Ransomware Protection and Remediation Expertise Melbourne

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyber pandemic that presents an extinction-level danger for businesses poorly prepared for an attack. Different versions of ransomware like the CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been around for years and still inflict destruction. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with more as yet unnamed newcomers, not only encrypt on-line information but also infect many available system backup. Data replicated to off-premises disaster recovery sites can also be ransomed. In a poorly architected data protection solution, it can make automated recovery hopeless and basically sets the datacenter back to zero.

Restoring services and data after a ransomware attack becomes a race against time as the targeted business struggles to contain the damage, clear the ransomware, and restore mission-critical operations. Because ransomware requires time to spread across a network, attacks are usually sprung on weekends, when penetrations may take longer to discover. This multiplies the difficulty of rapidly marshalling and coordinating a knowledgeable response team.

Progent has an assortment of solutions for protecting Melbourne organizations from ransomware attacks. Among these are user training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat protection to identify and quarantine day-zero modern malware assaults. Progent in addition can provide the services of veteran ransomware recovery professionals with the talent and perseverance to restore a breached network as quickly as possible.

Progent's Ransomware Restoration Help
Following a ransomware penetration, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the codes to decipher all your information. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to re-install the key parts of your Information Technology environment. Absent access to complete system backups, this requires a broad complement of skill sets, top notch team management, and the capability to work 24x7 until the job is completed.

For two decades, Progent has offered expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of experience gives Progent the capability to efficiently determine necessary systems and consolidate the surviving components of your computer network environment after a ransomware attack and configure them into an operational network.

Progent's recovery team uses state-of-the-art project management tools to orchestrate the sophisticated recovery process. Progent knows the importance of working rapidly and in unison with a customer's management and Information Technology resources to assign priority to tasks and to get key applications back on-line as fast as possible.

Business Case Study: A Successful Ransomware Penetration Restoration
A small business sought out Progent after their company was attacked by the Ryuk crypto-ransomware. Ryuk is believed to have been launched by North Korean government sponsored cybercriminals, suspected of adopting strategies leaked from the U.S. NSA organization. Ryuk attacks specific companies with little or no ability to sustain disruption and is one of the most profitable versions of ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in the Chicago metro area and has about 500 staff members. The Ryuk attack had paralyzed all company operations and manufacturing capabilities. Most of the client's system backups had been online at the time of the attack and were damaged. The client was evaluating paying the ransom (in excess of two hundred thousand dollars) and praying for the best, but ultimately engaged Progent.

Progent worked hand in hand the customer to rapidly assess and prioritize the mission critical elements that needed to be addressed to make it possible to resume departmental functions:

• Active Directory
• E-Mail
• MRP System

Within two days, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then completed reinstallations and hard drive recovery on critical applications. All Microsoft Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to find non-encrypted OST data files (Outlook Offline Folder Files) on various workstations and laptops to recover email information. A recent off-line backup of the businesses accounting/ERP systems made it possible to return these essential services back available to users. Although major work was left to recover completely from the Ryuk virus, critical systems were restored rapidly:

Over the following couple of weeks important milestones in the recovery process were achieved through tight collaboration between Progent consultants and the client:

• Self-hosted web applications were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server exceeding four million historical emails was restored to operations and available for users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control capabilities were fully restored.
• A new Palo Alto 850 security appliance was brought online.
• Nearly all of the desktops and laptops were operational.

Conclusion
A potential company-ending catastrophe was averted with results-oriented professionals, a wide array of subject matter expertise, and tight collaboration. Although in post mortem the ransomware virus attack described here would have been blocked with up-to-date cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and well thought out incident response procedures for information protection and proper patching controls, the fact remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's team of professionals has substantial experience in ransomware virus blocking, remediation, and information systems restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Melbourne
For ransomware system restoration consulting in the Melbourne metro area, phone Progent at 800-462-8800 or see Contact Progent.