Ransomware Defense and Cleanup Consulting St. Louis

Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become an escalating cyberplague that presents an existential threat for businesses vulnerable to an assault. Different versions of ransomware such as CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for a long time and still inflict destruction. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus daily unnamed viruses, not only encrypt on-line information but also infiltrate most configured system protection mechanisms. Data synched to off-premises disaster recovery sites can also be ransomed. In a vulnerable data protection solution, it can render any restore operations impossible and basically sets the datacenter back to square one.

Getting back on-line programs and data following a ransomware attack becomes a race against time as the victim struggles to stop lateral movement, clear the ransomware, and resume mission-critical operations. Due to the fact that ransomware takes time to move laterally across a targeted network, assaults are usually sprung on weekends and holidays, when penetrations in many cases take more time to recognize. This multiplies the difficulty of rapidly assembling and organizing a capable response team.

Progent has a range of services for securing St. Louis enterprises from ransomware events. These include team member education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to discover and quarantine day-zero modern malware attacks. Progent in addition can provide the assistance of seasoned crypto-ransomware recovery consultants with the skills and commitment to rebuild a breached environment as quickly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a ransomware invasion, even paying the ransom in cryptocurrency does not ensure that criminal gangs will provide the codes to decipher any or all of your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their data after having paid the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to re-install the mission-critical elements of your IT environment. Without access to full data backups, this requires a wide complement of IT skills, top notch team management, and the willingness to work continuously until the task is complete.

For twenty years, Progent has made available professional IT services for companies throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have been awarded advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial management and ERP software solutions. This breadth of experience affords Progent the ability to quickly understand important systems and organize the surviving components of your IT environment after a crypto-ransomware attack and configure them into a functioning system.

Progent's ransomware team of experts uses powerful project management applications to orchestrate the complicated restoration process. Progent understands the importance of acting swiftly and together with a customer's management and Information Technology staff to prioritize tasks and to get key systems back online as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Intrusion Response
A customer hired Progent after their network was brought down by the Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean state criminal gangs, possibly using algorithms leaked from the United States National Security Agency. Ryuk attacks specific organizations with little or no ability to sustain operational disruption and is among the most profitable examples of ransomware viruses. Headline victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in the Chicago metro area with about 500 workers. The Ryuk intrusion had frozen all essential operations and manufacturing processes. Most of the client's data protection had been online at the start of the attack and were damaged. The client was pursuing financing for paying the ransom (exceeding $200,000) and praying for the best, but ultimately reached out to Progent.

Progent worked together with the customer to quickly understand and prioritize the mission critical services that had to be recovered to make it possible to restart company operations:

• Active Directory
• Microsoft Exchange Email
• MRP System

Within two days, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then initiated reinstallations and storage recovery of needed systems. All Microsoft Exchange Server ties and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to find local OST data files (Microsoft Outlook Offline Data Files) on user desktop computers and laptops to recover email information. A not too old offline backup of the businesses manufacturing systems made them able to return these essential services back online. Although a large amount of work still had to be done to recover completely from the Ryuk event, critical systems were returned to operations rapidly:

During the next month critical milestones in the recovery process were made in tight collaboration between Progent team members and the customer:

• Internal web sites were restored with no loss of information.
• The MailStore Server with over four million historical emails was brought online and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory modules were completely operational.
• A new Palo Alto 850 security appliance was brought on-line.
• Nearly all of the user desktops were being used by staff.

Conclusion
A possible business-killing catastrophe was evaded by results-oriented experts, a broad spectrum of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware virus penetration described here should have been blocked with advanced cyber security solutions and recognized best practices, staff education, and well designed incident response procedures for data protection and proper patching controls, the fact remains that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware virus, feel confident that Progent's team of professionals has substantial experience in crypto-ransomware virus defense, remediation, and data restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in St. Louis
For ransomware cleanup consulting services in the St. Louis area, call Progent at 800-462-8800 or go to Contact Progent.