Ransomware Filtering and Remediation Expertise Santa Rosa

Ransomware : Your Worst Information Technology Disaster
Ransomware has become a modern cyberplague that poses an extinction-level threat for organizations vulnerable to an attack. Different iterations of crypto-ransomware like the CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for years and continue to cause damage. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus frequent unnamed newcomers, not only perform encryption of on-line critical data but also infiltrate any accessible system backups. Information synched to cloud environments can also be ransomed. In a vulnerable environment, it can make automatic restoration useless and basically knocks the datacenter back to zero.

Getting back online applications and information after a ransomware intrusion becomes a race against the clock as the victim tries its best to stop the spread, eradicate the ransomware, and restore mission-critical activity. Because ransomware needs time to move laterally across a targeted network, assaults are usually sprung at night, when penetrations are likely to take longer to uncover. This multiplies the difficulty of quickly mobilizing and organizing a qualified mitigation team.

Progent makes available a variety of solutions for securing Santa Rosa organizations from ransomware penetrations. These include team member training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to identify and quarantine zero-day modern malware assaults. Progent also provides the services of expert ransomware recovery consultants with the skills and perseverance to reconstruct a breached system as urgently as possible.

Progent's Crypto-Ransomware Restoration Support Services
Subsequent to a crypto-ransomware event, paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will respond with the codes to decipher any of your data. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to piece back together the critical parts of your IT environment. Absent the availability of full data backups, this calls for a wide range of skill sets, professional project management, and the capability to work continuously until the recovery project is complete.

For decades, Progent has made available certified expert Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have earned top certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of expertise provides Progent the capability to quickly determine important systems and consolidate the surviving components of your IT system after a crypto-ransomware penetration and assemble them into an operational network.

Progent's ransomware team deploys state-of-the-art project management applications to orchestrate the complicated recovery process. Progent knows the importance of working swiftly and in unison with a customer's management and IT staff to assign priority to tasks and to get key services back on line as soon as possible.

Customer Story: A Successful Crypto-Ransomware Intrusion Response
A business sought out Progent after their network system was brought down by Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean government sponsored cybercriminals, possibly using techniques leaked from the United States National Security Agency. Ryuk goes after specific businesses with little or no ability to sustain operational disruption and is one of the most lucrative instances of ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in the Chicago metro area with about 500 workers. The Ryuk event had frozen all essential operations and manufacturing processes. The majority of the client's data backups had been online at the start of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (in excess of $200,000) and hoping for good luck, but ultimately brought in Progent.

Progent worked with the client to quickly understand and assign priority to the essential applications that had to be restored to make it possible to continue company functions:

• Active Directory (AD)
• E-Mail
• Accounting/MRP

In less than two days, Progent was able to recover Active Directory to its pre-intrusion state. Progent then accomplished rebuilding and hard drive recovery of needed applications. All Exchange schema and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to locate intact OST files (Microsoft Outlook Off-Line Folder Files) on user PCs and laptops in order to recover mail data. A recent off-line backup of the businesses accounting/MRP software made it possible to return these required programs back online for users. Although major work remained to recover fully from the Ryuk attack, critical systems were returned to operations quickly:

During the next couple of weeks important milestones in the restoration project were completed in tight cooperation between Progent team members and the customer:

• In-house web sites were restored without losing any data.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory functions were 100 percent recovered.
• A new Palo Alto 850 firewall was brought online.
• Ninety percent of the desktops and laptops were operational.

Conclusion
A potential company-ending catastrophe was avoided with dedicated experts, a broad range of knowledge, and tight collaboration. Although in retrospect the crypto-ransomware penetration described here should have been disabled with advanced cyber security systems and NIST Cybersecurity Framework best practices, team education, and well thought out security procedures for information backup and proper patching controls, the fact is that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware incursion, feel confident that Progent's roster of professionals has proven experience in ransomware virus blocking, removal, and file disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Santa Rosa
For ransomware system recovery consulting in the Santa Rosa metro area, call Progent at 800-462-8800 or go to Contact Progent.