Ransomware Filtering and Restoration Services Detroit

Crypto-Ransomware : Your Feared IT Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that presents an enterprise-level danger for organizations vulnerable to an assault. Different iterations of ransomware such as Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been around for many years and still cause damage. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with additional as yet unnamed newcomers, not only encrypt online data files but also infect all accessible system backups. Files synchronized to off-premises disaster recovery sites can also be ransomed. In a poorly designed data protection solution, this can render automated restore operations impossible and basically knocks the entire system back to square one.

Recovering applications and information after a crypto-ransomware event becomes a race against the clock as the targeted organization struggles to stop the spread, cleanup the ransomware, and restore business-critical operations. Due to the fact that ransomware needs time to replicate across a network, assaults are usually sprung at night, when attacks typically take longer to uncover. This multiplies the difficulty of quickly marshalling and organizing an experienced response team.

Progent offers a range of support services for protecting Detroit businesses from crypto-ransomware events. Among these are team training to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat defense to detect and disable day-zero malware assaults. Progent also can provide the services of expert ransomware recovery professionals with the track record and perseverance to rebuild a breached system as rapidly as possible.

Progent's Crypto-Ransomware Recovery Help
After a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will return the keys to unencrypt any of your data. Kaspersky ascertained that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to piece back together the critical components of your Information Technology environment. Without the availability of complete information backups, this requires a broad complement of IT skills, well-coordinated team management, and the capability to work 24x7 until the recovery project is over.

For twenty years, Progent has offered certified expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial management and ERP application software. This breadth of expertise provides Progent the capability to rapidly determine necessary systems and integrate the remaining pieces of your computer network system following a ransomware attack and assemble them into a functioning network.

Progent's recovery team of experts has powerful project management systems to coordinate the complex recovery process. Progent knows the urgency of acting swiftly and in unison with a client's management and IT staff to assign priority to tasks and to get critical services back online as soon as humanly possible.

Client Story: A Successful Crypto-Ransomware Virus Response
A business sought out Progent after their network was brought down by Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean state sponsored cybercriminals, possibly using techniques leaked from the U.S. NSA organization. Ryuk targets specific businesses with limited ability to sustain operational disruption and is among the most profitable instances of ransomware malware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business headquartered in the Chicago metro area with around 500 employees. The Ryuk event had paralyzed all business operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the start of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and hoping for good luck, but ultimately reached out to Progent.

Progent worked together with the customer to rapidly get our arms around and assign priority to the key applications that needed to be addressed in order to restart company functions:

• Active Directory
• E-Mail
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then assisted with rebuilding and hard drive recovery of the most important applications. All Exchange data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to find local OST data files (Outlook Email Off-Line Data Files) on various workstations and laptops in order to recover mail information. A recent offline backup of the businesses accounting/MRP software made them able to restore these essential services back online. Although major work remained to recover totally from the Ryuk virus, essential systems were recovered quickly:

Throughout the next couple of weeks critical milestones in the recovery process were achieved in close cooperation between Progent team members and the customer:

• In-house web applications were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server with over four million archived emails was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory functions were 100% operational.
• A new Palo Alto 850 security appliance was set up and programmed.
• Most of the user desktops were fully operational.

Conclusion
A potential company-ending disaster was avoided due to dedicated professionals, a broad array of subject matter expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware virus attack detailed here would have been disabled with advanced cyber security systems and security best practices, user and IT administrator education, and well designed security procedures for data protection and keeping systems up to date with security patches, the reality remains that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's team of professionals has proven experience in ransomware virus blocking, mitigation, and information systems restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Detroit
For ransomware system restoration consulting in the Detroit metro area, phone Progent at 800-462-8800 or see Contact Progent.