy a breached environment as rapidly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware invasion, sending the ransom in cryptocurrency does not guarantee that merciless criminals will respond with the needed codes to decipher any of your information. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The alternative is to re-install the vital components of your IT environment. Without the availability of essential data backups, this requires a wide complement of skills, top notch team management, and the capability to work continuously until the job is complete.

For twenty years, Progent has provided professional IT services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have been awarded high-level certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial management and ERP software solutions. This breadth of expertise provides Progent the ability to knowledgably determine important systems and organize the remaining components of your computer network system following a ransomware event and assemble them into a functioning network.

Progent's recovery team of experts uses powerful project management systems to coordinate the complicated restoration process. Progent understands the urgency of acting quickly and in unison with a customer's management and Information Technology staff to prioritize tasks and to get essential services back on-line as fast as humanly possible.

Business Case Study: A Successful Ransomware Penetration Recovery
A customer sought out Progent after their organization was penetrated by Ryuk ransomware virus. Ryuk is believed to have been developed by North Korean state criminal gangs, possibly adopting algorithms exposed from the United States NSA organization. Ryuk attacks specific businesses with little or no tolerance for disruption and is one of the most profitable incarnations of ransomware viruses. Major organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer located in the Chicago metro area and has about 500 employees. The Ryuk event had brought down all business operations and manufacturing capabilities. Most of the client's data protection had been on-line at the start of the attack and were destroyed. The client was pursuing financing for paying the ransom demand (in excess of $200K) and wishfully thinking for the best, but in the end utilized Progent.

Progent worked hand in hand the customer to rapidly understand and prioritize the essential services that needed to be recovered in order to resume company operations:

• Active Directory
• Exchange Server
• MRP System

Within two days, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then assisted with rebuilding and hard drive recovery on key applications. All Microsoft Exchange Server schema and configuration information were usable, which facilitated the restore of Exchange. Progent was able to collect local OST files (Microsoft Outlook Off-Line Data Files) on various PCs to recover email information. A not too old off-line backup of the customer's accounting software made them able to return these vital applications back available to users. Although a lot of work remained to recover totally from the Ryuk damage, essential systems were returned to operations rapidly:

Over the following month key milestones in the restoration process were completed through tight collaboration between Progent team members and the client:

• Internal web applications were brought back up without losing any data.
• The MailStore Server exceeding 4 million archived messages was brought online and available for users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory capabilities were completely recovered.
• A new Palo Alto Networks 850 firewall was installed.
• Most of the user workstations were back into operation.

Conclusion
A likely business extinction disaster was dodged by top-tier experts, a wide array of subject matter expertise, and tight collaboration. Although in retrospect the crypto-ransomware virus attack described here would have been prevented with up-to-date security technology solutions and ISO/IEC 27001 best practices, staff education, and appropriate incident response procedures for information backup and keeping systems up to date with security patches, the reality is that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware virus, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus defense, mitigation, and information systems recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Denver
For ransomware cleanup services in the Denver metro area, phone Progent at 800-462-8800 or go to Contact Progent.