Ransomware Defense and Recovery Consulting Atlanta

Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that presents an enterprise-level danger for organizations vulnerable to an attack. Different versions of crypto-ransomware such as CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for many years and still cause harm. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with more as yet unnamed malware, not only encrypt online data but also infiltrate most accessible system protection mechanisms. Information synchronized to off-premises disaster recovery sites can also be encrypted. In a poorly designed environment, it can render automatic restoration useless and effectively sets the datacenter back to square one.

Getting back on-line applications and information following a crypto-ransomware attack becomes a sprint against time as the targeted organization struggles to stop lateral movement, cleanup the virus, and resume mission-critical activity. Because ransomware needs time to move laterally throughout a network, penetrations are often sprung on weekends and holidays, when penetrations typically take longer to recognize. This compounds the difficulty of quickly marshalling and orchestrating a qualified mitigation team.

Progent has an assortment of solutions for protecting Atlanta enterprises from crypto-ransomware attacks. These include team member training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat protection to detect and disable zero-day modern malware attacks. Progent in addition offers the services of experienced ransomware recovery professionals with the skills and commitment to reconstruct a compromised system as rapidly as possible.

Progent's Crypto-Ransomware Recovery Services
After a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will respond with the keys to decrypt all your data. Kaspersky estimated that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to setup from scratch the essential elements of your IT environment. Without access to complete system backups, this calls for a wide range of skill sets, professional team management, and the willingness to work continuously until the job is done.

For twenty years, Progent has provided expert IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded top certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial management and ERP application software. This breadth of experience provides Progent the skills to efficiently determine necessary systems and consolidate the surviving pieces of your Information Technology system following a ransomware event and rebuild them into a functioning system.

Progent's recovery team of experts deploys state-of-the-art project management systems to orchestrate the complicated restoration process. Progent knows the urgency of working rapidly and together with a customer's management and IT resources to prioritize tasks and to get essential applications back on line as soon as possible.

Case Study: A Successful Crypto-Ransomware Virus Recovery
A client escalated to Progent after their network was attacked by the Ryuk crypto-ransomware. Ryuk is thought to have been launched by North Korean government sponsored hackers, suspected of using algorithms leaked from the U.S. National Security Agency. Ryuk seeks specific businesses with little ability to sustain operational disruption and is among the most lucrative incarnations of ransomware malware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in the Chicago metro area with around 500 workers. The Ryuk event had brought down all company operations and manufacturing capabilities. The majority of the client's system backups had been on-line at the beginning of the attack and were destroyed. The client was taking steps for paying the ransom (more than $200,000) and wishfully thinking for good luck, but in the end brought in Progent.

Progent worked with the client to quickly determine and assign priority to the most important systems that had to be recovered in order to resume business operations:

• Active Directory (AD)
• Microsoft Exchange Server
• Financials/MRP

Within 2 days, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then completed reinstallations and hard drive recovery on key servers. All Exchange ties and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to collect non-encrypted OST data files (Outlook Email Offline Folder Files) on various workstations and laptops in order to recover email messages. A recent offline backup of the client's accounting/ERP software made it possible to restore these required programs back on-line. Although a lot of work still had to be done to recover completely from the Ryuk damage, core services were restored quickly:

During the following couple of weeks important milestones in the restoration process were completed in close collaboration between Progent consultants and the customer:

• Self-hosted web sites were restored with no loss of data.
• The MailStore Server with over 4 million archived messages was brought on-line and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory functions were fully restored.
• A new Palo Alto Networks 850 security appliance was set up.
• 90% of the desktops and laptops were being used by staff.

Conclusion
A potential business catastrophe was dodged by dedicated professionals, a wide spectrum of IT skills, and close teamwork. Although in analyzing the event afterwards the ransomware virus incident described here could have been identified and blocked with up-to-date cyber security systems and NIST Cybersecurity Framework best practices, user and IT administrator training, and well thought out security procedures for data backup and applying software patches, the reality remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has a proven track record in crypto-ransomware virus defense, cleanup, and data restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Atlanta
For ransomware system restoration consulting in the Atlanta area, call Progent at 800-462-8800 or go to Contact Progent.