Ransomware Filtering and Removal Expertise Brighton

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that represents an enterprise-level danger for organizations vulnerable to an assault. Different versions of ransomware like the CrySIS, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for a long time and still cause harm. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, along with frequent as yet unnamed newcomers, not only encrypt online files but also infiltrate any accessible system protection mechanisms. Data replicated to off-premises disaster recovery sites can also be corrupted. In a poorly designed system, it can render any restore operations impossible and basically sets the entire system back to zero.

Getting back programs and data following a ransomware intrusion becomes a sprint against time as the victim tries its best to contain the damage, clear the virus, and restore enterprise-critical activity. Due to the fact that crypto-ransomware needs time to replicate throughout a network, penetrations are frequently sprung during nights and weekends, when successful penetrations are likely to take more time to discover. This multiplies the difficulty of rapidly assembling and organizing a capable mitigation team.

Progent provides a range of support services for protecting Brighton businesses from ransomware attacks. These include team training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to discover and quarantine zero-day modern malware attacks. Progent also provides the assistance of veteran ransomware recovery professionals with the track record and perseverance to re-deploy a breached system as soon as possible.

Progent's Crypto-Ransomware Recovery Services
Soon after a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not ensure that cyber hackers will respond with the codes to decipher any of your data. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The alternative is to re-install the essential components of your Information Technology environment. Without the availability of full system backups, this calls for a broad range of skills, well-coordinated project management, and the ability to work 24x7 until the task is done.

For twenty years, Progent has offered certified expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained high-level industry certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of experience gives Progent the skills to rapidly determine critical systems and organize the remaining parts of your computer network system after a crypto-ransomware penetration and configure them into a functioning system.

Progent's recovery team of experts deploys powerful project management applications to orchestrate the complicated restoration process. Progent understands the importance of acting rapidly and in unison with a client's management and IT resources to assign priority to tasks and to put the most important applications back online as fast as humanly possible.

Customer Story: A Successful Ransomware Penetration Response
A client contacted Progent after their network was crashed by Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state sponsored cybercriminals, possibly adopting techniques leaked from the U.S. National Security Agency. Ryuk goes after specific organizations with little or no ability to sustain operational disruption and is among the most lucrative incarnations of ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business located in the Chicago metro area with about 500 staff members. The Ryuk event had disabled all company operations and manufacturing capabilities. Most of the client's backups had been online at the start of the attack and were eventually encrypted. The client considered paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked with the customer to quickly get our arms around and assign priority to the essential services that had to be restored to make it possible to resume company operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting/MRP

In less than two days, Progent was able to rebuild Active Directory to its pre-virus state. Progent then completed setup and hard drive recovery of critical applications. All Microsoft Exchange Server ties and attributes were usable, which greatly helped the restore of Exchange. Progent was also able to assemble intact OST files (Outlook Off-Line Folder Files) on user desktop computers and laptops to recover mail information. A recent offline backup of the client's accounting systems made them able to return these essential applications back online for users. Although a lot of work remained to recover fully from the Ryuk damage, essential systems were returned to operations rapidly:

During the following month important milestones in the restoration project were made in close cooperation between Progent consultants and the customer:

• Internal web sites were returned to operation without losing any information.
• The MailStore Server containing more than four million archived messages was brought on-line and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/AR/Inventory Control capabilities were fully restored.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• 90% of the user workstations were being used by staff.

Conclusion
A possible company-ending catastrophe was averted by top-tier professionals, a broad spectrum of IT skills, and tight collaboration. Although in post mortem the ransomware incident described here could have been disabled with advanced security technology and NIST Cybersecurity Framework best practices, team education, and well thought out incident response procedures for data protection and keeping systems up to date with security patches, the reality is that government-sponsored cybercriminals from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware attack, feel confident that Progent's roster of experts has substantial experience in ransomware virus defense, remediation, and information systems recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Brighton
For ransomware cleanup expertise in the Brighton area, call Progent at 800-462-8800 or go to Contact Progent.