Ransomware Prevention and Removal Services San Jose

Crypto-Ransomware : Your Feared Information Technology Nightmare
Ransomware has become an escalating cyberplague that represents an enterprise-level threat for businesses vulnerable to an attack. Multiple generations of ransomware like the Reveton, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for many years and continue to cause havoc. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, as well as daily unnamed malware, not only perform encryption of on-line information but also infect many configured system backup. Files synched to cloud environments can also be ransomed. In a vulnerable environment, this can make any recovery impossible and effectively sets the datacenter back to square one.

Getting back online services and information following a ransomware outage becomes a sprint against time as the targeted business tries its best to stop lateral movement, clear the virus, and restore mission-critical activity. Because crypto-ransomware takes time to replicate throughout a targeted network, assaults are often launched on weekends, when attacks typically take longer to identify. This multiplies the difficulty of promptly assembling and orchestrating an experienced mitigation team.

Progent has a range of support services for protecting San Jose enterprises from ransomware penetrations. These include staff training to help recognize and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to identify and suppress day-zero modern malware attacks. Progent also can provide the assistance of seasoned ransomware recovery consultants with the talent and commitment to rebuild a compromised network as rapidly as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware invasion, paying the ransom demands in cryptocurrency does not ensure that cyber hackers will provide the keys to unencrypt any or all of your data. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The fallback is to piece back together the essential components of your IT environment. Absent access to complete data backups, this calls for a wide range of skill sets, well-coordinated team management, and the capability to work non-stop until the recovery project is finished.

For two decades, Progent has provided professional Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained top certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with accounting and ERP application software. This breadth of experience provides Progent the skills to quickly determine necessary systems and consolidate the surviving pieces of your computer network environment following a ransomware event and assemble them into an operational system.

Progent's security team deploys powerful project management systems to coordinate the sophisticated restoration process. Progent understands the importance of acting rapidly and in unison with a customer's management and Information Technology resources to prioritize tasks and to get essential applications back online as fast as possible.

Customer Story: A Successful Ransomware Intrusion Response
A small business engaged Progent after their company was brought down by Ryuk ransomware virus. Ryuk is believed to have been deployed by North Korean state hackers, suspected of adopting algorithms leaked from the United States National Security Agency. Ryuk goes after specific businesses with little or no ability to sustain disruption and is one of the most profitable instances of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in the Chicago metro area with about 500 staff members. The Ryuk intrusion had shut down all company operations and manufacturing capabilities. Most of the client's system backups had been on-line at the start of the attack and were encrypted. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for the best, but ultimately reached out to Progent.

Progent worked with the client to rapidly get our arms around and assign priority to the critical areas that had to be addressed to make it possible to resume business operations:

• Active Directory
• Email
• Accounting/MRP

Within 2 days, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then initiated reinstallations and hard drive recovery on essential applications. All Microsoft Exchange Server data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to collect intact OST data files (Outlook Offline Folder Files) on staff PCs in order to recover mail messages. A recent off-line backup of the client's manufacturing software made them able to restore these vital programs back online. Although a lot of work was left to recover totally from the Ryuk virus, the most important services were restored rapidly:

During the following couple of weeks key milestones in the restoration process were achieved in tight collaboration between Progent team members and the customer:

• In-house web sites were restored with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million archived emails was brought online and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control modules were fully restored.
• A new Palo Alto Networks 850 firewall was installed and configured.
• 90% of the desktop computers were being used by staff.

Conclusion
A probable business-killing catastrophe was averted due to results-oriented professionals, a broad range of IT skills, and close teamwork. Although in post mortem the crypto-ransomware virus incident described here could have been identified and blocked with up-to-date cyber security technology solutions and best practices, user training, and well designed security procedures for information backup and applying software patches, the reality is that state-sponsored hackers from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware penetration, remember that Progent's team of experts has substantial experience in ransomware virus defense, remediation, and information systems disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in San Jose
For ransomware system recovery expertise in the San Jose metro area, phone Progent at 800-462-8800 or visit Contact Progent.