Ransomware Protection and Cleanup Solutions Centennial

Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become an escalating cyber pandemic that presents an extinction-level danger for organizations unprepared for an assault. Versions of ransomware such as Reveton, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for many years and continue to cause havoc. Newer variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as additional as yet unnamed newcomers, not only encrypt on-line data files but also infect most accessible system protection mechanisms. Data replicated to cloud environments can also be ransomed. In a poorly architected environment, this can render any restore operations impossible and effectively knocks the network back to zero.

Recovering applications and information following a crypto-ransomware intrusion becomes a race against the clock as the targeted organization fights to stop the spread, cleanup the ransomware, and resume business-critical activity. Since ransomware takes time to replicate throughout a targeted network, attacks are frequently launched on weekends, when successful penetrations typically take longer to identify. This compounds the difficulty of quickly assembling and coordinating an experienced response team.

Progent offers a range of support services for securing Centennial enterprises from ransomware penetrations. Among these are team member education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat protection to identify and disable day-zero modern malware attacks. Progent in addition provides the assistance of experienced ransomware recovery professionals with the track record and commitment to restore a breached system as quickly as possible.

Progent's Ransomware Restoration Help
Subsequent to a crypto-ransomware attack, sending the ransom in cryptocurrency does not ensure that cyber hackers will provide the needed keys to decrypt all your files. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their files even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to piece back together the essential components of your Information Technology environment. Absent the availability of full information backups, this requires a broad complement of skill sets, well-coordinated team management, and the willingness to work non-stop until the recovery project is completed.

For decades, Progent has offered expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have attained top industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with accounting and ERP software solutions. This breadth of experience affords Progent the ability to knowledgably understand important systems and organize the remaining pieces of your Information Technology environment following a ransomware penetration and rebuild them into a functioning system.

Progent's ransomware team deploys top notch project management tools to orchestrate the complicated restoration process. Progent understands the importance of acting swiftly and in concert with a client's management and IT resources to prioritize tasks and to get the most important services back on-line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Virus Response
A client escalated to Progent after their network was taken over by Ryuk ransomware. Ryuk is thought to have been deployed by North Korean government sponsored hackers, suspected of adopting techniques exposed from America's NSA organization. Ryuk goes after specific organizations with limited room for operational disruption and is among the most profitable examples of ransomware viruses. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer located in the Chicago metro area and has around 500 employees. The Ryuk attack had paralyzed all essential operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the start of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately brought in Progent.

Progent worked hand in hand the customer to rapidly assess and prioritize the critical services that had to be recovered to make it possible to restart company operations:

• Active Directory
• Microsoft Exchange
• MRP System

In less than two days, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then assisted with setup and hard drive recovery of essential systems. All Exchange ties and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to assemble local OST data files (Outlook Off-Line Folder Files) on team PCs in order to recover mail messages. A not too old offline backup of the customer's financials/MRP systems made it possible to restore these vital applications back servicing users. Although a lot of work was left to recover fully from the Ryuk virus, the most important systems were restored quickly:

Throughout the next few weeks key milestones in the recovery process were made in close cooperation between Progent team members and the customer:

• Internal web sites were returned to operation with no loss of information.
• The MailStore Server with over four million archived emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were fully recovered.
• A new Palo Alto Networks 850 firewall was set up.
• 90% of the user desktops and notebooks were back into operation.

Conclusion
A likely business-ending disaster was averted through the efforts of results-oriented experts, a broad array of IT skills, and close teamwork. Although in post mortem the ransomware penetration detailed here could have been disabled with up-to-date cyber security systems and recognized best practices, team training, and well thought out security procedures for data protection and keeping systems up to date with security patches, the fact is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware attack, remember that Progent's roster of professionals has proven experience in crypto-ransomware virus blocking, mitigation, and file recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Centennial
For ransomware recovery consulting services in the Centennial metro area, call Progent at 800-462-8800 or see Contact Progent.