Ransomware Defense and Restoration Consulting Shreveport

Crypto-Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyberplague that poses an enterprise-level danger for organizations unprepared for an attack. Different iterations of ransomware such as CryptoLocker, Fusob, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and still inflict damage. Modern strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, plus daily unnamed newcomers, not only encrypt on-line files but also infiltrate most available system protection mechanisms. Files synchronized to the cloud can also be rendered useless. In a poorly designed system, this can render automatic recovery impossible and basically knocks the network back to zero.

Restoring services and information after a ransomware outage becomes a race against the clock as the targeted business struggles to stop lateral movement, eradicate the virus, and resume business-critical activity. Because ransomware requires time to spread throughout a targeted network, assaults are frequently launched during nights and weekends, when penetrations tend to take longer to uncover. This compounds the difficulty of rapidly marshalling and organizing a capable mitigation team.

Progent makes available a range of solutions for securing Shreveport organizations from ransomware attacks. These include staff training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to detect and disable day-zero modern malware assaults. Progent in addition provides the services of veteran ransomware recovery professionals with the track record and perseverance to rebuild a compromised system as urgently as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a ransomware event, paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will provide the needed codes to decipher any of your data. Kaspersky ascertained that 17% of crypto-ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The other path is to setup from scratch the essential components of your Information Technology environment. Absent the availability of complete information backups, this calls for a broad complement of skill sets, top notch project management, and the capability to work 24x7 until the recovery project is done.

For decades, Progent has made available certified expert Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained advanced industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of expertise affords Progent the capability to quickly determine necessary systems and re-organize the remaining components of your Information Technology system after a ransomware penetration and rebuild them into a functioning network.

Progent's ransomware group deploys state-of-the-art project management applications to coordinate the complex recovery process. Progent knows the urgency of acting swiftly and in concert with a client's management and Information Technology team members to assign priority to tasks and to put essential systems back on line as fast as possible.

Case Study: A Successful Ransomware Penetration Restoration
A business escalated to Progent after their network was attacked by Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored cybercriminals, possibly using technology leaked from the United States NSA organization. Ryuk seeks specific businesses with limited room for disruption and is one of the most lucrative iterations of ransomware malware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturer based in Chicago and has about 500 employees. The Ryuk intrusion had shut down all business operations and manufacturing capabilities. The majority of the client's backups had been on-line at the time of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but in the end made the decision to use Progent.

Progent worked hand in hand the client to quickly determine and assign priority to the most important elements that had to be restored to make it possible to resume departmental functions:

• Microsoft Active Directory
• E-Mail
• MRP System

In less than two days, Progent was able to recover Active Directory services to its pre-virus state. Progent then initiated reinstallations and storage recovery of critical servers. All Microsoft Exchange Server ties and attributes were intact, which accelerated the restore of Exchange. Progent was able to locate local OST files (Outlook Email Offline Data Files) on team PCs and laptops to recover email messages. A recent offline backup of the customer's manufacturing systems made them able to return these required programs back available to users. Although major work still had to be done to recover completely from the Ryuk attack, the most important systems were returned to operations quickly:

Over the next month important milestones in the recovery project were accomplished in close collaboration between Progent team members and the client:

• Self-hosted web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than 4 million historical messages was brought online and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control capabilities were completely operational.
• A new Palo Alto 850 security appliance was set up and programmed.
• Most of the user desktops were operational.

Conclusion
A potential business-killing catastrophe was evaded through the efforts of results-oriented experts, a broad range of subject matter expertise, and close teamwork. Although in post mortem the ransomware attack described here should have been disabled with advanced cyber security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and appropriate security procedures for data protection and proper patching controls, the reality remains that government-sponsored cyber criminals from China, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware attack, remember that Progent's team of professionals has proven experience in crypto-ransomware virus blocking, mitigation, and file disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Shreveport
For ransomware recovery services in the Shreveport area, phone Progent at 800-462-8800 or see Contact Progent.