Ransomware Defense and Cleanup Consulting Barra da Tijuca

Crypto-Ransomware : Your Feared Information Technology Disaster
Ransomware has become a too-frequent cyber pandemic that represents an existential threat for organizations poorly prepared for an attack. Different versions of ransomware such as CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for years and still inflict damage. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with additional unnamed malware, not only perform encryption of online data but also infiltrate most configured system backups. Files synched to the cloud can also be encrypted. In a poorly architected data protection solution, this can make automatic restoration hopeless and effectively sets the network back to square one.

Restoring services and information following a crypto-ransomware event becomes a race against the clock as the targeted business struggles to stop lateral movement, clear the ransomware, and resume mission-critical operations. Due to the fact that ransomware needs time to spread throughout a network, penetrations are frequently sprung on weekends and holidays, when successful attacks are likely to take more time to discover. This compounds the difficulty of rapidly mobilizing and organizing a capable mitigation team.

Progent provides a variety of solutions for securing Barra da Tijuca enterprises from crypto-ransomware penetrations. These include team education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to identify and disable day-zero modern malware attacks. Progent also can provide the assistance of experienced ransomware recovery professionals with the talent and commitment to re-deploy a breached environment as quickly as possible.

Progent's Crypto-Ransomware Restoration Help
Subsequent to a ransomware event, paying the ransom in cryptocurrency does not guarantee that criminal gangs will respond with the needed keys to unencrypt any of your information. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their files even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to setup from scratch the vital parts of your IT environment. Absent access to essential data backups, this calls for a wide range of skill sets, well-coordinated project management, and the ability to work continuously until the job is complete.

For twenty years, Progent has offered certified expert IT services for companies across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned top certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of experience provides Progent the ability to quickly understand critical systems and consolidate the surviving parts of your computer network environment following a ransomware attack and configure them into a functioning system.

Progent's security team of experts utilizes best of breed project management applications to orchestrate the complicated restoration process. Progent appreciates the urgency of acting rapidly and in unison with a client's management and IT team members to prioritize tasks and to put the most important applications back online as fast as possible.

Case Study: A Successful Ransomware Incident Restoration
A client escalated to Progent after their network system was taken over by the Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean state cybercriminals, possibly adopting techniques exposed from the U.S. NSA organization. Ryuk goes after specific businesses with little ability to sustain disruption and is among the most profitable incarnations of ransomware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer located in the Chicago metro area with around 500 staff members. The Ryuk intrusion had frozen all essential operations and manufacturing capabilities. The majority of the client's system backups had been on-line at the time of the attack and were destroyed. The client was pursuing financing for paying the ransom demand (exceeding two hundred thousand dollars) and praying for the best, but in the end utilized Progent.

Progent worked with the customer to rapidly identify and prioritize the mission critical systems that had to be addressed in order to continue departmental functions:

• Microsoft Active Directory
• E-Mail
• Financials/MRP

In less than 2 days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then charged ahead with setup and hard drive recovery on critical systems. All Exchange schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to find local OST files (Outlook Email Offline Folder Files) on staff workstations in order to recover mail information. A not too old offline backup of the customer's financials/MRP software made it possible to return these vital programs back online for users. Although a large amount of work remained to recover completely from the Ryuk virus, essential services were returned to operations quickly:

Over the following couple of weeks key milestones in the restoration process were accomplished in close cooperation between Progent team members and the client:

• In-house web applications were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server containing more than 4 million archived emails was brought online and available for users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables/Inventory functions were 100 percent recovered.
• A new Palo Alto Networks 850 firewall was installed.
• Nearly all of the user PCs were functioning as before the incident.

Conclusion
A probable company-ending disaster was avoided with hard-working professionals, a broad range of subject matter expertise, and tight teamwork. Although in post mortem the ransomware incident described here would have been prevented with modern cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and well thought out incident response procedures for information backup and proper patching controls, the fact remains that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's roster of experts has extensive experience in ransomware virus defense, remediation, and data recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Barra da Tijuca
For ransomware system restoration consulting services in the Barra da Tijuca area, phone Progent at 800-462-8800 or go to Contact Progent.