Ransomware Protection and Remediation Consulting Akron

Ransomware : Your Crippling IT Disaster
Ransomware has become a too-frequent cyber pandemic that represents an enterprise-level danger for organizations unprepared for an assault. Different versions of ransomware such as CrySIS, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for years and continue to cause damage. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, along with additional as yet unnamed newcomers, not only encrypt on-line data but also infect any available system protection. Data synched to the cloud can also be corrupted. In a poorly architected data protection solution, this can render automatic restore operations impossible and effectively sets the entire system back to zero.

Getting back online programs and information following a ransomware event becomes a sprint against the clock as the targeted business tries its best to contain, clear the virus, and restore business-critical activity. Due to the fact that ransomware needs time to move laterally throughout a network, penetrations are often launched on weekends and holidays, when successful attacks are likely to take more time to identify. This multiplies the difficulty of quickly assembling and organizing a qualified mitigation team.

Progent makes available a variety of help services for securing Akron businesses from ransomware events. These include staff education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to discover and disable day-zero malware assaults. Progent in addition provides the assistance of experienced ransomware recovery engineers with the track record and perseverance to rebuild a compromised system as quickly as possible.

Progent's Ransomware Restoration Services
Soon after a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that cyber criminals will provide the keys to decrypt any of your files. Kaspersky Labs determined that 17% of crypto-ransomware victims never restored their information even after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to piece back together the mission-critical elements of your IT environment. Without access to full information backups, this calls for a broad range of IT skills, top notch project management, and the capability to work non-stop until the recovery project is complete.

For two decades, Progent has provided professional Information Technology services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained top industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial systems and ERP software solutions. This breadth of experience gives Progent the capability to rapidly determine critical systems and organize the surviving components of your IT system after a ransomware penetration and configure them into an operational system.

Progent's security team has powerful project management applications to orchestrate the complex recovery process. Progent appreciates the importance of acting rapidly and in unison with a customer's management and IT team members to prioritize tasks and to put the most important systems back on line as soon as possible.

Business Case Study: A Successful Ransomware Virus Recovery
A business hired Progent after their organization was taken over by the Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean state sponsored hackers, suspected of adopting algorithms leaked from America's National Security Agency. Ryuk seeks specific businesses with little or no room for operational disruption and is one of the most lucrative examples of ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing business headquartered in Chicago and has about 500 workers. The Ryuk penetration had paralyzed all company operations and manufacturing capabilities. Most of the client's backups had been online at the beginning of the intrusion and were destroyed. The client was taking steps for paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately reached out to Progent.

Progent worked with the client to quickly determine and prioritize the mission critical areas that had to be restored in order to continue departmental operations:

• Active Directory
• Email
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-attack state. Progent then completed rebuilding and storage recovery of the most important systems. All Exchange schema and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to assemble non-encrypted OST files (Outlook Offline Folder Files) on staff PCs and laptops in order to recover mail messages. A not too old off-line backup of the businesses manufacturing software made it possible to recover these required programs back servicing users. Although major work needed to be completed to recover fully from the Ryuk event, critical systems were returned to operations rapidly:

Throughout the next month key milestones in the recovery process were achieved in close collaboration between Progent team members and the customer:

• Internal web applications were brought back up with no loss of data.
• The MailStore Server with over 4 million archived emails was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory capabilities were completely functional.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Most of the desktops and laptops were back into operation.

Conclusion
A possible business-killing catastrophe was averted through the efforts of results-oriented professionals, a broad array of knowledge, and close collaboration. Although in retrospect the ransomware virus incident described here could have been identified and stopped with advanced cyber security systems and security best practices, staff training, and appropriate incident response procedures for data backup and proper patching controls, the reality is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware incident, feel confident that Progent's roster of professionals has proven experience in ransomware virus blocking, cleanup, and information systems restoration.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Akron
For ransomware recovery consulting services in the Akron area, phone Progent at 800-462-8800 or go to Contact Progent.