Ransomware Protection and Cleanup Solutions Nashville

Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become a modern cyber pandemic that presents an existential threat for organizations unprepared for an attack. Different iterations of crypto-ransomware such as Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been replicating for years and still inflict havoc. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as more unnamed newcomers, not only perform encryption of on-line data but also infect most configured system backup. Information synched to off-premises disaster recovery sites can also be ransomed. In a poorly designed environment, this can render any recovery useless and effectively sets the entire system back to zero.

Recovering programs and data after a crypto-ransomware event becomes a race against time as the victim tries its best to stop lateral movement, remove the crypto-ransomware, and resume business-critical operations. Due to the fact that ransomware requires time to move laterally throughout a targeted network, penetrations are usually launched on weekends, when successful penetrations in many cases take longer to notice. This multiplies the difficulty of quickly marshalling and orchestrating a qualified response team.

Progent provides a range of support services for protecting Nashville enterprises from crypto-ransomware attacks. Among these are team training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to discover and quarantine zero-day modern malware attacks. Progent also provides the services of seasoned ransomware recovery engineers with the talent and perseverance to reconstruct a compromised network as quickly as possible.

Progent's Ransomware Restoration Help
Following a ransomware attack, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will respond with the keys to decrypt any or all of your information. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to re-install the mission-critical components of your IT environment. Absent the availability of complete system backups, this requires a broad complement of skills, professional team management, and the capability to work 24x7 until the task is finished.

For two decades, Progent has made available expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have been awarded top certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of expertise gives Progent the ability to quickly determine important systems and consolidate the remaining parts of your Information Technology environment following a ransomware event and assemble them into a functioning network.

Progent's recovery team has top notch project management systems to coordinate the complicated restoration process. Progent understands the importance of acting swiftly and in concert with a customer's management and Information Technology resources to prioritize tasks and to get essential applications back on line as fast as humanly possible.

Customer Case Study: A Successful Ransomware Attack Restoration
A business sought out Progent after their organization was penetrated by the Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean state hackers, possibly using approaches exposed from America's National Security Agency. Ryuk seeks specific companies with little tolerance for operational disruption and is one of the most lucrative incarnations of crypto-ransomware. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in the Chicago metro area and has about 500 employees. The Ryuk penetration had shut down all essential operations and manufacturing processes. Most of the client's data protection had been directly accessible at the time of the attack and were destroyed. The client was taking steps for paying the ransom (in excess of $200K) and praying for good luck, but in the end engaged Progent.

Progent worked together with the customer to quickly understand and assign priority to the key applications that had to be addressed in order to restart company functions:

• Active Directory
• Microsoft Exchange
• Accounting/MRP

Within two days, Progent was able to restore Active Directory to its pre-virus state. Progent then helped perform setup and storage recovery of needed systems. All Exchange Server data and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to collect non-encrypted OST files (Microsoft Outlook Off-Line Data Files) on user PCs and laptops in order to recover email information. A recent off-line backup of the client's financials/ERP software made them able to return these essential applications back on-line. Although significant work needed to be completed to recover fully from the Ryuk attack, critical systems were returned to operations quickly:

During the following couple of weeks critical milestones in the restoration project were made in close collaboration between Progent team members and the client:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Server exceeding 4 million historical messages was restored to operations and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables/Inventory Control functions were completely recovered.
• A new Palo Alto 850 security appliance was installed and configured.
• Most of the desktop computers were fully operational.

Conclusion
A possible business-ending disaster was dodged with hard-working experts, a broad array of IT skills, and tight collaboration. Although upon completion of forensics the ransomware attack described here could have been identified and disabled with advanced cyber security technology and ISO/IEC 27001 best practices, staff education, and well thought out incident response procedures for information protection and keeping systems up to date with security patches, the fact is that state-sponsored hackers from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware virus, remember that Progent's roster of experts has extensive experience in ransomware virus blocking, remediation, and information systems recovery.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Nashville
For ransomware system recovery expertise in the Nashville metro area, call Progent at 800-462-8800 or go to Contact Progent.