Ransomware Filtering and Cleanup Expertise Appleton

Ransomware : Your Worst IT Catastrophe
Ransomware has become a modern cyber pandemic that represents an extinction-level danger for organizations vulnerable to an attack. Multiple generations of ransomware like the CrySIS, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for many years and still cause harm. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, plus additional as yet unnamed newcomers, not only encrypt online information but also infect all available system protection mechanisms. Information synched to cloud environments can also be ransomed. In a poorly architected data protection solution, it can make automated restore operations useless and effectively knocks the datacenter back to square one.

Restoring services and information following a ransomware intrusion becomes a sprint against time as the targeted business struggles to contain, remove the crypto-ransomware, and restore mission-critical operations. Because ransomware needs time to replicate throughout a network, penetrations are frequently sprung on weekends and holidays, when successful penetrations in many cases take longer to detect. This compounds the difficulty of quickly marshalling and organizing a qualified mitigation team.

Progent provides a variety of support services for protecting Appleton businesses from ransomware penetrations. Among these are user training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to discover and disable day-zero malware attacks. Progent also can provide the services of experienced ransomware recovery consultants with the track record and perseverance to restore a breached environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Services
After a crypto-ransomware invasion, paying the ransom demands in cryptocurrency does not ensure that cyber criminals will provide the needed keys to decipher any of your files. Kaspersky Labs determined that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to setup from scratch the vital parts of your Information Technology environment. Absent access to complete information backups, this requires a wide range of skills, professional team management, and the willingness to work 24x7 until the recovery project is completed.

For decades, Progent has offered certified expert Information Technology services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have garnered internationally-renowned certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in accounting and ERP application software. This breadth of experience affords Progent the skills to quickly ascertain critical systems and integrate the surviving parts of your IT environment following a ransomware penetration and rebuild them into an operational network.

Progent's recovery group uses state-of-the-art project management systems to coordinate the complicated restoration process. Progent understands the importance of working rapidly and in concert with a client's management and Information Technology staff to prioritize tasks and to get essential applications back on line as fast as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Virus Restoration
A small business hired Progent after their company was crashed by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state cybercriminals, possibly using algorithms exposed from America's National Security Agency. Ryuk goes after specific organizations with limited room for operational disruption and is among the most lucrative incarnations of crypto-ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company based in the Chicago metro area with about 500 workers. The Ryuk penetration had frozen all essential operations and manufacturing capabilities. Most of the client's data backups had been online at the start of the attack and were damaged. The client was evaluating paying the ransom (more than two hundred thousand dollars) and hoping for the best, but ultimately made the decision to use Progent.

Progent worked with the customer to quickly get our arms around and prioritize the key services that had to be restored to make it possible to continue company operations:

• Microsoft Active Directory
• Exchange Server
• MRP System

Within 2 days, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then accomplished reinstallations and storage recovery of the most important systems. All Microsoft Exchange Server schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to assemble local OST data files (Outlook Offline Folder Files) on team PCs in order to recover email data. A not too old offline backup of the businesses manufacturing systems made them able to return these vital applications back available to users. Although major work needed to be completed to recover fully from the Ryuk virus, essential services were returned to operations rapidly:

Throughout the next month critical milestones in the restoration process were completed in tight collaboration between Progent team members and the client:

• Internal web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million archived emails was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory functions were 100 percent restored.
• A new Palo Alto Networks 850 firewall was deployed.
• Most of the user desktops were functioning as before the incident.

Conclusion
A possible business extinction catastrophe was evaded through the efforts of hard-working professionals, a broad spectrum of IT skills, and close teamwork. Although in retrospect the ransomware virus attack detailed here could have been stopped with up-to-date security solutions and security best practices, user and IT administrator training, and well thought out incident response procedures for data backup and proper patching controls, the fact is that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware virus, feel confident that Progent's team of experts has a proven track record in ransomware virus blocking, cleanup, and file disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Appleton
For ransomware recovery expertise in the Appleton area, phone Progent at 800-462-8800 or go to Contact Progent.