Ransomware Filtering and Cleanup Solutions Aurora

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become an escalating cyber pandemic that poses an enterprise-level danger for organizations unprepared for an attack. Different versions of ransomware such as CrySIS, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and continue to cause damage. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with daily as yet unnamed viruses, not only encrypt on-line information but also infiltrate most accessible system protection mechanisms. Information replicated to the cloud can also be ransomed. In a poorly architected data protection solution, it can make any restore operations impossible and effectively sets the entire system back to square one.

Getting back on-line programs and information after a crypto-ransomware event becomes a race against time as the targeted business tries its best to contain, eradicate the crypto-ransomware, and restore enterprise-critical activity. Because ransomware takes time to spread throughout a targeted network, penetrations are frequently sprung on weekends, when attacks are likely to take longer to recognize. This compounds the difficulty of quickly assembling and coordinating an experienced response team.

Progent provides a variety of solutions for protecting Aurora businesses from crypto-ransomware attacks. Among these are staff training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based cyberthreat protection to identify and extinguish day-zero malware assaults. Progent also provides the services of veteran ransomware recovery professionals with the talent and perseverance to restore a compromised system as soon as possible.

Progent's Ransomware Restoration Services
Subsequent to a ransomware event, paying the ransom in cryptocurrency does not guarantee that cyber criminals will provide the keys to decrypt all your files. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to setup from scratch the mission-critical elements of your IT environment. Absent access to essential information backups, this requires a broad complement of skills, professional project management, and the capability to work 24x7 until the job is completed.

For two decades, Progent has offered expert Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have attained top certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of experience affords Progent the skills to quickly understand necessary systems and re-organize the remaining parts of your computer network system following a ransomware attack and assemble them into an operational system.

Progent's ransomware team deploys state-of-the-art project management applications to orchestrate the complex restoration process. Progent knows the importance of acting quickly and together with a client's management and IT resources to prioritize tasks and to put key applications back on-line as fast as possible.

Case Study: A Successful Ransomware Incident Recovery
A business sought out Progent after their network system was attacked by Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean state cybercriminals, possibly adopting approaches exposed from the U.S. NSA organization. Ryuk goes after specific organizations with little tolerance for operational disruption and is among the most profitable versions of ransomware malware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in the Chicago metro area with about 500 employees. The Ryuk event had paralyzed all company operations and manufacturing processes. Most of the client's data protection had been on-line at the time of the intrusion and were encrypted. The client was evaluating paying the ransom (in excess of $200K) and hoping for the best, but in the end made the decision to use Progent.

Progent worked hand in hand the customer to quickly assess and assign priority to the essential applications that needed to be recovered in order to continue company functions:

• Active Directory
• Email
• Accounting and Manufacturing Software

In less than two days, Progent was able to re-build Windows Active Directory to its pre-penetration state. Progent then performed setup and storage recovery of mission critical servers. All Microsoft Exchange Server ties and attributes were intact, which greatly helped the restore of Exchange. Progent was able to assemble local OST files (Outlook Email Offline Folder Files) on staff PCs to recover email information. A recent off-line backup of the businesses accounting/ERP software made it possible to recover these essential programs back online for users. Although major work remained to recover completely from the Ryuk damage, critical systems were returned to operations rapidly:

Over the following couple of weeks key milestones in the recovery project were accomplished in close collaboration between Progent consultants and the client:

• In-house web sites were restored without losing any data.
• The MailStore Exchange Server exceeding four million archived messages was brought online and available for users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory modules were completely restored.
• A new Palo Alto Networks 850 firewall was brought online.
• 90% of the desktops and laptops were functioning as before the incident.

Conclusion
A potential enterprise-killing disaster was dodged through the efforts of dedicated professionals, a wide spectrum of technical expertise, and tight teamwork. Although in retrospect the ransomware incident described here would have been identified and stopped with current cyber security technology solutions and best practices, user and IT administrator education, and properly executed incident response procedures for data backup and proper patching controls, the fact is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus defense, removal, and information systems restoration.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Aurora
For ransomware system recovery consulting in the Aurora metro area, phone Progent at 800-462-8800 or see Contact Progent.