Ransomware Filtering and Restoration Services Bellevue

Crypto-Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become a too-frequent cyberplague that represents an existential danger for organizations vulnerable to an assault. Different versions of ransomware like the Dharma, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for years and still cause damage. Newer variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as additional as yet unnamed malware, not only encrypt on-line data but also infect most available system backups. Information replicated to the cloud can also be encrypted. In a poorly architected data protection solution, this can make automated restoration useless and effectively knocks the datacenter back to square one.

Retrieving programs and information after a ransomware intrusion becomes a sprint against time as the targeted business fights to stop the spread, clear the ransomware, and resume enterprise-critical activity. Since ransomware needs time to replicate across a network, penetrations are frequently sprung during weekends and nights, when penetrations tend to take more time to recognize. This compounds the difficulty of quickly assembling and organizing a knowledgeable response team.

Progent offers a variety of support services for protecting Bellevue organizations from ransomware events. Among these are user training to help identify and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to identify and extinguish zero-day modern malware attacks. Progent also offers the services of seasoned ransomware recovery engineers with the track record and perseverance to re-deploy a compromised environment as soon as possible.

Progent's Ransomware Restoration Services
Subsequent to a crypto-ransomware penetration, paying the ransom in cryptocurrency does not guarantee that cyber criminals will respond with the needed keys to decipher all your files. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their information even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to setup from scratch the vital components of your Information Technology environment. Without the availability of full information backups, this calls for a broad complement of IT skills, professional project management, and the ability to work non-stop until the task is done.

For twenty years, Progent has offered certified expert IT services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have earned high-level industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have earned internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP applications. This breadth of expertise gives Progent the skills to efficiently determine critical systems and re-organize the remaining parts of your network environment following a ransomware penetration and rebuild them into an operational system.

Progent's recovery team of experts deploys powerful project management applications to orchestrate the complex restoration process. Progent appreciates the importance of working swiftly and in unison with a customer's management and IT staff to prioritize tasks and to put critical applications back on-line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Virus Restoration
A customer sought out Progent after their organization was taken over by Ryuk crypto-ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored criminal gangs, suspected of using technology exposed from the U.S. National Security Agency. Ryuk goes after specific businesses with little or no room for operational disruption and is among the most profitable examples of ransomware viruses. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company located in the Chicago metro area with around 500 employees. The Ryuk penetration had disabled all essential operations and manufacturing capabilities. The majority of the client's data backups had been directly accessible at the time of the intrusion and were damaged. The client was evaluating paying the ransom demand (more than $200,000) and praying for the best, but in the end called Progent.

Progent worked with the customer to quickly determine and prioritize the most important areas that needed to be addressed in order to resume business functions:

• Active Directory (AD)
• Exchange Server
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to rebuild Active Directory to its pre-intrusion state. Progent then initiated rebuilding and hard drive recovery of the most important systems. All Exchange data and attributes were usable, which accelerated the restore of Exchange. Progent was able to locate local OST files (Outlook Email Offline Folder Files) on team PCs to recover mail information. A not too old off-line backup of the customer's accounting/ERP software made them able to restore these vital programs back on-line. Although significant work needed to be completed to recover completely from the Ryuk damage, critical services were recovered quickly:

Throughout the next few weeks important milestones in the recovery process were completed through tight cooperation between Progent engineers and the client:

• Internal web sites were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server containing more than 4 million historical messages was restored to operations and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/AR/Inventory modules were fully recovered.
• A new Palo Alto 850 firewall was deployed.
• 90% of the user workstations were being used by staff.

Conclusion
A probable enterprise-killing catastrophe was avoided with hard-working professionals, a wide range of IT skills, and tight teamwork. Although in post mortem the crypto-ransomware virus attack detailed here would have been identified and disabled with current cyber security technology and recognized best practices, user training, and well designed incident response procedures for data protection and applying software patches, the fact remains that state-sponsored hackers from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, cleanup, and data recovery.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Bellevue
For ransomware system restoration consulting in the Bellevue metro area, call Progent at 800-462-8800 or go to Contact Progent.