Ransomware Filtering and Removal Solutions San Francisco

Crypto-Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a modern cyberplague that represents an existential danger for businesses of all sizes vulnerable to an attack. Multiple generations of ransomware such as Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for years and still cause havoc. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus daily as yet unnamed malware, not only perform encryption of on-line files but also infiltrate all available system backups. Data synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly architected environment, it can render any restoration useless and basically sets the entire system back to zero.

Retrieving applications and information following a crypto-ransomware outage becomes a sprint against the clock as the targeted business fights to contain, remove the crypto-ransomware, and resume business-critical activity. Due to the fact that ransomware takes time to replicate across a network, penetrations are frequently launched during nights and weekends, when penetrations typically take more time to identify. This multiplies the difficulty of promptly marshalling and organizing an experienced response team.

Progent makes available an assortment of services for protecting San Francisco organizations from ransomware events. Among these are team member education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat protection to discover and extinguish zero-day malware attacks. Progent also can provide the services of veteran crypto-ransomware recovery consultants with the skills and perseverance to restore a breached system as rapidly as possible.

Progent's Ransomware Restoration Help
Soon after a ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will provide the needed keys to decrypt any of your information. Kaspersky ascertained that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The fallback is to setup from scratch the mission-critical components of your IT environment. Without access to essential information backups, this requires a broad range of skill sets, professional team management, and the willingness to work non-stop until the task is finished.

For two decades, Progent has provided certified expert IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned top industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of experience gives Progent the skills to knowledgably identify necessary systems and integrate the remaining components of your computer network system after a ransomware penetration and configure them into an operational network.

Progent's ransomware team has powerful project management applications to orchestrate the complex recovery process. Progent appreciates the importance of working swiftly and in concert with a client's management and IT resources to prioritize tasks and to get the most important services back on-line as fast as humanly possible.

Client Case Study: A Successful Ransomware Virus Restoration
A small business contacted Progent after their network system was taken over by the Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean government sponsored hackers, possibly using strategies exposed from the United States NSA organization. Ryuk targets specific organizations with little tolerance for operational disruption and is among the most profitable instances of ransomware viruses. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company based in the Chicago metro area with about 500 staff members. The Ryuk event had paralyzed all company operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the beginning of the intrusion and were damaged. The client was actively seeking loans for paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but ultimately utilized Progent.

Progent worked hand in hand the client to quickly understand and prioritize the mission critical systems that needed to be recovered to make it possible to restart business operations:

• Windows Active Directory
• Microsoft Exchange
• MRP System

Within two days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then performed setup and storage recovery of the most important applications. All Exchange Server data and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to locate intact OST data files (Outlook Off-Line Data Files) on team PCs to recover mail information. A not too old off-line backup of the businesses financials/MRP systems made them able to return these essential applications back online for users. Although major work remained to recover completely from the Ryuk attack, critical services were recovered rapidly:

Over the next few weeks important milestones in the recovery process were accomplished through close collaboration between Progent engineers and the client:

• In-house web sites were returned to operation with no loss of information.
• The MailStore Server exceeding 4 million archived messages was spun up and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory Control modules were fully operational.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Ninety percent of the user workstations were operational.

Conclusion
A likely business-ending disaster was evaded through the efforts of dedicated professionals, a wide array of technical expertise, and tight collaboration. Although upon completion of forensics the crypto-ransomware incident described here could have been disabled with modern cyber security technology and best practices, user education, and properly executed security procedures for information backup and applying software patches, the reality remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware attack, remember that Progent's team of professionals has extensive experience in ransomware virus defense, removal, and data disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in San Francisco
For ransomware cleanup expertise in the San Francisco metro area, phone Progent at 800-462-8800 or visit Contact Progent.