Ransomware Filtering and Restoration Expertise Arlington

Ransomware : Your Worst Information Technology Disaster
Ransomware has become a too-frequent cyber pandemic that represents an existential threat for businesses of all sizes unprepared for an assault. Versions of ransomware such as Reveton, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for many years and continue to cause destruction. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as frequent unnamed malware, not only perform encryption of online information but also infiltrate many accessible system protection mechanisms. Data replicated to the cloud can also be ransomed. In a vulnerable environment, it can render automatic restore operations useless and effectively knocks the network back to square one.

Getting back online services and information after a crypto-ransomware attack becomes a race against time as the targeted organization tries its best to stop lateral movement, remove the ransomware, and restore business-critical operations. Since ransomware requires time to replicate across a targeted network, attacks are frequently launched on weekends, when attacks typically take more time to detect. This multiplies the difficulty of quickly assembling and coordinating a qualified response team.

Progent makes available an assortment of support services for securing Arlington enterprises from crypto-ransomware events. These include staff education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based threat protection to discover and disable zero-day malware assaults. Progent in addition provides the services of experienced ransomware recovery engineers with the skills and perseverance to reconstruct a compromised system as soon as possible.

Progent's Ransomware Restoration Support Services
After a crypto-ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that distant criminals will return the needed codes to unencrypt any of your files. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to setup from scratch the essential elements of your Information Technology environment. Without the availability of complete information backups, this calls for a wide range of IT skills, professional project management, and the capability to work continuously until the job is done.

For two decades, Progent has provided professional Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have attained high-level certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have earned internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of expertise affords Progent the ability to rapidly determine critical systems and organize the surviving components of your IT system after a crypto-ransomware event and rebuild them into an operational system.

Progent's security team of experts uses state-of-the-art project management tools to orchestrate the complex recovery process. Progent understands the urgency of working quickly and together with a customer's management and IT team members to prioritize tasks and to put essential applications back online as fast as possible.

Client Case Study: A Successful Ransomware Intrusion Recovery
A small business sought out Progent after their organization was crashed by Ryuk ransomware virus. Ryuk is thought to have been created by North Korean state sponsored hackers, suspected of adopting approaches exposed from the U.S. NSA organization. Ryuk targets specific companies with little ability to sustain disruption and is among the most profitable instances of ransomware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company based in Chicago with around 500 workers. The Ryuk attack had disabled all essential operations and manufacturing capabilities. Most of the client's backups had been directly accessible at the time of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom (in excess of two hundred thousand dollars) and praying for the best, but ultimately called Progent.

Progent worked together with the customer to quickly understand and prioritize the most important elements that needed to be addressed in order to restart business functions:

• Active Directory
• Microsoft Exchange
• Financials/MRP

Within 2 days, Progent was able to recover Active Directory to its pre-penetration state. Progent then performed rebuilding and storage recovery on key applications. All Exchange schema and configuration information were usable, which accelerated the restore of Exchange. Progent was able to assemble local OST files (Outlook Off-Line Folder Files) on staff desktop computers in order to recover mail data. A recent offline backup of the customer's accounting/MRP software made them able to return these vital programs back on-line. Although significant work remained to recover fully from the Ryuk virus, core systems were restored rapidly:

Over the following month critical milestones in the restoration project were achieved through tight cooperation between Progent engineers and the customer:

• Self-hosted web sites were restored with no loss of data.
• The MailStore Exchange Server containing more than four million archived messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control functions were fully operational.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• Most of the desktop computers were functioning as before the incident.

Conclusion
A possible company-ending catastrophe was evaded due to results-oriented experts, a wide array of knowledge, and tight collaboration. Although in retrospect the ransomware virus attack detailed here would have been shut down with advanced cyber security systems and best practices, user training, and properly executed incident response procedures for information backup and applying software patches, the reality is that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware incident, feel confident that Progent's roster of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and information systems disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Arlington
For ransomware system recovery consulting services in the Arlington metro area, phone Progent at 800-462-8800 or visit Contact Progent.