Ransomware Defense and Cleanup Solutions Reading

Crypto-Ransomware : Your Worst IT Nightmare
Crypto-Ransomware has become an escalating cyberplague that represents an extinction-level threat for businesses unprepared for an assault. Different versions of crypto-ransomware such as Reveton, Fusob, Locky, NotPetya and MongoLock cryptoworms have been around for many years and still cause harm. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, as well as additional unnamed malware, not only perform encryption of on-line data files but also infect all available system backup. Files replicated to the cloud can also be encrypted. In a vulnerable system, it can make automatic recovery impossible and effectively sets the network back to zero.

Restoring services and information following a ransomware outage becomes a race against time as the targeted organization struggles to stop the spread, cleanup the ransomware, and resume enterprise-critical operations. Because ransomware requires time to move laterally throughout a targeted network, assaults are often sprung on weekends, when successful attacks are likely to take longer to discover. This compounds the difficulty of quickly assembling and orchestrating a knowledgeable mitigation team.

Progent provides a range of solutions for protecting Reading organizations from ransomware penetrations. These include staff training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to detect and suppress day-zero modern malware assaults. Progent also provides the services of veteran ransomware recovery engineers with the talent and commitment to rebuild a compromised system as rapidly as possible.

Progent's Crypto-Ransomware Recovery Help
After a crypto-ransomware penetration, paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will respond with the needed keys to decipher all your data. Kaspersky determined that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to setup from scratch the critical elements of your IT environment. Without access to full system backups, this requires a broad range of IT skills, top notch team management, and the willingness to work 24x7 until the recovery project is completed.

For decades, Progent has provided professional Information Technology services for businesses across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have been awarded advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in accounting and ERP software solutions. This breadth of experience gives Progent the ability to efficiently ascertain critical systems and consolidate the remaining components of your IT environment following a ransomware penetration and assemble them into an operational system.

Progent's ransomware team of experts has best of breed project management tools to coordinate the complicated recovery process. Progent appreciates the importance of working quickly and together with a client's management and Information Technology team members to prioritize tasks and to put essential services back online as fast as humanly possible.

Customer Story: A Successful Ransomware Penetration Restoration
A customer hired Progent after their organization was brought down by Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean state sponsored criminal gangs, suspected of using technology leaked from America's NSA organization. Ryuk seeks specific organizations with limited room for disruption and is among the most profitable instances of crypto-ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in the Chicago metro area with about 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing processes. The majority of the client's information backups had been directly accessible at the beginning of the intrusion and were damaged. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and hoping for the best, but ultimately called Progent.

Progent worked together with the customer to rapidly identify and assign priority to the key services that needed to be addressed in order to continue departmental operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• MRP System

In less than 48 hours, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then performed reinstallations and storage recovery of key systems. All Exchange schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to find non-encrypted OST files (Outlook Email Offline Data Files) on staff PCs and laptops to recover mail information. A recent offline backup of the customer's financials/ERP software made it possible to restore these vital services back online for users. Although major work still had to be done to recover totally from the Ryuk event, critical systems were recovered rapidly:

During the next couple of weeks critical milestones in the restoration process were made through close cooperation between Progent team members and the client:

• Internal web sites were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million historical emails was brought online and accessible to users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory modules were 100% recovered.
• A new Palo Alto 850 firewall was brought online.
• 90% of the desktops and laptops were functioning as before the incident.

Conclusion
A possible enterprise-killing catastrophe was evaded with hard-working professionals, a wide spectrum of subject matter expertise, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware penetration detailed here should have been identified and prevented with up-to-date cyber security systems and best practices, user education, and properly executed security procedures for information protection and proper patching controls, the reality remains that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware virus, remember that Progent's roster of experts has substantial experience in crypto-ransomware virus defense, mitigation, and data recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Reading
For ransomware cleanup consulting in the Reading metro area, call Progent at 800-462-8800 or see Contact Progent.