Ransomware Prevention and Restoration Consulting Guadalajara

Ransomware : Your Worst IT Disaster
Crypto-Ransomware has become a modern cyberplague that represents an extinction-level danger for businesses of all sizes unprepared for an assault. Different versions of crypto-ransomware such as Dharma, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for years and still cause havoc. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as additional as yet unnamed newcomers, not only perform encryption of online data files but also infect any available system protection mechanisms. Data replicated to off-premises disaster recovery sites can also be rendered useless. In a poorly designed data protection solution, this can make automatic restore operations impossible and effectively sets the network back to zero.

Restoring programs and data following a crypto-ransomware event becomes a race against the clock as the victim tries its best to contain, clear the virus, and resume business-critical operations. Because ransomware takes time to replicate across a targeted network, assaults are usually sprung on weekends, when penetrations are likely to take longer to uncover. This compounds the difficulty of rapidly mobilizing and organizing a qualified response team.

Progent makes available a range of services for protecting Guadalajara enterprises from ransomware penetrations. These include user training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat protection to identify and extinguish zero-day malware assaults. Progent in addition provides the services of expert ransomware recovery professionals with the track record and commitment to reconstruct a breached environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a ransomware invasion, paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will return the keys to unencrypt any of your information. Kaspersky Labs determined that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to re-install the key components of your IT environment. Absent access to complete data backups, this calls for a wide complement of IT skills, top notch project management, and the ability to work 24x7 until the recovery project is finished.

For two decades, Progent has provided certified expert Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained high-level industry certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP software solutions. This breadth of experience affords Progent the skills to quickly ascertain important systems and organize the surviving pieces of your network system after a crypto-ransomware attack and configure them into an operational network.

Progent's security team of experts has best of breed project management tools to coordinate the sophisticated recovery process. Progent knows the importance of acting quickly and in unison with a customer's management and Information Technology team members to assign priority to tasks and to get critical systems back on line as soon as humanly possible.

Customer Case Study: A Successful Crypto-Ransomware Intrusion Response
A business contacted Progent after their organization was attacked by the Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean state hackers, possibly using strategies exposed from America's NSA organization. Ryuk seeks specific organizations with little ability to sustain disruption and is one of the most profitable versions of ransomware malware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in the Chicago metro area with about 500 employees. The Ryuk event had disabled all company operations and manufacturing processes. Most of the client's data protection had been online at the beginning of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom demand (exceeding $200,000) and wishfully thinking for good luck, but ultimately utilized Progent.

Progent worked with the client to quickly understand and assign priority to the essential elements that had to be addressed to make it possible to continue business functions:

• Windows Active Directory
• Microsoft Exchange Email
• MRP System

Within 48 hours, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then performed setup and storage recovery of essential systems. All Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Email Offline Data Files) on team PCs and laptops in order to recover email messages. A recent offline backup of the client's accounting/ERP software made them able to return these vital services back available to users. Although a lot of work remained to recover fully from the Ryuk damage, core services were returned to operations rapidly:

During the next couple of weeks critical milestones in the restoration process were completed in close collaboration between Progent consultants and the client:

• Internal web sites were brought back up without losing any information.
• The MailStore Exchange Server with over 4 million archived messages was brought online and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory modules were 100% restored.
• A new Palo Alto Networks 850 firewall was brought on-line.
• 90% of the user workstations were fully operational.

Conclusion
A potential business-killing disaster was avoided by hard-working experts, a broad array of knowledge, and close collaboration. Although in analyzing the event afterwards the ransomware virus penetration described here could have been disabled with modern security solutions and security best practices, staff education, and well thought out security procedures for information protection and keeping systems up to date with security patches, the fact remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware penetration, feel confident that Progent's roster of experts has substantial experience in ransomware virus blocking, cleanup, and file restoration.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Guadalajara
For ransomware cleanup consulting services in the Guadalajara metro area, phone Progent at 800-462-8800 or see Contact Progent.