Ransomware Prevention and Recovery Expertise Montreal

Ransomware : Your Feared Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyberplague that poses an existential threat for businesses vulnerable to an attack. Different versions of crypto-ransomware such as CrySIS, Fusob, Locky, Syskey and MongoLock cryptoworms have been circulating for many years and continue to cause harm. More recent strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as more as yet unnamed newcomers, not only encrypt online data but also infect most configured system backup. Files synched to cloud environments can also be corrupted. In a poorly designed environment, it can make automatic restore operations useless and effectively sets the datacenter back to zero.

Recovering applications and information after a crypto-ransomware attack becomes a race against time as the victim tries its best to stop lateral movement, clear the ransomware, and resume business-critical activity. Due to the fact that ransomware requires time to spread throughout a network, assaults are usually launched during weekends and nights, when successful attacks may take longer to detect. This multiplies the difficulty of promptly mobilizing and coordinating a knowledgeable mitigation team.

Progent has a range of support services for securing Montreal organizations from ransomware attacks. These include user training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to identify and quarantine zero-day modern malware attacks. Progent in addition can provide the assistance of experienced ransomware recovery engineers with the skills and perseverance to restore a breached environment as soon as possible.

Progent's Ransomware Restoration Help
Soon after a crypto-ransomware event, even paying the ransom in cryptocurrency does not ensure that cyber criminals will provide the codes to decipher all your information. Kaspersky estimated that 17% of ransomware victims never restored their files after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to piece back together the vital elements of your IT environment. Without the availability of full information backups, this calls for a broad range of skills, professional team management, and the willingness to work 24x7 until the recovery project is finished.

For decades, Progent has made available professional IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial systems and ERP applications. This breadth of expertise gives Progent the skills to efficiently determine necessary systems and consolidate the remaining components of your IT environment following a ransomware event and assemble them into an operational system.

Progent's recovery team of experts uses best of breed project management systems to coordinate the complex restoration process. Progent knows the importance of acting swiftly and in unison with a customer's management and Information Technology staff to assign priority to tasks and to put key services back on line as fast as possible.

Client Case Study: A Successful Ransomware Penetration Restoration
A client sought out Progent after their network system was brought down by the Ryuk ransomware virus. Ryuk is thought to have been created by North Korean state criminal gangs, suspected of adopting strategies leaked from the U.S. NSA organization. Ryuk seeks specific organizations with little ability to sustain operational disruption and is among the most lucrative versions of ransomware viruses. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company located in the Chicago metro area and has about 500 staff members. The Ryuk event had frozen all essential operations and manufacturing processes. Most of the client's data backups had been directly accessible at the start of the attack and were damaged. The client was pursuing financing for paying the ransom demand (in excess of $200K) and wishfully thinking for good luck, but ultimately engaged Progent.

Progent worked together with the client to rapidly understand and assign priority to the essential services that had to be addressed in order to resume business functions:

• Windows Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

Within two days, Progent was able to re-build Active Directory services to its pre-virus state. Progent then performed setup and storage recovery of essential systems. All Exchange data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to find non-encrypted OST files (Microsoft Outlook Off-Line Data Files) on various desktop computers to recover mail messages. A recent offline backup of the customer's accounting systems made it possible to recover these required services back online. Although major work needed to be completed to recover completely from the Ryuk attack, the most important services were returned to operations quickly:

During the next couple of weeks important milestones in the recovery project were made through close cooperation between Progent engineers and the customer:

• In-house web applications were brought back up with no loss of data.
• The MailStore Exchange Server with over four million historical messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control modules were 100% recovered.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Nearly all of the desktop computers were fully operational.

Conclusion
A possible enterprise-killing catastrophe was evaded through the efforts of top-tier experts, a wide range of knowledge, and tight teamwork. Although in hindsight the ransomware virus attack detailed here should have been identified and stopped with current security technology and ISO/IEC 27001 best practices, team training, and appropriate incident response procedures for backup and applying software patches, the reality remains that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's team of professionals has proven experience in ransomware virus blocking, remediation, and file disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Montreal
For ransomware cleanup consulting services in the Montreal area, phone Progent at 800-462-8800 or see Contact Progent.