Ransomware Defense and Recovery Consulting Perth

Ransomware : Your Feared IT Catastrophe
Ransomware has become an escalating cyber pandemic that poses an enterprise-level danger for businesses poorly prepared for an assault. Multiple generations of ransomware such as Reveton, WannaCry, Locky, SamSam and MongoLock cryptoworms have been running rampant for years and still inflict havoc. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, along with additional as yet unnamed malware, not only encrypt online data but also infiltrate most accessible system backups. Files synched to cloud environments can also be ransomed. In a poorly architected environment, it can make automated restore operations useless and effectively knocks the datacenter back to square one.

Restoring services and information following a ransomware attack becomes a race against time as the targeted business struggles to stop the spread, cleanup the virus, and resume mission-critical activity. Since ransomware requires time to replicate throughout a network, assaults are usually sprung during weekends and nights, when successful penetrations are likely to take more time to uncover. This compounds the difficulty of quickly assembling and orchestrating a qualified response team.

Progent has a range of solutions for protecting Perth enterprises from ransomware events. Among these are team member training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat protection to detect and quarantine day-zero malware attacks. Progent also offers the assistance of seasoned ransomware recovery consultants with the talent and perseverance to re-deploy a compromised network as urgently as possible.

Progent's Ransomware Recovery Support Services
Following a ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that distant criminals will provide the codes to decrypt any or all of your files. Kaspersky ascertained that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to setup from scratch the critical elements of your IT environment. Without access to full information backups, this requires a broad range of skills, well-coordinated project management, and the ability to work non-stop until the task is finished.

For twenty years, Progent has offered certified expert IT services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned high-level certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in accounting and ERP application software. This breadth of experience provides Progent the skills to efficiently determine necessary systems and consolidate the surviving parts of your IT system after a ransomware attack and rebuild them into an operational system.

Progent's recovery team utilizes state-of-the-art project management applications to orchestrate the complex restoration process. Progent understands the importance of acting quickly and in concert with a customer's management and Information Technology resources to prioritize tasks and to get essential services back on-line as fast as humanly possible.

Customer Case Study: A Successful Ransomware Virus Response
A small business escalated to Progent after their company was attacked by the Ryuk ransomware virus. Ryuk is believed to have been created by North Korean state sponsored hackers, suspected of using strategies leaked from the United States National Security Agency. Ryuk goes after specific businesses with little or no ability to sustain operational disruption and is among the most lucrative instances of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business based in Chicago and has about 500 workers. The Ryuk attack had disabled all company operations and manufacturing processes. Most of the client's system backups had been on-line at the beginning of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom demand (exceeding $200,000) and wishfully thinking for good luck, but in the end reached out to Progent.

Progent worked hand in hand the customer to rapidly get our arms around and prioritize the essential elements that had to be addressed in order to continue departmental operations:

• Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to restore Active Directory to its pre-penetration state. Progent then charged ahead with reinstallations and storage recovery of mission critical applications. All Exchange Server schema and attributes were intact, which greatly helped the restore of Exchange. Progent was also able to locate local OST data files (Outlook Offline Data Files) on staff workstations in order to recover mail information. A recent off-line backup of the customer's financials/MRP systems made them able to recover these vital services back online for users. Although a large amount of work remained to recover totally from the Ryuk attack, essential systems were recovered rapidly:

During the following month key milestones in the recovery process were accomplished in close collaboration between Progent team members and the customer:

• Self-hosted web applications were restored without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million historical emails was spun up and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control capabilities were completely recovered.
• A new Palo Alto 850 security appliance was brought on-line.
• Ninety percent of the user PCs were fully operational.

Conclusion
A probable enterprise-killing disaster was averted with hard-working experts, a wide array of knowledge, and close collaboration. Although in post mortem the crypto-ransomware attack detailed here should have been identified and blocked with advanced security technology and recognized best practices, staff training, and well designed incident response procedures for information protection and applying software patches, the reality is that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware incident, remember that Progent's roster of experts has a proven track record in ransomware virus defense, removal, and data disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Perth
For ransomware cleanup services in the Perth metro area, phone Progent at 800-462-8800 or visit Contact Progent.