Ransomware Protection and Cleanup Solutions Addison

Crypto-Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that presents an existential threat for organizations unprepared for an assault. Multiple generations of ransomware such as Reveton, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been around for many years and continue to cause havoc. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, along with more as yet unnamed viruses, not only encrypt on-line data but also infiltrate most configured system backup. Data synched to cloud environments can also be encrypted. In a poorly designed data protection solution, it can render automated recovery hopeless and effectively sets the network back to zero.

Getting back on-line services and information after a ransomware outage becomes a race against the clock as the targeted organization tries its best to stop the spread, eradicate the virus, and restore enterprise-critical operations. Because crypto-ransomware takes time to replicate throughout a targeted network, penetrations are often launched during weekends and nights, when attacks typically take longer to notice. This multiplies the difficulty of quickly mobilizing and organizing a capable response team.

Progent offers a variety of solutions for securing Addison enterprises from crypto-ransomware events. These include staff training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to discover and disable zero-day modern malware attacks. Progent in addition can provide the assistance of experienced ransomware recovery engineers with the talent and commitment to reconstruct a compromised network as rapidly as possible.

Progent's Ransomware Recovery Support Services
Soon after a ransomware invasion, even paying the ransom in cryptocurrency does not guarantee that criminal gangs will provide the needed codes to decipher any of your files. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never restored their data even after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to re-install the essential elements of your Information Technology environment. Absent the availability of complete information backups, this calls for a wide complement of skill sets, well-coordinated project management, and the ability to work continuously until the task is done.

For twenty years, Progent has offered professional Information Technology services for companies across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned advanced industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have earned internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP applications. This breadth of experience affords Progent the skills to knowledgably determine necessary systems and organize the remaining parts of your Information Technology system after a crypto-ransomware penetration and assemble them into a functioning system.

Progent's security group has top notch project management tools to orchestrate the sophisticated recovery process. Progent appreciates the importance of working rapidly and in unison with a client's management and IT resources to prioritize tasks and to get key applications back online as soon as possible.

Customer Story: A Successful Ransomware Virus Recovery
A customer contacted Progent after their network was taken over by Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean government sponsored cybercriminals, suspected of adopting techniques exposed from America's National Security Agency. Ryuk targets specific companies with little ability to sustain operational disruption and is one of the most lucrative incarnations of ransomware malware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing business located in the Chicago metro area and has around 500 employees. The Ryuk penetration had paralyzed all essential operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the beginning of the intrusion and were damaged. The client was actively seeking loans for paying the ransom demand (exceeding $200K) and hoping for the best, but in the end made the decision to use Progent.

Progent worked hand in hand the client to quickly identify and prioritize the critical elements that needed to be addressed in order to resume departmental functions:

• Microsoft Active Directory
• Microsoft Exchange
• MRP System

In less than two days, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then accomplished rebuilding and storage recovery on the most important systems. All Microsoft Exchange Server ties and attributes were intact, which facilitated the restore of Exchange. Progent was also able to collect local OST data files (Outlook Email Off-Line Data Files) on staff workstations and laptops in order to recover email information. A not too old offline backup of the customer's accounting software made it possible to restore these essential applications back on-line. Although significant work needed to be completed to recover totally from the Ryuk damage, critical services were returned to operations rapidly:

Over the following month critical milestones in the recovery process were achieved through tight collaboration between Progent team members and the customer:

• Self-hosted web sites were restored with no loss of information.
• The MailStore Microsoft Exchange Server with over 4 million historical emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory capabilities were fully restored.
• A new Palo Alto Networks 850 security appliance was deployed.
• 90% of the user workstations were functioning as before the incident.

Conclusion
A likely business-killing catastrophe was evaded due to dedicated professionals, a broad range of knowledge, and close teamwork. Although in hindsight the ransomware virus incident detailed here would have been identified and stopped with up-to-date cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and appropriate security procedures for information backup and keeping systems up to date with security patches, the reality remains that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a crypto-ransomware virus, remember that Progent's roster of professionals has a proven track record in crypto-ransomware virus defense, remediation, and file recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Addison
For ransomware system recovery consulting in the Addison metro area, call Progent at 800-462-8800 or go to Contact Progent.