Ransomware Filtering and Cleanup Services Minneapolis

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that presents an existential threat for businesses of all sizes unprepared for an attack. Multiple generations of crypto-ransomware like the CryptoLocker, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for years and continue to cause damage. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as additional unnamed viruses, not only perform encryption of online files but also infiltrate any available system backup. Information synchronized to the cloud can also be rendered useless. In a vulnerable system, this can make automatic recovery hopeless and effectively knocks the datacenter back to square one.

Getting back applications and information after a crypto-ransomware outage becomes a sprint against the clock as the victim tries its best to contain, cleanup the virus, and resume business-critical operations. Due to the fact that crypto-ransomware takes time to replicate throughout a targeted network, penetrations are often launched at night, when successful penetrations may take more time to notice. This compounds the difficulty of quickly assembling and coordinating a capable response team.

Progent has a range of services for protecting Minneapolis businesses from ransomware penetrations. Among these are team member education to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat defense to detect and extinguish day-zero modern malware assaults. Progent in addition offers the services of expert crypto-ransomware recovery professionals with the talent and perseverance to restore a compromised system as quickly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a ransomware penetration, paying the ransom demands in cryptocurrency does not guarantee that merciless criminals will provide the codes to unencrypt all your data. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The fallback is to setup from scratch the vital elements of your Information Technology environment. Absent the availability of complete data backups, this requires a wide complement of skills, well-coordinated project management, and the ability to work continuously until the recovery project is complete.

For decades, Progent has offered certified expert IT services for companies across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained advanced certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP applications. This breadth of experience gives Progent the ability to quickly determine critical systems and organize the remaining pieces of your IT environment following a ransomware attack and configure them into an operational network.

Progent's security team of experts deploys top notch project management systems to coordinate the sophisticated restoration process. Progent understands the importance of acting quickly and together with a client's management and IT resources to assign priority to tasks and to get the most important services back online as fast as humanly possible.

Client Story: A Successful Ransomware Attack Restoration
A customer hired Progent after their network was penetrated by the Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state sponsored hackers, suspected of adopting techniques exposed from the U.S. National Security Agency. Ryuk goes after specific companies with limited room for disruption and is among the most lucrative iterations of ransomware malware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer based in Chicago and has around 500 employees. The Ryuk event had disabled all essential operations and manufacturing processes. The majority of the client's information backups had been on-line at the time of the attack and were destroyed. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for the best, but in the end engaged Progent.

Progent worked with the client to rapidly identify and prioritize the most important areas that needed to be restored to make it possible to resume company operations:

• Active Directory (AD)
• Microsoft Exchange
• Financials/MRP

Within 48 hours, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then performed rebuilding and storage recovery on essential systems. All Exchange ties and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to assemble local OST files (Microsoft Outlook Off-Line Folder Files) on various desktop computers and laptops to recover email information. A not too old off-line backup of the businesses accounting/MRP software made them able to recover these required applications back online. Although significant work needed to be completed to recover completely from the Ryuk attack, essential systems were restored quickly:

Over the following month important milestones in the restoration process were made in tight collaboration between Progent engineers and the client:

• Internal web sites were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server exceeding 4 million archived emails was spun up and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control modules were 100% recovered.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• 90% of the desktops and laptops were functioning as before the incident.

Conclusion
A potential company-ending disaster was evaded by dedicated experts, a broad array of IT skills, and close collaboration. Although in post mortem the crypto-ransomware virus attack described here would have been disabled with up-to-date cyber security technology and NIST Cybersecurity Framework best practices, team training, and well thought out security procedures for data protection and proper patching controls, the fact remains that government-sponsored cybercriminals from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, remember that Progent's team of experts has a proven track record in ransomware virus blocking, cleanup, and file restoration.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Minneapolis
For ransomware cleanup consulting in the Minneapolis metro area, phone Progent at 800-462-8800 or visit Contact Progent.