Ransomware Prevention and Removal Consulting West Palm Beach

Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become an escalating cyberplague that poses an existential threat for organizations poorly prepared for an assault. Different versions of ransomware such as CryptoLocker, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and continue to cause destruction. More recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, plus additional unnamed newcomers, not only perform encryption of online data files but also infiltrate many configured system backups. Information replicated to the cloud can also be encrypted. In a vulnerable environment, this can render any restore operations impossible and basically knocks the datacenter back to square one.

Retrieving programs and data after a ransomware intrusion becomes a sprint against time as the victim tries its best to contain the damage, cleanup the ransomware, and restore mission-critical activity. Due to the fact that crypto-ransomware takes time to move laterally across a network, assaults are frequently launched on weekends, when successful attacks may take more time to identify. This compounds the difficulty of quickly mobilizing and coordinating a knowledgeable response team.

Progent has an assortment of help services for protecting West Palm Beach enterprises from ransomware events. Among these are team training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to identify and disable zero-day modern malware attacks. Progent also provides the services of experienced ransomware recovery professionals with the skills and commitment to re-deploy a compromised system as soon as possible.

Progent's Ransomware Recovery Services
Soon after a ransomware attack, sending the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will return the needed codes to decipher any or all of your files. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their information even after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to piece back together the key elements of your IT environment. Without the availability of full data backups, this requires a wide range of skill sets, top notch project management, and the capability to work continuously until the job is done.

For twenty years, Progent has offered professional Information Technology services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained advanced certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of expertise affords Progent the capability to efficiently identify necessary systems and re-organize the remaining components of your network system following a crypto-ransomware event and assemble them into a functioning network.

Progent's ransomware group has top notch project management systems to coordinate the complex restoration process. Progent understands the importance of acting rapidly and in concert with a customer's management and IT team members to prioritize tasks and to get key applications back on-line as soon as possible.

Case Study: A Successful Crypto-Ransomware Penetration Restoration
A small business sought out Progent after their network was crashed by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state criminal gangs, possibly adopting techniques exposed from the U.S. NSA organization. Ryuk attacks specific companies with little or no ability to sustain disruption and is among the most lucrative instances of ransomware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in the Chicago metro area and has around 500 workers. The Ryuk event had disabled all business operations and manufacturing capabilities. Most of the client's information backups had been on-line at the beginning of the intrusion and were destroyed. The client was taking steps for paying the ransom (exceeding $200K) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked together with the client to quickly get our arms around and prioritize the critical applications that had to be restored to make it possible to restart business operations:

• Windows Active Directory
• Microsoft Exchange
• Financials/MRP

In less than two days, Progent was able to recover Active Directory to its pre-virus state. Progent then initiated rebuilding and storage recovery on needed servers. All Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to find intact OST data files (Outlook Offline Folder Files) on various PCs and laptops to recover mail messages. A recent offline backup of the businesses financials/MRP software made them able to return these required programs back online. Although significant work was left to recover completely from the Ryuk attack, essential services were restored rapidly:

During the next couple of weeks critical milestones in the restoration project were accomplished in tight collaboration between Progent engineers and the customer:

• Internal web sites were returned to operation without losing any data.
• The MailStore Server containing more than four million archived messages was spun up and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory capabilities were completely operational.
• A new Palo Alto Networks 850 firewall was brought online.
• Ninety percent of the desktops and laptops were fully operational.

Conclusion
A potential business-killing catastrophe was averted through the efforts of hard-working experts, a broad spectrum of technical expertise, and tight collaboration. Although upon completion of forensics the crypto-ransomware virus penetration described here should have been identified and disabled with up-to-date security solutions and NIST Cybersecurity Framework best practices, user training, and properly executed incident response procedures for information protection and proper patching controls, the reality is that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware incursion, remember that Progent's roster of experts has proven experience in ransomware virus defense, cleanup, and file disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in West Palm Beach
For ransomware system restoration services in the West Palm Beach area, call Progent at 800-462-8800 or go to Contact Progent.