Ransomware Protection and Removal Solutions Anchorage

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a modern cyber pandemic that poses an enterprise-level danger for organizations unprepared for an assault. Different versions of crypto-ransomware like the CryptoLocker, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been replicating for many years and continue to inflict havoc. Modern variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, plus frequent as yet unnamed malware, not only perform encryption of on-line data but also infiltrate most available system backup. Data synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly designed system, it can render any restoration impossible and effectively sets the entire system back to zero.

Getting back applications and information after a crypto-ransomware event becomes a race against the clock as the targeted business struggles to stop the spread, clear the ransomware, and restore enterprise-critical operations. Due to the fact that crypto-ransomware needs time to replicate throughout a network, penetrations are usually sprung on weekends, when attacks typically take longer to uncover. This multiplies the difficulty of promptly assembling and orchestrating a knowledgeable response team.

Progent provides an assortment of help services for securing Anchorage enterprises from crypto-ransomware events. These include team training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to discover and disable zero-day malware assaults. Progent in addition provides the assistance of seasoned crypto-ransomware recovery engineers with the track record and perseverance to re-deploy a compromised network as urgently as possible.

Progent's Ransomware Restoration Help
Soon after a crypto-ransomware invasion, even paying the ransom in cryptocurrency does not ensure that cyber hackers will respond with the keys to decipher any or all of your information. Kaspersky Labs determined that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to piece back together the key elements of your IT environment. Absent access to complete system backups, this requires a wide complement of skills, well-coordinated team management, and the capability to work continuously until the job is completed.

For twenty years, Progent has provided certified expert IT services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have earned top industry certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of expertise affords Progent the capability to quickly understand critical systems and re-organize the remaining components of your Information Technology environment following a ransomware event and assemble them into a functioning network.

Progent's recovery team uses powerful project management tools to coordinate the complicated recovery process. Progent knows the importance of acting rapidly and in concert with a client's management and Information Technology team members to prioritize tasks and to get critical systems back online as fast as possible.

Client Case Study: A Successful Ransomware Incident Response
A customer hired Progent after their organization was penetrated by Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean state hackers, possibly using approaches leaked from America's NSA organization. Ryuk attacks specific businesses with limited tolerance for operational disruption and is among the most lucrative instances of crypto-ransomware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business located in Chicago and has around 500 staff members. The Ryuk event had frozen all company operations and manufacturing processes. The majority of the client's information backups had been online at the beginning of the attack and were destroyed. The client was pursuing financing for paying the ransom demand (more than $200,000) and hoping for good luck, but ultimately called Progent.

Progent worked with the client to quickly identify and prioritize the critical areas that had to be addressed to make it possible to continue departmental operations:

• Microsoft Active Directory
• Electronic Mail
• Accounting/MRP

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-virus state. Progent then helped perform setup and storage recovery of key systems. All Exchange Server schema and configuration information were usable, which facilitated the restore of Exchange. Progent was able to assemble local OST data files (Microsoft Outlook Offline Folder Files) on staff PCs and laptops to recover email data. A recent off-line backup of the client's manufacturing systems made it possible to return these essential programs back servicing users. Although significant work needed to be completed to recover fully from the Ryuk event, core systems were recovered rapidly:

Throughout the following few weeks important milestones in the recovery process were accomplished through tight cooperation between Progent engineers and the client:

• Internal web sites were returned to operation with no loss of information.
• The MailStore Server containing more than 4 million historical messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory modules were 100 percent operational.
• A new Palo Alto 850 firewall was brought on-line.
• Ninety percent of the user desktops and notebooks were operational.

Conclusion
A probable enterprise-killing disaster was averted by hard-working professionals, a broad array of technical expertise, and close collaboration. Although in retrospect the ransomware incident detailed here should have been identified and disabled with modern cyber security systems and recognized best practices, staff training, and well thought out incident response procedures for backup and applying software patches, the fact remains that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of experts has a proven track record in crypto-ransomware virus defense, removal, and data recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Anchorage
For ransomware cleanup expertise in the Anchorage metro area, phone Progent at 800-462-8800 or visit Contact Progent.