Ransomware Defense and Removal Consulting Riverside

Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become a too-frequent cyberplague that represents an enterprise-level danger for businesses vulnerable to an assault. Versions of ransomware such as Reveton, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for years and continue to cause havoc. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus daily unnamed viruses, not only perform encryption of online data files but also infiltrate any accessible system restores and backups. Information synched to off-premises disaster recovery sites can also be corrupted. In a vulnerable data protection solution, this can render any recovery useless and effectively sets the network back to zero.

Restoring programs and data after a crypto-ransomware intrusion becomes a sprint against the clock as the targeted organization struggles to contain the damage, cleanup the ransomware, and resume mission-critical activity. Because ransomware takes time to move laterally across a network, assaults are usually launched on weekends, when successful attacks tend to take more time to uncover. This compounds the difficulty of quickly mobilizing and coordinating a qualified mitigation team.

Progent has a range of solutions for securing Riverside organizations from crypto-ransomware events. Among these are user education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to detect and disable zero-day modern malware attacks. Progent also can provide the services of expert crypto-ransomware recovery consultants with the talent and perseverance to reconstruct a compromised system as urgently as possible.

Progent's Ransomware Recovery Support Services
Following a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will return the codes to decrypt any or all of your files. Kaspersky ascertained that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to setup from scratch the critical components of your Information Technology environment. Without the availability of full information backups, this requires a wide range of IT skills, professional team management, and the capability to work 24x7 until the job is complete.

For two decades, Progent has provided professional IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have earned advanced certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial management and ERP application software. This breadth of expertise provides Progent the ability to efficiently determine necessary systems and re-organize the remaining components of your Information Technology environment after a crypto-ransomware attack and configure them into a functioning network.

Progent's security team of experts deploys state-of-the-art project management tools to orchestrate the sophisticated restoration process. Progent knows the importance of acting rapidly and in concert with a client's management and IT resources to prioritize tasks and to put the most important services back online as fast as humanly possible.

Case Study: A Successful Ransomware Attack Recovery
A client hired Progent after their organization was brought down by Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean government sponsored criminal gangs, suspected of using technology exposed from the U.S. National Security Agency. Ryuk goes after specific companies with little tolerance for disruption and is among the most lucrative instances of ransomware. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturer located in Chicago and has about 500 employees. The Ryuk intrusion had frozen all essential operations and manufacturing processes. The majority of the client's data backups had been on-line at the start of the intrusion and were encrypted. The client considered paying the ransom (more than $200,000) and praying for the best, but ultimately utilized Progent.

Progent worked with the client to rapidly identify and prioritize the most important areas that had to be recovered in order to continue business functions:

• Windows Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to re-build Windows Active Directory to its pre-intrusion state. Progent then charged ahead with reinstallations and hard drive recovery on critical servers. All Exchange data and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to collect local OST data files (Outlook Offline Folder Files) on user workstations to recover email information. A recent offline backup of the customer's financials/MRP systems made it possible to restore these vital applications back online. Although a large amount of work was left to recover totally from the Ryuk event, core services were recovered rapidly:

Over the following couple of weeks key milestones in the recovery project were achieved in tight cooperation between Progent engineers and the client:

• Self-hosted web sites were restored without losing any information.
• The MailStore Server containing more than 4 million archived emails was brought on-line and available for users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control modules were fully restored.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Nearly all of the user workstations were fully operational.

Conclusion
A potential business extinction catastrophe was avoided with results-oriented professionals, a broad array of IT skills, and tight teamwork. Although upon completion of forensics the ransomware penetration described here could have been prevented with up-to-date cyber security technology solutions and recognized best practices, user training, and well designed security procedures for backup and keeping systems up to date with security patches, the reality is that government-sponsored hackers from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware incident, feel confident that Progent's roster of experts has extensive experience in crypto-ransomware virus defense, remediation, and file disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Riverside
For ransomware system recovery consulting services in the Riverside metro area, call Progent at 800-462-8800 or visit Contact Progent.