Ransomware Prevention and Restoration Expertise Midland

Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become a modern cyber pandemic that represents an enterprise-level danger for businesses of all sizes unprepared for an attack. Different iterations of ransomware such as Reveton, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for a long time and still cause damage. Newer variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, plus daily as yet unnamed newcomers, not only encrypt on-line information but also infect any available system backup. Files synched to off-premises disaster recovery sites can also be encrypted. In a vulnerable system, it can render automatic recovery useless and basically sets the entire system back to zero.

Retrieving services and data after a ransomware intrusion becomes a race against the clock as the targeted organization tries its best to stop the spread, eradicate the virus, and restore business-critical operations. Due to the fact that crypto-ransomware requires time to spread across a network, assaults are frequently launched on weekends and holidays, when attacks tend to take more time to discover. This multiplies the difficulty of quickly mobilizing and orchestrating an experienced response team.

Progent offers a variety of solutions for securing Midland businesses from ransomware penetrations. These include team education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to detect and disable zero-day malware attacks. Progent in addition offers the services of experienced crypto-ransomware recovery consultants with the skills and commitment to re-deploy a breached system as urgently as possible.

Progent's Ransomware Recovery Help
After a ransomware invasion, paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will respond with the needed keys to decipher all your files. Kaspersky Labs ascertained that seventeen percent of crypto-ransomware victims never restored their files after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The fallback is to piece back together the vital parts of your IT environment. Without access to complete data backups, this calls for a broad complement of skill sets, well-coordinated team management, and the willingness to work non-stop until the task is done.

For two decades, Progent has provided certified expert Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have earned internationally-renowned certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial systems and ERP application software. This breadth of experience gives Progent the ability to rapidly determine important systems and re-organize the surviving components of your network system after a crypto-ransomware attack and rebuild them into an operational network.

Progent's security team of experts utilizes state-of-the-art project management systems to orchestrate the sophisticated recovery process. Progent appreciates the importance of acting swiftly and in concert with a customer's management and Information Technology staff to prioritize tasks and to put the most important systems back online as soon as humanly possible.

Client Story: A Successful Ransomware Intrusion Response
A small business hired Progent after their network system was attacked by the Ryuk crypto-ransomware. Ryuk is believed to have been created by North Korean government sponsored hackers, suspected of adopting approaches leaked from America's NSA organization. Ryuk targets specific organizations with little or no room for disruption and is one of the most profitable incarnations of ransomware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business headquartered in Chicago and has around 500 employees. The Ryuk penetration had disabled all essential operations and manufacturing capabilities. Most of the client's backups had been on-line at the time of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (more than $200K) and hoping for the best, but in the end brought in Progent.

Progent worked with the customer to rapidly assess and assign priority to the essential systems that had to be recovered in order to resume business operations:

• Windows Active Directory
• Microsoft Exchange
• MRP System

In less than 48 hours, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then performed setup and hard drive recovery of needed servers. All Exchange Server schema and attributes were intact, which accelerated the restore of Exchange. Progent was also able to locate local OST files (Microsoft Outlook Off-Line Data Files) on user workstations in order to recover email information. A recent off-line backup of the client's financials/ERP software made them able to return these vital programs back available to users. Although a lot of work remained to recover totally from the Ryuk virus, the most important services were restored quickly:

During the next month key milestones in the restoration process were achieved in close cooperation between Progent engineers and the customer:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Exchange Server containing more than 4 million historical messages was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control functions were fully operational.
• A new Palo Alto 850 firewall was deployed.
• 90% of the user workstations were operational.

Conclusion
A possible business extinction disaster was evaded due to dedicated professionals, a broad array of IT skills, and tight collaboration. Although in retrospect the ransomware incident described here could have been identified and disabled with up-to-date cyber security solutions and NIST Cybersecurity Framework best practices, team training, and appropriate security procedures for backup and applying software patches, the reality is that state-sponsored cyber criminals from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's team of experts has extensive experience in ransomware virus defense, remediation, and data restoration.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Midland
For ransomware recovery consulting services in the Midland metro area, call Progent at 800-462-8800 or go to Contact Progent.