Ransomware Defense and Cleanup Solutions Mexico City

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyber pandemic that presents an extinction-level threat for businesses of all sizes unprepared for an assault. Different iterations of crypto-ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for a long time and continue to cause harm. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with frequent as yet unnamed malware, not only encrypt on-line data but also infect any configured system backups. Data synched to off-premises disaster recovery sites can also be ransomed. In a poorly designed system, it can render automatic restore operations impossible and basically knocks the network back to zero.

Recovering applications and data following a crypto-ransomware event becomes a race against time as the victim tries its best to contain, clear the ransomware, and resume enterprise-critical activity. Because crypto-ransomware requires time to replicate across a network, penetrations are frequently launched at night, when successful attacks typically take longer to discover. This compounds the difficulty of quickly marshalling and coordinating a knowledgeable mitigation team.

Progent makes available a variety of solutions for securing Mexico City businesses from ransomware penetrations. These include team education to help identify and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat protection to detect and quarantine zero-day modern malware assaults. Progent in addition can provide the assistance of seasoned crypto-ransomware recovery consultants with the talent and perseverance to restore a compromised environment as rapidly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will respond with the needed codes to decipher any of your data. Kaspersky ascertained that 17% of ransomware victims never restored their data even after having paid the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The fallback is to piece back together the mission-critical elements of your Information Technology environment. Absent access to full system backups, this calls for a wide complement of skill sets, top notch team management, and the ability to work 24x7 until the task is done.

For decades, Progent has made available expert IT services for companies throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have been awarded advanced certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP software solutions. This breadth of expertise affords Progent the ability to knowledgably identify necessary systems and re-organize the remaining components of your IT system after a crypto-ransomware event and rebuild them into an operational system.

Progent's security team deploys best of breed project management systems to coordinate the complicated restoration process. Progent knows the urgency of working rapidly and in concert with a customer's management and IT resources to assign priority to tasks and to get key applications back online as soon as possible.

Customer Story: A Successful Ransomware Incident Restoration
A customer hired Progent after their organization was taken over by Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored cybercriminals, possibly using approaches leaked from the U.S. National Security Agency. Ryuk goes after specific businesses with little room for operational disruption and is among the most lucrative iterations of ransomware viruses. Headline targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturer based in Chicago and has about 500 staff members. The Ryuk attack had disabled all business operations and manufacturing processes. Most of the client's system backups had been directly accessible at the start of the intrusion and were damaged. The client considered paying the ransom demand (exceeding $200,000) and wishfully thinking for the best, but in the end made the decision to use Progent.

Progent worked hand in hand the client to rapidly understand and prioritize the key applications that needed to be addressed to make it possible to restart business operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting/MRP

Within 48 hours, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then initiated reinstallations and storage recovery of needed systems. All Exchange Server schema and attributes were usable, which greatly helped the restore of Exchange. Progent was able to assemble intact OST data files (Outlook Off-Line Folder Files) on various desktop computers and laptops to recover email information. A recent offline backup of the businesses accounting/ERP systems made it possible to recover these vital applications back online for users. Although a lot of work still had to be done to recover completely from the Ryuk event, critical services were recovered quickly:

Throughout the next few weeks important milestones in the recovery project were achieved through close collaboration between Progent engineers and the customer:

• In-house web sites were brought back up without losing any data.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was brought on-line and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory capabilities were fully functional.
• A new Palo Alto Networks 850 firewall was installed and configured.
• 90% of the user PCs were fully operational.

Conclusion
A possible company-ending catastrophe was averted with dedicated experts, a broad spectrum of subject matter expertise, and tight teamwork. Although in hindsight the crypto-ransomware attack described here could have been blocked with modern security technology solutions and ISO/IEC 27001 best practices, user and IT administrator training, and properly executed security procedures for data backup and keeping systems up to date with security patches, the reality remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's roster of experts has proven experience in crypto-ransomware virus blocking, cleanup, and data restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Mexico City
For ransomware cleanup services in the Mexico City metro area, call Progent at 800-462-8800 or visit Contact Progent.