Ransomware Filtering and Removal Services Miami

Ransomware : Your Feared IT Nightmare
Ransomware has become a modern cyberplague that represents an existential threat for businesses of all sizes unprepared for an attack. Versions of crypto-ransomware like the Reveton, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and continue to inflict destruction. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus frequent unnamed malware, not only encrypt online data but also infect most configured system backup. Data synched to the cloud can also be encrypted. In a poorly designed data protection solution, this can render automated restore operations useless and basically knocks the entire system back to square one.

Restoring services and information following a crypto-ransomware intrusion becomes a race against time as the victim tries its best to contain the damage, clear the crypto-ransomware, and restore business-critical operations. Since crypto-ransomware needs time to replicate throughout a network, penetrations are often sprung at night, when successful penetrations may take more time to identify. This compounds the difficulty of promptly marshalling and coordinating a knowledgeable response team.

Progent has a variety of support services for securing Miami organizations from ransomware events. Among these are team training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to identify and extinguish day-zero malware attacks. Progent in addition offers the assistance of seasoned ransomware recovery consultants with the skills and perseverance to rebuild a breached system as quickly as possible.

Progent's Ransomware Recovery Support Services
Following a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that cyber hackers will respond with the needed keys to decrypt any or all of your data. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to re-install the key components of your Information Technology environment. Absent the availability of essential information backups, this requires a broad complement of skills, top notch project management, and the willingness to work continuously until the task is finished.

For two decades, Progent has offered professional Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded high-level certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of expertise affords Progent the skills to knowledgably identify critical systems and integrate the remaining components of your IT system after a crypto-ransomware event and configure them into a functioning system.

Progent's ransomware team deploys powerful project management tools to orchestrate the complex recovery process. Progent appreciates the importance of working swiftly and together with a customer's management and Information Technology team members to prioritize tasks and to put key systems back on line as fast as humanly possible.

Client Story: A Successful Ransomware Virus Response
A client contacted Progent after their network was penetrated by the Ryuk ransomware virus. Ryuk is thought to have been launched by North Korean government sponsored criminal gangs, possibly using strategies exposed from the U.S. NSA organization. Ryuk seeks specific companies with little tolerance for operational disruption and is among the most lucrative iterations of crypto-ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing business located in Chicago and has around 500 workers. The Ryuk intrusion had shut down all company operations and manufacturing processes. Most of the client's information backups had been on-line at the beginning of the attack and were encrypted. The client was taking steps for paying the ransom demand (more than $200,000) and hoping for the best, but ultimately reached out to Progent.

Progent worked hand in hand the customer to quickly determine and assign priority to the most important systems that needed to be restored in order to resume business operations:

• Microsoft Active Directory
• Microsoft Exchange
• MRP System

In less than two days, Progent was able to re-build Active Directory services to its pre-attack state. Progent then performed setup and storage recovery of needed systems. All Microsoft Exchange Server schema and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to collect non-encrypted OST files (Outlook Offline Data Files) on user PCs in order to recover mail information. A recent off-line backup of the client's financials/ERP systems made them able to restore these vital applications back on-line. Although major work was left to recover completely from the Ryuk event, critical systems were returned to operations quickly:

Over the next month key milestones in the recovery process were achieved through close collaboration between Progent consultants and the customer:

• Internal web sites were brought back up with no loss of data.
• The MailStore Exchange Server containing more than 4 million historical emails was spun up and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were completely restored.
• A new Palo Alto Networks 850 firewall was brought on-line.
• 90% of the desktop computers were operational.

Conclusion
A possible enterprise-killing catastrophe was evaded due to results-oriented professionals, a wide array of IT skills, and tight teamwork. Although in post mortem the ransomware virus penetration described here would have been identified and blocked with up-to-date security solutions and ISO/IEC 27001 best practices, user training, and properly executed incident response procedures for information protection and keeping systems up to date with security patches, the fact remains that government-sponsored cyber criminals from China, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware incursion, remember that Progent's team of professionals has substantial experience in crypto-ransomware virus defense, remediation, and file restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Miami
For ransomware system recovery consulting services in the Miami area, phone Progent at 800-462-8800 or go to Contact Progent.