Ransomware Prevention and Restoration Consulting San Francisco

Crypto-Ransomware : Your Feared IT Nightmare
Ransomware has become an escalating cyber pandemic that represents an enterprise-level danger for businesses of all sizes poorly prepared for an assault. Multiple generations of crypto-ransomware such as Reveton, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for years and continue to inflict havoc. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as frequent unnamed viruses, not only encrypt online data but also infiltrate all accessible system backup. Files synchronized to the cloud can also be ransomed. In a vulnerable environment, it can make automatic recovery hopeless and effectively sets the datacenter back to square one.

Recovering programs and information following a crypto-ransomware outage becomes a race against the clock as the targeted organization struggles to contain, remove the virus, and restore mission-critical operations. Due to the fact that crypto-ransomware takes time to move laterally across a network, penetrations are frequently launched on weekends and holidays, when attacks may take more time to discover. This compounds the difficulty of promptly mobilizing and organizing a qualified response team.

Progent provides a variety of solutions for protecting San Francisco organizations from ransomware penetrations. These include team training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat defense to detect and quarantine zero-day malware assaults. Progent also provides the assistance of veteran crypto-ransomware recovery consultants with the talent and perseverance to restore a breached environment as urgently as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware event, even paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will provide the codes to decipher any of your data. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to setup from scratch the key components of your Information Technology environment. Without the availability of full information backups, this requires a wide complement of IT skills, professional team management, and the ability to work continuously until the job is finished.

For two decades, Progent has made available expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained top certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in accounting and ERP software solutions. This breadth of experience provides Progent the skills to quickly ascertain critical systems and re-organize the remaining pieces of your network system following a crypto-ransomware event and configure them into an operational network.

Progent's recovery team uses state-of-the-art project management tools to coordinate the complex restoration process. Progent knows the importance of working swiftly and together with a client's management and Information Technology team members to assign priority to tasks and to get critical systems back on-line as soon as possible.

Client Story: A Successful Crypto-Ransomware Penetration Restoration
A small business escalated to Progent after their organization was crashed by Ryuk ransomware. Ryuk is thought to have been created by North Korean government sponsored cybercriminals, suspected of adopting technology leaked from America's NSA organization. Ryuk targets specific organizations with limited ability to sustain operational disruption and is among the most lucrative versions of crypto-ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company located in the Chicago metro area with about 500 staff members. The Ryuk attack had frozen all business operations and manufacturing processes. Most of the client's system backups had been online at the beginning of the attack and were damaged. The client was evaluating paying the ransom demand (exceeding $200K) and hoping for good luck, but in the end reached out to Progent.

Progent worked with the client to quickly understand and prioritize the key systems that needed to be recovered to make it possible to restart company functions:

• Active Directory
• E-Mail
• MRP System

Within 2 days, Progent was able to recover Active Directory services to its pre-attack state. Progent then performed rebuilding and storage recovery on the most important applications. All Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to find intact OST files (Microsoft Outlook Off-Line Folder Files) on various workstations and laptops to recover mail messages. A not too old offline backup of the client's accounting/ERP systems made them able to recover these essential programs back on-line. Although significant work was left to recover fully from the Ryuk damage, the most important systems were returned to operations quickly:

During the following couple of weeks critical milestones in the restoration process were accomplished in close cooperation between Progent consultants and the customer:

• Self-hosted web sites were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server exceeding four million archived emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control modules were completely recovered.
• A new Palo Alto Networks 850 security appliance was set up.
• 90% of the user desktops were fully operational.

Conclusion
A likely company-ending disaster was dodged through the efforts of results-oriented experts, a wide array of knowledge, and tight teamwork. Although in analyzing the event afterwards the ransomware penetration described here would have been disabled with up-to-date cyber security systems and ISO/IEC 27001 best practices, user education, and appropriate incident response procedures for backup and applying software patches, the fact is that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, removal, and information systems recovery.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in San Francisco
For ransomware system restoration expertise in the San Francisco area, call Progent at 800-462-8800 or see Contact Progent.