Ransomware Prevention and Cleanup Expertise Guadalajara

Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become a modern cyberplague that presents an extinction-level danger for organizations poorly prepared for an assault. Versions of ransomware such as Dharma, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for a long time and still cause destruction. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as more unnamed malware, not only encrypt online files but also infect any configured system protection mechanisms. Data synched to the cloud can also be encrypted. In a poorly architected system, this can make automatic recovery impossible and effectively knocks the network back to zero.

Getting back online programs and data after a ransomware attack becomes a race against time as the targeted organization tries its best to stop lateral movement, eradicate the virus, and resume enterprise-critical operations. Due to the fact that ransomware requires time to move laterally throughout a network, assaults are usually sprung on weekends and holidays, when attacks in many cases take longer to uncover. This multiplies the difficulty of quickly assembling and organizing a capable response team.

Progent offers a range of services for securing Guadalajara businesses from crypto-ransomware penetrations. These include user training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to identify and quarantine day-zero modern malware attacks. Progent in addition provides the services of veteran ransomware recovery engineers with the track record and commitment to re-deploy a breached system as soon as possible.

Progent's Ransomware Recovery Help
Soon after a ransomware attack, paying the ransom in cryptocurrency does not ensure that distant criminals will provide the needed keys to decipher all your files. Kaspersky determined that seventeen percent of ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to setup from scratch the key elements of your Information Technology environment. Without access to complete data backups, this calls for a broad complement of skill sets, professional project management, and the willingness to work 24x7 until the job is finished.

For decades, Progent has provided professional IT services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have been awarded advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have garnered internationally-renowned industry certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with financial management and ERP applications. This breadth of expertise affords Progent the ability to efficiently understand necessary systems and integrate the remaining pieces of your IT environment following a crypto-ransomware attack and assemble them into a functioning system.

Progent's recovery team of experts uses best of breed project management tools to orchestrate the complicated recovery process. Progent understands the urgency of acting swiftly and together with a customer's management and IT team members to assign priority to tasks and to put essential services back on-line as fast as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Virus Response
A client hired Progent after their network system was attacked by Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean government sponsored hackers, possibly adopting technology leaked from the U.S. National Security Agency. Ryuk attacks specific organizations with limited tolerance for disruption and is among the most lucrative examples of ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in the Chicago metro area and has around 500 employees. The Ryuk event had brought down all essential operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the start of the intrusion and were destroyed. The client was pursuing financing for paying the ransom demand (more than $200,000) and hoping for good luck, but in the end brought in Progent.

Progent worked hand in hand the client to rapidly identify and prioritize the critical services that had to be restored in order to restart company operations:

• Windows Active Directory
• Email
• Accounting/MRP

In less than 2 days, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then performed reinstallations and hard drive recovery of essential systems. All Exchange Server data and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to find intact OST data files (Outlook Email Off-Line Data Files) on staff PCs and laptops in order to recover email information. A recent off-line backup of the businesses financials/ERP software made them able to recover these required applications back online for users. Although a lot of work still had to be done to recover completely from the Ryuk damage, critical services were recovered quickly:

During the next few weeks key milestones in the recovery process were accomplished through close cooperation between Progent team members and the client:

• Self-hosted web applications were brought back up with no loss of data.
• The MailStore Exchange Server with over 4 million historical messages was restored to operations and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were completely recovered.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• Ninety percent of the user workstations were fully operational.

Conclusion
A likely business extinction catastrophe was avoided with results-oriented professionals, a broad spectrum of knowledge, and tight collaboration. Although in hindsight the crypto-ransomware penetration detailed here should have been identified and prevented with up-to-date security solutions and NIST Cybersecurity Framework best practices, staff training, and well thought out security procedures for information backup and keeping systems up to date with security patches, the fact remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's roster of experts has a proven track record in ransomware virus blocking, mitigation, and data restoration.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Guadalajara
For ransomware system recovery expertise in the Guadalajara metro area, phone Progent at 800-462-8800 or visit Contact Progent.