Ransomware Defense and Removal Expertise Londrina

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level threat for organizations poorly prepared for an assault. Multiple generations of crypto-ransomware such as Dharma, Fusob, Locky, Syskey and MongoLock cryptoworms have been circulating for many years and continue to inflict harm. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, as well as daily unnamed newcomers, not only encrypt on-line information but also infect most configured system backup. Information replicated to off-premises disaster recovery sites can also be ransomed. In a poorly architected system, this can make automatic restoration useless and effectively knocks the entire system back to square one.

Getting back programs and information following a ransomware outage becomes a sprint against the clock as the victim fights to stop lateral movement, cleanup the ransomware, and resume mission-critical operations. Because crypto-ransomware takes time to spread across a network, attacks are usually sprung during nights and weekends, when penetrations in many cases take more time to detect. This multiplies the difficulty of rapidly assembling and organizing an experienced mitigation team.

Progent offers an assortment of services for protecting Londrina businesses from ransomware events. These include team member education to help identify and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based cyberthreat defense to detect and extinguish day-zero malware assaults. Progent in addition offers the assistance of seasoned crypto-ransomware recovery consultants with the track record and perseverance to re-deploy a breached system as urgently as possible.

Progent's Ransomware Restoration Help
Soon after a ransomware attack, sending the ransom demands in cryptocurrency does not provide any assurance that distant criminals will provide the needed keys to unencrypt any of your information. Kaspersky determined that 17% of ransomware victims never restored their files even after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to setup from scratch the vital parts of your Information Technology environment. Without access to full data backups, this requires a broad complement of IT skills, well-coordinated team management, and the capability to work continuously until the job is completed.

For twenty years, Progent has made available professional Information Technology services for businesses across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained high-level certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial systems and ERP applications. This breadth of expertise provides Progent the ability to quickly understand necessary systems and re-organize the surviving pieces of your IT environment following a ransomware attack and assemble them into a functioning system.

Progent's recovery team of experts utilizes powerful project management applications to coordinate the complex recovery process. Progent knows the urgency of working swiftly and in concert with a client's management and IT team members to prioritize tasks and to get key systems back on-line as soon as possible.

Customer Story: A Successful Ransomware Penetration Response
A business sought out Progent after their network system was attacked by the Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean state sponsored cybercriminals, possibly using approaches exposed from the U.S. National Security Agency. Ryuk targets specific organizations with little room for operational disruption and is among the most profitable examples of ransomware malware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer based in Chicago with about 500 workers. The Ryuk penetration had disabled all business operations and manufacturing capabilities. The majority of the client's backups had been on-line at the beginning of the intrusion and were damaged. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and hoping for good luck, but in the end made the decision to use Progent.

Progent worked with the client to quickly assess and assign priority to the mission critical elements that had to be addressed in order to resume departmental operations:

• Active Directory
• Microsoft Exchange
• Accounting/MRP

In less than 48 hours, Progent was able to recover Active Directory services to its pre-penetration state. Progent then charged ahead with setup and storage recovery on the most important applications. All Exchange ties and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to find local OST data files (Outlook Email Offline Folder Files) on various PCs and laptops to recover mail information. A not too old off-line backup of the client's accounting/ERP software made it possible to recover these essential applications back on-line. Although major work was left to recover completely from the Ryuk virus, core systems were recovered quickly:

During the next month key milestones in the recovery process were completed through close cooperation between Progent consultants and the client:

• Self-hosted web sites were returned to operation without losing any data.
• The MailStore Server with over 4 million archived messages was spun up and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/AR/Inventory functions were completely recovered.
• A new Palo Alto Networks 850 firewall was installed.
• Nearly all of the desktops and laptops were functioning as before the incident.

Conclusion
A likely company-ending catastrophe was averted due to top-tier experts, a wide spectrum of technical expertise, and close collaboration. Although in hindsight the ransomware penetration detailed here could have been identified and prevented with modern security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and well designed security procedures for data backup and proper patching controls, the reality is that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's roster of experts has extensive experience in ransomware virus blocking, cleanup, and file restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Londrina
For ransomware system restoration consulting in the Londrina metro area, phone Progent at 800-462-8800 or visit Contact Progent.