Ransomware Filtering and Recovery Expertise Indianapolis

Ransomware : Your Feared IT Disaster
Ransomware has become an escalating cyberplague that presents an extinction-level threat for businesses of all sizes poorly prepared for an attack. Multiple generations of ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for years and still cause destruction. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as daily unnamed newcomers, not only encrypt on-line information but also infiltrate all accessible system protection mechanisms. Information synched to cloud environments can also be ransomed. In a poorly architected environment, it can render automated restore operations impossible and effectively sets the entire system back to square one.

Retrieving programs and data after a crypto-ransomware outage becomes a race against time as the victim fights to stop the spread, clear the ransomware, and resume enterprise-critical activity. Because ransomware takes time to move laterally throughout a targeted network, attacks are frequently launched during nights and weekends, when penetrations tend to take more time to uncover. This multiplies the difficulty of rapidly marshalling and coordinating a knowledgeable response team.

Progent provides a range of solutions for protecting Indianapolis businesses from crypto-ransomware events. These include user education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to discover and extinguish day-zero modern malware assaults. Progent also offers the services of expert ransomware recovery consultants with the talent and commitment to rebuild a compromised network as soon as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a crypto-ransomware event, sending the ransom demands in cryptocurrency does not guarantee that cyber hackers will provide the codes to decipher any or all of your files. Kaspersky ascertained that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The fallback is to piece back together the vital components of your IT environment. Without access to full information backups, this calls for a broad complement of IT skills, well-coordinated project management, and the capability to work continuously until the recovery project is completed.

For decades, Progent has offered certified expert IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have been awarded advanced industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have garnered internationally-recognized certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial systems and ERP applications. This breadth of expertise affords Progent the skills to quickly identify necessary systems and re-organize the remaining components of your Information Technology system following a crypto-ransomware event and configure them into an operational system.

Progent's security team has top notch project management applications to coordinate the sophisticated restoration process. Progent appreciates the urgency of working quickly and together with a client's management and IT team members to prioritize tasks and to get critical applications back on-line as fast as possible.

Customer Story: A Successful Crypto-Ransomware Attack Recovery
A small business hired Progent after their organization was taken over by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state hackers, suspected of adopting techniques exposed from the United States NSA organization. Ryuk goes after specific companies with little or no tolerance for disruption and is among the most lucrative examples of ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in the Chicago metro area and has around 500 employees. The Ryuk attack had frozen all company operations and manufacturing capabilities. The majority of the client's data protection had been online at the beginning of the attack and were damaged. The client was pursuing financing for paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but ultimately reached out to Progent.

Progent worked with the client to rapidly determine and assign priority to the most important elements that needed to be restored to make it possible to resume business operations:

• Active Directory
• Microsoft Exchange Server
• MRP System

Within 2 days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then performed setup and hard drive recovery on essential servers. All Microsoft Exchange Server schema and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to assemble intact OST files (Outlook Off-Line Folder Files) on user PCs and laptops in order to recover email information. A not too old offline backup of the customer's financials/ERP software made them able to restore these essential programs back online. Although significant work remained to recover completely from the Ryuk event, essential systems were recovered quickly:

Throughout the next couple of weeks critical milestones in the recovery project were achieved through tight cooperation between Progent consultants and the customer:

• In-house web applications were restored without losing any information.
• The MailStore Microsoft Exchange Server with over four million historical emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables/Inventory Control capabilities were completely restored.
• A new Palo Alto 850 firewall was deployed.
• Most of the user workstations were fully operational.

Conclusion
A possible company-ending catastrophe was avoided due to top-tier experts, a broad range of IT skills, and close collaboration. Although in post mortem the ransomware incident detailed here could have been blocked with advanced cyber security systems and recognized best practices, user training, and properly executed security procedures for data backup and keeping systems up to date with security patches, the fact is that government-sponsored cybercriminals from Russia, China and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware penetration, remember that Progent's roster of professionals has substantial experience in crypto-ransomware virus defense, cleanup, and information systems disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Indianapolis
For ransomware cleanup consulting services in the Indianapolis metro area, call Progent at 800-462-8800 or see Contact Progent.