Ransomware Prevention and Removal Services Beverly Hills

Crypto-Ransomware : Your Worst Information Technology Catastrophe
Ransomware has become a modern cyberplague that presents an extinction-level danger for businesses of all sizes poorly prepared for an attack. Versions of ransomware like the Dharma, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for years and continue to cause damage. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as frequent unnamed viruses, not only perform encryption of on-line critical data but also infect all available system restores and backups. Information synchronized to cloud environments can also be ransomed. In a vulnerable environment, it can make automatic recovery useless and basically sets the network back to zero.

Retrieving programs and information after a crypto-ransomware attack becomes a sprint against the clock as the targeted business tries its best to stop the spread, eradicate the crypto-ransomware, and restore mission-critical operations. Because ransomware needs time to replicate throughout a targeted network, attacks are often launched during weekends and nights, when successful attacks tend to take more time to uncover. This multiplies the difficulty of rapidly assembling and coordinating a qualified response team.

Progent offers a range of services for securing Beverly Hills enterprises from ransomware penetrations. These include team training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to identify and suppress zero-day modern malware assaults. Progent in addition can provide the services of veteran ransomware recovery engineers with the talent and perseverance to re-deploy a breached system as soon as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware penetration, paying the ransom in cryptocurrency does not ensure that distant criminals will respond with the needed codes to decrypt any or all of your information. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to piece back together the vital components of your IT environment. Absent the availability of full system backups, this calls for a wide complement of IT skills, professional project management, and the capability to work non-stop until the recovery project is complete.

For two decades, Progent has made available certified expert IT services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of experience provides Progent the ability to rapidly understand critical systems and organize the surviving parts of your IT environment following a crypto-ransomware attack and configure them into an operational system.

Progent's ransomware team has powerful project management tools to orchestrate the sophisticated restoration process. Progent understands the urgency of working rapidly and in unison with a customer's management and Information Technology team members to assign priority to tasks and to put critical services back on-line as fast as possible.

Customer Story: A Successful Crypto-Ransomware Attack Recovery
A small business hired Progent after their organization was crashed by Ryuk ransomware. Ryuk is thought to have been developed by North Korean state sponsored hackers, possibly using techniques exposed from the U.S. NSA organization. Ryuk attacks specific businesses with limited ability to sustain operational disruption and is one of the most lucrative versions of crypto-ransomware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in the Chicago metro area with around 500 employees. The Ryuk attack had frozen all business operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the time of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for good luck, but ultimately made the decision to use Progent.

Progent worked together with the customer to rapidly determine and assign priority to the essential areas that needed to be recovered in order to resume company functions:

• Active Directory
• Exchange Server
• Accounting/MRP

Within 2 days, Progent was able to recover Active Directory to its pre-virus state. Progent then completed setup and hard drive recovery on mission critical systems. All Exchange schema and attributes were intact, which facilitated the restore of Exchange. Progent was able to locate non-encrypted OST files (Outlook Offline Folder Files) on various desktop computers in order to recover mail information. A recent off-line backup of the customer's financials/MRP systems made it possible to restore these essential programs back online. Although a lot of work needed to be completed to recover completely from the Ryuk event, core services were restored rapidly:

Throughout the next few weeks critical milestones in the recovery process were completed through close cooperation between Progent team members and the customer:

• In-house web applications were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were 100% restored.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Most of the user PCs were being used by staff.

Conclusion
A possible company-ending disaster was dodged through the efforts of hard-working professionals, a wide range of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the crypto-ransomware incident detailed here should have been disabled with current cyber security technology solutions and ISO/IEC 27001 best practices, staff education, and well thought out security procedures for data protection and proper patching controls, the reality is that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and will continue. If you do get hit by a ransomware virus, feel confident that Progent's team of professionals has proven experience in ransomware virus blocking, cleanup, and data restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Beverly Hills
For ransomware cleanup services in the Beverly Hills metro area, phone Progent at 800-462-8800 or see Contact Progent.