Ransomware Filtering and Removal Solutions Leeds

Ransomware : Your Crippling IT Nightmare
Ransomware has become an escalating cyberplague that represents an existential danger for businesses poorly prepared for an assault. Multiple generations of ransomware like the Reveton, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for many years and still inflict damage. More recent variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, along with daily as yet unnamed viruses, not only perform encryption of on-line critical data but also infiltrate any available system protection. Information synchronized to the cloud can also be ransomed. In a poorly designed environment, it can render automated recovery useless and effectively sets the datacenter back to zero.

Getting back programs and data following a crypto-ransomware attack becomes a sprint against time as the victim struggles to stop the spread, eradicate the ransomware, and resume business-critical operations. Due to the fact that ransomware requires time to move laterally across a targeted network, attacks are often sprung during nights and weekends, when successful attacks are likely to take more time to notice. This compounds the difficulty of promptly mobilizing and organizing a capable response team.

Progent provides a range of solutions for securing Leeds businesses from ransomware penetrations. These include team training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to identify and quarantine zero-day modern malware assaults. Progent in addition offers the services of expert crypto-ransomware recovery consultants with the track record and perseverance to reconstruct a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Restoration Services
After a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will return the needed keys to unencrypt all your information. Kaspersky Labs estimated that 17% of ransomware victims never restored their information after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to re-install the critical elements of your Information Technology environment. Absent access to complete data backups, this requires a wide complement of skills, professional project management, and the ability to work continuously until the job is complete.

For twenty years, Progent has offered certified expert IT services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have been awarded advanced industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have earned internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial management and ERP software solutions. This breadth of expertise gives Progent the skills to knowledgably identify critical systems and consolidate the surviving pieces of your computer network environment following a ransomware event and configure them into an operational network.

Progent's security group uses powerful project management tools to coordinate the sophisticated recovery process. Progent appreciates the urgency of working swiftly and in unison with a client's management and IT team members to prioritize tasks and to put the most important applications back on line as fast as humanly possible.

Customer Case Study: A Successful Ransomware Penetration Recovery
A business hired Progent after their network system was attacked by Ryuk ransomware virus. Ryuk is thought to have been created by North Korean government sponsored hackers, suspected of using strategies exposed from America's National Security Agency. Ryuk attacks specific organizations with limited ability to sustain operational disruption and is one of the most lucrative iterations of ransomware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company located in Chicago and has about 500 workers. The Ryuk penetration had frozen all company operations and manufacturing capabilities. Most of the client's data protection had been on-line at the time of the attack and were eventually encrypted. The client was evaluating paying the ransom (more than two hundred thousand dollars) and wishfully thinking for the best, but in the end engaged Progent.

Progent worked with the client to rapidly assess and prioritize the critical services that had to be restored to make it possible to continue company functions:

• Active Directory (AD)
• Electronic Messaging
• MRP System

In less than two days, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then accomplished setup and storage recovery on needed applications. All Microsoft Exchange Server data and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble local OST files (Outlook Email Offline Folder Files) on user workstations to recover mail messages. A recent off-line backup of the client's financials/ERP systems made it possible to return these required programs back servicing users. Although a lot of work remained to recover completely from the Ryuk event, essential systems were returned to operations quickly:

Throughout the next few weeks key milestones in the restoration process were completed through tight collaboration between Progent engineers and the customer:

• Self-hosted web applications were brought back up with no loss of data.
• The MailStore Server exceeding four million archived messages was restored to operations and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory modules were fully recovered.
• A new Palo Alto 850 firewall was installed and configured.
• Nearly all of the user desktops and notebooks were fully operational.

Conclusion
A likely business catastrophe was evaded through the efforts of results-oriented experts, a broad spectrum of knowledge, and tight teamwork. Although in analyzing the event afterwards the ransomware penetration described here could have been identified and prevented with modern cyber security systems and ISO/IEC 27001 best practices, team training, and well designed incident response procedures for information backup and keeping systems up to date with security patches, the fact is that state-sponsored cybercriminals from Russia, China and elsewhere are tireless and are not going away. If you do fall victim to a ransomware incident, feel confident that Progent's roster of experts has substantial experience in ransomware virus defense, remediation, and data disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Leeds
For ransomware system recovery consulting in the Leeds area, call Progent at 800-462-8800 or see Contact Progent.