Ransomware Defense and Cleanup Consulting St. Paul

Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level danger for organizations poorly prepared for an assault. Multiple generations of crypto-ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for many years and continue to cause havoc. Modern strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus more unnamed newcomers, not only perform encryption of online data files but also infect any configured system protection. Information synched to the cloud can also be ransomed. In a poorly architected system, it can render any restoration impossible and basically knocks the entire system back to square one.

Getting back on-line programs and data after a crypto-ransomware event becomes a race against the clock as the targeted business fights to stop the spread, remove the ransomware, and restore enterprise-critical activity. Since crypto-ransomware requires time to move laterally across a network, attacks are often sprung on weekends and holidays, when successful penetrations are likely to take longer to notice. This compounds the difficulty of promptly assembling and organizing a qualified response team.

Progent makes available an assortment of services for securing St. Paul enterprises from crypto-ransomware penetrations. These include user education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to discover and quarantine day-zero malware assaults. Progent also offers the services of seasoned ransomware recovery engineers with the talent and perseverance to reconstruct a breached system as soon as possible.

Progent's Ransomware Recovery Support Services
Soon after a ransomware invasion, sending the ransom in cryptocurrency does not ensure that cyber criminals will provide the needed codes to decrypt any of your files. Kaspersky determined that 17% of crypto-ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The fallback is to setup from scratch the essential elements of your IT environment. Absent access to full data backups, this requires a broad complement of IT skills, professional team management, and the ability to work non-stop until the recovery project is done.

For decades, Progent has made available expert IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded high-level certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP applications. This breadth of expertise gives Progent the skills to knowledgably determine necessary systems and consolidate the surviving pieces of your network system following a crypto-ransomware event and configure them into an operational network.

Progent's recovery team of experts uses best of breed project management applications to orchestrate the complex restoration process. Progent appreciates the urgency of acting swiftly and together with a client's management and IT team members to prioritize tasks and to put key services back online as soon as humanly possible.

Client Story: A Successful Ransomware Virus Response
A client sought out Progent after their network system was attacked by Ryuk ransomware. Ryuk is thought to have been launched by North Korean government sponsored criminal gangs, possibly adopting approaches leaked from America's National Security Agency. Ryuk targets specific organizations with little ability to sustain disruption and is one of the most lucrative instances of ransomware viruses. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in Chicago and has around 500 workers. The Ryuk penetration had disabled all business operations and manufacturing processes. Most of the client's backups had been online at the start of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom (more than $200K) and wishfully thinking for good luck, but ultimately made the decision to use Progent.

Progent worked together with the customer to rapidly assess and assign priority to the essential elements that had to be recovered to make it possible to resume company functions:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to restore Active Directory to its pre-intrusion state. Progent then initiated setup and hard drive recovery on key applications. All Exchange Server data and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to assemble intact OST data files (Outlook Off-Line Folder Files) on team desktop computers and laptops in order to recover mail messages. A recent offline backup of the client's accounting/ERP systems made them able to restore these required services back available to users. Although significant work remained to recover totally from the Ryuk damage, the most important services were restored rapidly:

Throughout the following couple of weeks important milestones in the recovery process were accomplished through tight cooperation between Progent team members and the customer:

• In-house web applications were returned to operation with no loss of information.
• The MailStore Server with over 4 million historical messages was brought online and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory capabilities were fully operational.
• A new Palo Alto 850 security appliance was installed.
• Nearly all of the desktops and laptops were fully operational.

Conclusion
A likely company-ending catastrophe was avoided due to hard-working professionals, a broad range of IT skills, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware attack described here could have been identified and prevented with current cyber security solutions and recognized best practices, team education, and properly executed incident response procedures for data backup and keeping systems up to date with security patches, the reality remains that state-sponsored hackers from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware incident, feel confident that Progent's team of professionals has substantial experience in ransomware virus defense, cleanup, and data disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in St. Paul
For ransomware system restoration consulting services in the St. Paul area, phone Progent at 800-462-8800 or visit Contact Progent.