Ransomware Protection and Removal Expertise Albany

Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a modern cyberplague that poses an extinction-level threat for businesses of all sizes poorly prepared for an assault. Multiple generations of ransomware like the Reveton, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been circulating for a long time and continue to inflict destruction. Modern variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus daily unnamed viruses, not only perform encryption of on-line data files but also infect all configured system protection. Files replicated to cloud environments can also be ransomed. In a vulnerable system, this can make automated recovery impossible and basically knocks the network back to zero.

Retrieving programs and data after a ransomware intrusion becomes a race against the clock as the targeted business fights to contain the damage, eradicate the crypto-ransomware, and restore business-critical operations. Since ransomware requires time to replicate across a targeted network, assaults are frequently launched during nights and weekends, when successful penetrations in many cases take more time to discover. This multiplies the difficulty of rapidly mobilizing and coordinating a knowledgeable response team.

Progent offers a range of help services for securing Albany organizations from ransomware penetrations. Among these are staff education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to discover and suppress day-zero malware assaults. Progent also can provide the assistance of seasoned ransomware recovery engineers with the talent and perseverance to re-deploy a breached network as urgently as possible.

Progent's Ransomware Restoration Support Services
Following a ransomware penetration, paying the ransom in cryptocurrency does not ensure that cyber criminals will provide the needed codes to unencrypt any of your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their files even after having paid the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to re-install the critical parts of your Information Technology environment. Absent the availability of essential information backups, this requires a broad complement of skills, top notch project management, and the ability to work 24x7 until the recovery project is finished.

For decades, Progent has made available professional Information Technology services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained high-level industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with accounting and ERP software solutions. This breadth of expertise affords Progent the capability to rapidly understand critical systems and re-organize the remaining parts of your computer network environment after a crypto-ransomware penetration and assemble them into an operational network.

Progent's ransomware team uses top notch project management tools to coordinate the complex recovery process. Progent understands the importance of acting quickly and in concert with a client's management and Information Technology team members to assign priority to tasks and to put critical systems back on-line as fast as humanly possible.

Client Case Study: A Successful Ransomware Attack Restoration
A business contacted Progent after their organization was taken over by Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state sponsored criminal gangs, possibly adopting strategies exposed from America's NSA organization. Ryuk attacks specific companies with limited room for disruption and is one of the most profitable examples of ransomware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company located in Chicago and has about 500 staff members. The Ryuk penetration had frozen all business operations and manufacturing processes. Most of the client's data protection had been directly accessible at the start of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (exceeding $200K) and praying for the best, but ultimately engaged Progent.

Progent worked hand in hand the customer to rapidly understand and prioritize the essential areas that needed to be addressed to make it possible to continue company functions:

• Microsoft Active Directory
• E-Mail
• MRP System

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then initiated setup and storage recovery of the most important applications. All Microsoft Exchange Server schema and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to locate local OST files (Outlook Off-Line Data Files) on staff PCs to recover mail information. A not too old off-line backup of the businesses accounting systems made them able to return these vital services back online for users. Although major work remained to recover fully from the Ryuk virus, the most important systems were recovered rapidly:

Throughout the next few weeks critical milestones in the recovery project were accomplished through tight cooperation between Progent engineers and the client:

• Internal web applications were returned to operation without losing any information.
• The MailStore Exchange Server containing more than four million historical emails was restored to operations and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control capabilities were completely functional.
• A new Palo Alto 850 firewall was installed.
• Most of the user workstations were functioning as before the incident.

Conclusion
A possible business-killing disaster was averted due to results-oriented experts, a broad range of subject matter expertise, and tight collaboration. Although in hindsight the crypto-ransomware attack detailed here would have been blocked with advanced security technology and recognized best practices, staff education, and appropriate incident response procedures for information backup and keeping systems up to date with security patches, the fact is that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware incident, feel confident that Progent's team of experts has extensive experience in ransomware virus blocking, removal, and information systems disaster recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Albany
For ransomware cleanup expertise in the Albany metro area, phone Progent at 800-462-8800 or visit Contact Progent.