Ransomware Defense and Removal Consulting Riverside

Crypto-Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyberplague that presents an enterprise-level threat for organizations unprepared for an assault. Different iterations of ransomware such as Dharma, Fusob, Locky, NotPetya and MongoLock cryptoworms have been around for many years and still inflict damage. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, along with frequent unnamed malware, not only encrypt online data files but also infiltrate many accessible system protection mechanisms. Information synched to off-premises disaster recovery sites can also be rendered useless. In a poorly designed system, this can render automated restore operations impossible and effectively sets the entire system back to zero.

Recovering applications and information after a ransomware attack becomes a race against time as the targeted business fights to contain the damage, remove the virus, and restore business-critical operations. Since crypto-ransomware requires time to spread across a network, attacks are frequently sprung at night, when attacks typically take longer to discover. This compounds the difficulty of promptly assembling and organizing a qualified response team.

Progent provides a variety of support services for securing Riverside businesses from ransomware events. These include team member training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat protection to identify and quarantine zero-day modern malware attacks. Progent also provides the assistance of expert ransomware recovery engineers with the talent and commitment to reconstruct a breached system as urgently as possible.

Progent's Ransomware Restoration Support Services
Soon after a crypto-ransomware attack, paying the ransom in cryptocurrency does not provide any assurance that distant criminals will provide the needed keys to decrypt all your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never restored their files even after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to piece back together the essential parts of your IT environment. Without the availability of full information backups, this calls for a wide range of IT skills, professional team management, and the ability to work continuously until the job is finished.

For two decades, Progent has provided expert IT services for companies across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained high-level industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP application software. This breadth of expertise gives Progent the skills to knowledgably ascertain important systems and organize the remaining components of your network environment following a crypto-ransomware event and assemble them into an operational system.

Progent's ransomware team of experts deploys top notch project management systems to coordinate the sophisticated restoration process. Progent appreciates the urgency of acting swiftly and in concert with a client's management and Information Technology staff to assign priority to tasks and to put essential services back on line as fast as humanly possible.

Client Story: A Successful Crypto-Ransomware Virus Response
A small business engaged Progent after their organization was brought down by the Ryuk ransomware virus. Ryuk is thought to have been created by North Korean government sponsored criminal gangs, suspected of adopting algorithms leaked from the United States NSA organization. Ryuk seeks specific companies with limited ability to sustain operational disruption and is one of the most lucrative versions of ransomware malware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer located in Chicago and has about 500 employees. The Ryuk event had brought down all business operations and manufacturing processes. Most of the client's backups had been directly accessible at the start of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom demand (exceeding $200K) and wishfully thinking for good luck, but in the end utilized Progent.

Progent worked hand in hand the client to rapidly assess and prioritize the key elements that had to be addressed in order to restart business functions:

• Active Directory
• Exchange Server
• Financials/MRP

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then completed setup and hard drive recovery of essential systems. All Microsoft Exchange Server schema and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to collect non-encrypted OST data files (Microsoft Outlook Offline Folder Files) on various PCs and laptops in order to recover email information. A recent offline backup of the client's accounting/ERP software made them able to return these essential services back on-line. Although a large amount of work was left to recover fully from the Ryuk virus, critical services were restored rapidly:

During the next few weeks critical milestones in the recovery process were made in close collaboration between Progent engineers and the client:

• In-house web applications were restored with no loss of data.
• The MailStore Exchange Server with over four million historical messages was brought online and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory capabilities were completely functional.
• A new Palo Alto 850 security appliance was installed and configured.
• Most of the user workstations were operational.

Conclusion
A likely business disaster was dodged by dedicated professionals, a wide spectrum of technical expertise, and close collaboration. Although in retrospect the crypto-ransomware virus attack described here could have been identified and disabled with up-to-date security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and appropriate security procedures for information backup and applying software patches, the reality is that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware incursion, remember that Progent's roster of experts has substantial experience in crypto-ransomware virus defense, cleanup, and information systems disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Riverside
For ransomware system recovery consulting services in the Riverside area, phone Progent at 800-462-8800 or go to Contact Progent.