Ransomware Protection and Recovery Expertise Reading

Ransomware : Your Crippling IT Disaster
Ransomware has become an escalating cyber pandemic that poses an existential threat for businesses poorly prepared for an attack. Different iterations of ransomware such as CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and still cause damage. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, along with daily unnamed malware, not only perform encryption of on-line data but also infiltrate many available system protection. Files synchronized to cloud environments can also be rendered useless. In a poorly architected system, it can render automated recovery hopeless and effectively sets the entire system back to square one.

Getting back on-line applications and data after a ransomware event becomes a sprint against the clock as the targeted business fights to contain, eradicate the ransomware, and restore business-critical operations. Since ransomware requires time to spread throughout a network, assaults are usually sprung on weekends and holidays, when successful attacks tend to take longer to uncover. This multiplies the difficulty of quickly marshalling and orchestrating a knowledgeable response team.

Progent offers a variety of help services for protecting Reading enterprises from ransomware events. Among these are staff education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to discover and extinguish zero-day malware assaults. Progent also can provide the services of expert ransomware recovery engineers with the talent and perseverance to reconstruct a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Following a crypto-ransomware penetration, sending the ransom in cryptocurrency does not guarantee that distant criminals will return the keys to decipher any or all of your data. Kaspersky determined that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to re-install the vital components of your Information Technology environment. Absent the availability of essential data backups, this calls for a wide range of skill sets, professional team management, and the capability to work non-stop until the task is finished.

For decades, Progent has offered professional Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have earned top industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in accounting and ERP applications. This breadth of expertise provides Progent the capability to quickly identify important systems and consolidate the remaining parts of your IT environment after a ransomware penetration and assemble them into a functioning system.

Progent's security team of experts deploys top notch project management tools to orchestrate the sophisticated restoration process. Progent appreciates the urgency of working swiftly and together with a client's management and Information Technology team members to assign priority to tasks and to put critical applications back on-line as soon as possible.

Client Story: A Successful Crypto-Ransomware Incident Restoration
A business engaged Progent after their network was taken over by Ryuk ransomware. Ryuk is thought to have been deployed by North Korean government sponsored cybercriminals, possibly using strategies exposed from the United States NSA organization. Ryuk targets specific businesses with little or no tolerance for disruption and is among the most lucrative instances of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer headquartered in the Chicago metro area and has around 500 workers. The Ryuk event had disabled all company operations and manufacturing capabilities. The majority of the client's system backups had been directly accessible at the time of the intrusion and were encrypted. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for the best, but in the end reached out to Progent.

Progent worked together with the customer to rapidly get our arms around and prioritize the essential systems that had to be restored in order to resume company functions:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then initiated rebuilding and storage recovery of needed systems. All Exchange schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to find local OST data files (Outlook Email Off-Line Folder Files) on user workstations to recover email messages. A recent offline backup of the businesses financials/MRP software made it possible to recover these essential programs back on-line. Although major work remained to recover fully from the Ryuk damage, the most important systems were returned to operations rapidly:

Throughout the next few weeks key milestones in the restoration project were accomplished in tight collaboration between Progent consultants and the customer:

• In-house web applications were brought back up without losing any information.
• The MailStore Server containing more than four million historical messages was brought online and accessible to users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory Control functions were 100% restored.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Most of the user PCs were being used by staff.

Conclusion
A likely business extinction disaster was averted through the efforts of dedicated professionals, a wide range of knowledge, and close collaboration. Although in hindsight the ransomware virus penetration detailed here should have been shut down with current cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and properly executed incident response procedures for data protection and applying software patches, the reality remains that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware penetration, feel confident that Progent's roster of professionals has a proven track record in crypto-ransomware virus blocking, removal, and information systems disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Reading
For ransomware recovery consulting in the Reading metro area, phone Progent at 800-462-8800 or see Contact Progent.