Ransomware Prevention and Restoration Consulting Mobile

Ransomware : Your Crippling IT Nightmare
Ransomware has become a modern cyberplague that represents an extinction-level danger for organizations unprepared for an assault. Different iterations of crypto-ransomware like the Dharma, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for many years and continue to inflict harm. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus frequent as yet unnamed viruses, not only encrypt on-line data but also infect any available system protection. Data synched to the cloud can also be corrupted. In a poorly architected system, it can make automated restore operations hopeless and basically sets the entire system back to zero.

Restoring programs and data after a ransomware attack becomes a race against time as the targeted business struggles to stop the spread, clear the crypto-ransomware, and restore mission-critical activity. Due to the fact that crypto-ransomware takes time to replicate across a targeted network, attacks are usually sprung during weekends and nights, when successful attacks may take longer to recognize. This compounds the difficulty of rapidly assembling and orchestrating an experienced mitigation team.

Progent has a variety of solutions for protecting Mobile organizations from crypto-ransomware attacks. Among these are user training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat defense to detect and disable day-zero malware assaults. Progent also offers the services of experienced ransomware recovery consultants with the track record and commitment to rebuild a compromised network as soon as possible.

Progent's Ransomware Restoration Support Services
After a ransomware invasion, paying the ransom demands in cryptocurrency does not ensure that criminal gangs will provide the keys to unencrypt all your files. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The alternative is to piece back together the vital parts of your Information Technology environment. Without access to essential information backups, this requires a broad range of IT skills, top notch project management, and the willingness to work continuously until the job is completed.

For decades, Progent has provided certified expert IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained top certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of experience affords Progent the capability to efficiently ascertain important systems and organize the remaining components of your computer network system after a crypto-ransomware event and configure them into a functioning network.

Progent's ransomware team has best of breed project management systems to orchestrate the complex restoration process. Progent knows the urgency of working quickly and in unison with a client's management and Information Technology staff to prioritize tasks and to put the most important services back on line as soon as possible.

Customer Story: A Successful Ransomware Penetration Response
A client hired Progent after their network was taken over by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state sponsored hackers, possibly using technology leaked from the U.S. NSA organization. Ryuk seeks specific businesses with little or no room for operational disruption and is one of the most lucrative iterations of ransomware viruses. Major targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business based in the Chicago metro area and has around 500 staff members. The Ryuk intrusion had brought down all business operations and manufacturing capabilities. Most of the client's information backups had been online at the beginning of the attack and were destroyed. The client was evaluating paying the ransom (more than $200K) and praying for good luck, but ultimately utilized Progent.

Progent worked hand in hand the customer to rapidly assess and prioritize the mission critical systems that needed to be addressed to make it possible to restart company operations:

• Windows Active Directory
• Electronic Mail
• Accounting/MRP

In less than two days, Progent was able to restore Active Directory to its pre-attack state. Progent then completed setup and storage recovery on mission critical applications. All Exchange data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to locate intact OST data files (Outlook Email Offline Folder Files) on various workstations and laptops in order to recover mail information. A recent offline backup of the client's accounting/ERP software made them able to recover these vital applications back servicing users. Although a lot of work remained to recover totally from the Ryuk event, the most important services were recovered quickly:

During the following couple of weeks critical milestones in the restoration process were achieved through close collaboration between Progent consultants and the customer:

• Internal web sites were restored without losing any information.
• The MailStore Exchange Server exceeding 4 million archived emails was restored to operations and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were 100% restored.
• A new Palo Alto Networks 850 security appliance was installed.
• Nearly all of the desktop computers were being used by staff.

Conclusion
A potential business-killing catastrophe was evaded through the efforts of results-oriented professionals, a wide spectrum of IT skills, and close teamwork. Although in post mortem the ransomware attack detailed here would have been shut down with up-to-date cyber security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and well designed security procedures for data protection and proper patching controls, the reality is that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware attack, remember that Progent's roster of experts has extensive experience in ransomware virus blocking, removal, and data restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Mobile
For ransomware cleanup consulting services in the Mobile area, call Progent at 800-462-8800 or visit Contact Progent.