Ransomware Defense and Cleanup Expertise Tampa

Ransomware : Your Crippling IT Nightmare
Ransomware has become a modern cyber pandemic that presents an extinction-level danger for organizations unprepared for an attack. Different iterations of crypto-ransomware like the CryptoLocker, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been circulating for a long time and still cause havoc. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus additional as yet unnamed newcomers, not only perform encryption of online data but also infiltrate many accessible system backups. Files replicated to the cloud can also be corrupted. In a poorly designed system, it can render automated restoration useless and basically sets the entire system back to square one.

Getting back online applications and data after a ransomware attack becomes a sprint against time as the targeted business struggles to contain, cleanup the ransomware, and restore business-critical operations. Because ransomware needs time to replicate throughout a targeted network, penetrations are frequently launched during nights and weekends, when attacks are likely to take more time to identify. This multiplies the difficulty of quickly marshalling and orchestrating a qualified mitigation team.

Progent provides a range of support services for protecting Tampa enterprises from ransomware penetrations. These include team training to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to identify and disable day-zero malware assaults. Progent also provides the services of expert crypto-ransomware recovery engineers with the skills and perseverance to restore a compromised network as quickly as possible.

Progent's Crypto-Ransomware Restoration Services
Following a crypto-ransomware penetration, sending the ransom in cryptocurrency does not provide any assurance that cyber criminals will provide the keys to decipher any of your information. Kaspersky Labs determined that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The other path is to setup from scratch the critical elements of your IT environment. Absent the availability of full information backups, this calls for a wide range of skills, professional team management, and the willingness to work 24x7 until the recovery project is complete.

For decades, Progent has provided professional Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained top industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of expertise gives Progent the ability to rapidly understand critical systems and organize the surviving components of your Information Technology system after a ransomware attack and configure them into a functioning system.

Progent's recovery team of experts uses state-of-the-art project management tools to orchestrate the complicated restoration process. Progent appreciates the urgency of acting swiftly and together with a client's management and IT team members to assign priority to tasks and to get essential services back on-line as fast as possible.

Client Case Study: A Successful Crypto-Ransomware Virus Response
A business sought out Progent after their network was crashed by Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state sponsored criminal gangs, possibly using technology leaked from the United States National Security Agency. Ryuk goes after specific organizations with little tolerance for operational disruption and is one of the most profitable incarnations of ransomware viruses. Major victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in Chicago and has about 500 employees. The Ryuk penetration had paralyzed all essential operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the start of the attack and were destroyed. The client was pursuing financing for paying the ransom demand (exceeding $200K) and wishfully thinking for good luck, but in the end utilized Progent.

Progent worked with the client to rapidly get our arms around and assign priority to the critical services that had to be recovered in order to restart departmental functions:

• Windows Active Directory
• Exchange Server
• Accounting and Manufacturing Software

Within two days, Progent was able to restore Active Directory services to its pre-virus state. Progent then accomplished reinstallations and storage recovery of essential servers. All Microsoft Exchange Server ties and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to locate intact OST files (Outlook Offline Folder Files) on user PCs to recover email information. A not too old off-line backup of the client's accounting/MRP software made them able to return these vital services back available to users. Although a lot of work still had to be done to recover completely from the Ryuk virus, the most important services were restored quickly:

Throughout the following month critical milestones in the restoration project were accomplished in close cooperation between Progent engineers and the client:

• Self-hosted web applications were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was spun up and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/AR/Inventory Control capabilities were 100 percent operational.
• A new Palo Alto Networks 850 security appliance was deployed.
• Most of the desktop computers were operational.

Conclusion
A likely business extinction catastrophe was evaded due to dedicated professionals, a broad range of subject matter expertise, and tight teamwork. Although in hindsight the ransomware attack detailed here should have been prevented with current cyber security technology solutions and best practices, user and IT administrator education, and properly executed security procedures for information backup and keeping systems up to date with security patches, the fact is that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's team of experts has substantial experience in ransomware virus blocking, mitigation, and data disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Tampa
For ransomware system restoration expertise in the Tampa area, call Progent at 800-462-8800 or go to Contact Progent.