Ransomware Filtering and Remediation Consulting Milwaukee

Crypto-Ransomware : Your Feared IT Catastrophe
Ransomware has become a modern cyberplague that presents an enterprise-level threat for businesses poorly prepared for an assault. Different iterations of ransomware like the Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been running rampant for a long time and still cause harm. Modern strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, as well as daily unnamed viruses, not only perform encryption of online information but also infiltrate many accessible system backups. Information synched to cloud environments can also be ransomed. In a poorly designed system, it can render automated restore operations impossible and effectively sets the network back to zero.

Getting back on-line applications and information following a ransomware outage becomes a race against the clock as the targeted business struggles to stop the spread, eradicate the ransomware, and restore enterprise-critical activity. Because ransomware needs time to spread throughout a targeted network, attacks are usually sprung at night, when successful attacks tend to take more time to identify. This compounds the difficulty of quickly assembling and coordinating a knowledgeable mitigation team.

Progent has a range of support services for securing Milwaukee businesses from ransomware attacks. Among these are staff training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat defense to detect and quarantine zero-day malware assaults. Progent also provides the services of expert crypto-ransomware recovery professionals with the talent and perseverance to rebuild a compromised environment as rapidly as possible.

Progent's Ransomware Restoration Help
Following a ransomware penetration, paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will return the keys to decrypt any or all of your data. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their information after having paid the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to setup from scratch the vital parts of your Information Technology environment. Absent the availability of complete data backups, this calls for a broad range of skills, professional team management, and the willingness to work 24x7 until the recovery project is completed.

For twenty years, Progent has provided certified expert Information Technology services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have earned advanced certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience provides Progent the capability to efficiently understand important systems and organize the remaining parts of your network environment after a ransomware attack and rebuild them into a functioning system.

Progent's recovery team uses powerful project management systems to coordinate the sophisticated restoration process. Progent knows the importance of working swiftly and in unison with a client's management and Information Technology resources to prioritize tasks and to put essential services back on line as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Intrusion Recovery
A business engaged Progent after their company was penetrated by the Ryuk ransomware. Ryuk is thought to have been created by North Korean state sponsored hackers, possibly using algorithms exposed from America's National Security Agency. Ryuk goes after specific companies with little tolerance for operational disruption and is among the most profitable instances of ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in the Chicago metro area and has around 500 employees. The Ryuk event had disabled all business operations and manufacturing capabilities. Most of the client's backups had been directly accessible at the beginning of the intrusion and were eventually encrypted. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and hoping for the best, but ultimately called Progent.

Progent worked with the customer to quickly get our arms around and prioritize the critical applications that had to be addressed to make it possible to resume company operations:

• Microsoft Active Directory
• Exchange Server
• Accounting/MRP

In less than 2 days, Progent was able to restore Active Directory to its pre-attack state. Progent then assisted with setup and hard drive recovery of mission critical applications. All Microsoft Exchange Server schema and attributes were intact, which facilitated the restore of Exchange. Progent was able to locate intact OST files (Microsoft Outlook Off-Line Data Files) on staff PCs and laptops to recover email data. A not too old off-line backup of the customer's manufacturing software made them able to restore these essential applications back available to users. Although a large amount of work needed to be completed to recover completely from the Ryuk event, critical systems were returned to operations rapidly:

Throughout the following couple of weeks key milestones in the restoration process were made in tight cooperation between Progent engineers and the client:

• Internal web applications were returned to operation with no loss of information.
• The MailStore Exchange Server exceeding four million archived messages was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory capabilities were fully recovered.
• A new Palo Alto Networks 850 security appliance was brought online.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A potential business-ending catastrophe was avoided by results-oriented professionals, a wide range of IT skills, and tight teamwork. Although in post mortem the ransomware virus incident described here would have been disabled with up-to-date cyber security technology solutions and NIST Cybersecurity Framework best practices, user and IT administrator training, and well designed incident response procedures for data backup and proper patching controls, the reality is that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware penetration, feel confident that Progent's team of professionals has proven experience in ransomware virus defense, cleanup, and data recovery.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Milwaukee
For ransomware recovery services in the Milwaukee area, call Progent at 800-462-8800 or go to Contact Progent.