Ransomware Prevention and Removal Solutions Allentown

Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become an escalating cyber pandemic that presents an enterprise-level danger for organizations poorly prepared for an attack. Different iterations of crypto-ransomware such as CrySIS, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been circulating for a long time and still inflict harm. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus frequent unnamed malware, not only encrypt on-line critical data but also infect all accessible system protection. Information synchronized to the cloud can also be corrupted. In a poorly designed data protection solution, this can make automatic recovery impossible and basically sets the datacenter back to zero.

Retrieving services and information following a ransomware attack becomes a sprint against time as the victim fights to stop the spread, remove the crypto-ransomware, and resume mission-critical operations. Due to the fact that ransomware requires time to replicate throughout a network, attacks are frequently launched at night, when successful penetrations are likely to take more time to notice. This compounds the difficulty of promptly mobilizing and coordinating a qualified mitigation team.

Progent provides a range of services for securing Allentown enterprises from ransomware penetrations. Among these are team education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to identify and extinguish day-zero modern malware assaults. Progent also offers the services of seasoned ransomware recovery consultants with the skills and perseverance to rebuild a breached environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Following a crypto-ransomware invasion, even paying the ransom demands in cryptocurrency does not guarantee that distant criminals will return the needed codes to unencrypt all your files. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to re-install the vital components of your IT environment. Without the availability of essential information backups, this calls for a broad range of skills, well-coordinated project management, and the ability to work 24x7 until the task is finished.

For two decades, Progent has offered certified expert Information Technology services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have earned top certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial management and ERP application software. This breadth of expertise provides Progent the skills to rapidly identify important systems and consolidate the surviving pieces of your Information Technology system following a crypto-ransomware event and rebuild them into a functioning system.

Progent's security group utilizes powerful project management applications to orchestrate the sophisticated recovery process. Progent appreciates the urgency of acting quickly and together with a customer's management and IT team members to assign priority to tasks and to get the most important services back on-line as soon as possible.

Customer Case Study: A Successful Ransomware Penetration Recovery
A customer hired Progent after their company was brought down by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state cybercriminals, possibly using strategies exposed from the U.S. National Security Agency. Ryuk seeks specific businesses with little or no tolerance for operational disruption and is one of the most lucrative examples of ransomware viruses. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company based in Chicago with about 500 workers. The Ryuk event had frozen all business operations and manufacturing capabilities. Most of the client's information backups had been on-line at the time of the intrusion and were damaged. The client was actively seeking loans for paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but ultimately reached out to Progent.

Progent worked with the customer to quickly understand and prioritize the most important applications that needed to be addressed in order to restart company operations:

• Windows Active Directory
• Email
• Financials/MRP

In less than 48 hours, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then helped perform reinstallations and hard drive recovery of the most important applications. All Exchange Server schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to locate non-encrypted OST data files (Outlook Off-Line Data Files) on team PCs and laptops to recover mail information. A recent offline backup of the client's accounting/ERP software made them able to return these essential services back on-line. Although a large amount of work was left to recover completely from the Ryuk damage, the most important services were restored quickly:

During the following month important milestones in the recovery process were made in close collaboration between Progent engineers and the client:

• In-house web sites were restored with no loss of data.
• The MailStore Server containing more than 4 million historical messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were 100% restored.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Most of the desktops and laptops were fully operational.

Conclusion
A probable business-ending catastrophe was avoided by hard-working experts, a wide spectrum of subject matter expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration described here should have been identified and stopped with advanced cyber security solutions and best practices, team training, and well designed incident response procedures for information protection and keeping systems up to date with security patches, the reality is that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware penetration, remember that Progent's team of experts has substantial experience in ransomware virus blocking, removal, and information systems recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Allentown
For ransomware recovery consulting in the Allentown area, call Progent at 800-462-8800 or visit Contact Progent.