Ransomware Filtering and Cleanup Expertise Calgary

Ransomware : Your Feared IT Nightmare
Crypto-Ransomware has become an escalating cyberplague that presents an existential danger for businesses of all sizes vulnerable to an assault. Versions of crypto-ransomware such as CrySIS, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for years and still inflict harm. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, as well as additional unnamed newcomers, not only encrypt on-line data but also infiltrate most accessible system backup. Data synchronized to off-premises disaster recovery sites can also be rendered useless. In a vulnerable environment, this can make automatic recovery useless and effectively knocks the entire system back to square one.

Retrieving applications and data following a ransomware event becomes a sprint against time as the targeted organization tries its best to stop lateral movement, cleanup the ransomware, and resume business-critical operations. Because ransomware needs time to replicate across a network, assaults are usually launched at night, when successful penetrations in many cases take longer to notice. This compounds the difficulty of promptly assembling and orchestrating a capable mitigation team.

Progent has a range of support services for protecting Calgary enterprises from crypto-ransomware events. These include team member training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat defense to discover and disable zero-day modern malware assaults. Progent also can provide the assistance of veteran ransomware recovery professionals with the talent and commitment to re-deploy a compromised network as soon as possible.

Progent's Ransomware Restoration Services
After a ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that distant criminals will return the needed keys to decrypt any of your information. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their information even after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to re-install the vital elements of your IT environment. Absent access to complete information backups, this calls for a wide complement of skills, professional team management, and the capability to work 24x7 until the recovery project is finished.

For twenty years, Progent has made available expert IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned high-level industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with accounting and ERP applications. This breadth of experience affords Progent the skills to rapidly identify important systems and integrate the remaining components of your Information Technology environment following a crypto-ransomware penetration and configure them into an operational system.

Progent's ransomware team of experts has state-of-the-art project management applications to coordinate the complex recovery process. Progent appreciates the importance of acting swiftly and in concert with a client's management and IT team members to assign priority to tasks and to get essential services back online as fast as humanly possible.

Client Story: A Successful Ransomware Intrusion Recovery
A small business contacted Progent after their network was attacked by Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean state sponsored hackers, suspected of adopting approaches exposed from the United States National Security Agency. Ryuk goes after specific companies with limited ability to sustain operational disruption and is one of the most lucrative versions of ransomware viruses. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in the Chicago metro area with around 500 employees. The Ryuk penetration had shut down all essential operations and manufacturing capabilities. Most of the client's data protection had been online at the time of the intrusion and were damaged. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but ultimately called Progent.

Progent worked with the customer to rapidly understand and prioritize the essential services that needed to be restored in order to restart company functions:

• Active Directory (AD)
• Exchange Server
• Financials/MRP

Within two days, Progent was able to restore Active Directory to its pre-attack state. Progent then initiated reinstallations and storage recovery on the most important servers. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was able to collect local OST files (Outlook Off-Line Folder Files) on various PCs and laptops to recover email messages. A not too old offline backup of the customer's manufacturing systems made it possible to restore these vital programs back available to users. Although major work needed to be completed to recover fully from the Ryuk damage, the most important systems were recovered quickly:

Throughout the next couple of weeks key milestones in the restoration process were completed in tight cooperation between Progent consultants and the client:

• In-house web applications were restored without losing any information.
• The MailStore Server exceeding 4 million archived messages was brought online and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/AR/Inventory Control modules were fully recovered.
• A new Palo Alto 850 firewall was brought on-line.
• Ninety percent of the desktop computers were operational.

Conclusion
A probable enterprise-killing disaster was averted due to hard-working experts, a broad range of subject matter expertise, and close collaboration. Although in analyzing the event afterwards the ransomware attack described here would have been identified and blocked with current security technology and security best practices, team training, and well thought out security procedures for data protection and proper patching controls, the reality remains that state-sponsored cyber criminals from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware virus, feel confident that Progent's team of experts has substantial experience in crypto-ransomware virus blocking, cleanup, and data recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Calgary
For ransomware recovery services in the Calgary metro area, call Progent at 800-462-8800 or go to Contact Progent.