Ransomware Filtering and Restoration Solutions Birmingham

Ransomware : Your Feared IT Nightmare
Ransomware has become an escalating cyber pandemic that poses an existential danger for organizations poorly prepared for an attack. Multiple generations of ransomware such as Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been circulating for a long time and still cause damage. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with daily unnamed viruses, not only encrypt online information but also infiltrate most accessible system backup. Data replicated to the cloud can also be ransomed. In a poorly architected data protection solution, this can render automatic restore operations hopeless and basically knocks the entire system back to square one.

Getting back programs and data after a ransomware intrusion becomes a race against the clock as the victim struggles to contain, remove the crypto-ransomware, and restore business-critical operations. Due to the fact that ransomware takes time to move laterally throughout a targeted network, attacks are frequently launched at night, when successful attacks tend to take more time to recognize. This multiplies the difficulty of quickly assembling and orchestrating an experienced mitigation team.

Progent makes available an assortment of help services for protecting Birmingham enterprises from crypto-ransomware events. These include user education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to identify and disable day-zero modern malware assaults. Progent also provides the assistance of seasoned crypto-ransomware recovery consultants with the skills and commitment to restore a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Restoration Help
Following a ransomware penetration, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will provide the codes to unencrypt any or all of your data. Kaspersky Labs ascertained that 17% of ransomware victims never restored their files even after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to setup from scratch the critical elements of your IT environment. Absent access to essential data backups, this calls for a wide range of skill sets, professional team management, and the ability to work non-stop until the job is completed.

For decades, Progent has provided certified expert IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have been awarded top industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have earned internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial management and ERP application software. This breadth of expertise affords Progent the ability to knowledgably determine important systems and integrate the surviving pieces of your IT environment following a ransomware attack and assemble them into a functioning system.

Progent's recovery team deploys best of breed project management applications to coordinate the sophisticated recovery process. Progent knows the urgency of working swiftly and in concert with a client's management and Information Technology team members to assign priority to tasks and to get the most important services back on-line as soon as possible.

Business Case Study: A Successful Ransomware Virus Response
A small business escalated to Progent after their organization was crashed by the Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state cybercriminals, possibly adopting strategies exposed from America's NSA organization. Ryuk seeks specific companies with little ability to sustain disruption and is one of the most profitable examples of ransomware viruses. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in Chicago and has around 500 employees. The Ryuk intrusion had paralyzed all business operations and manufacturing capabilities. The majority of the client's backups had been directly accessible at the start of the attack and were destroyed. The client was taking steps for paying the ransom demand (more than $200K) and praying for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the customer to rapidly get our arms around and assign priority to the critical applications that needed to be recovered in order to continue departmental functions:

• Windows Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

In less than two days, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then initiated reinstallations and storage recovery on key servers. All Microsoft Exchange Server data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to collect intact OST files (Microsoft Outlook Off-Line Folder Files) on various PCs to recover email information. A not too old offline backup of the customer's financials/ERP systems made it possible to recover these vital services back online. Although a lot of work needed to be completed to recover completely from the Ryuk attack, the most important services were restored rapidly:

During the next few weeks critical milestones in the restoration project were completed through close collaboration between Progent engineers and the client:

• In-house web sites were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server with over four million archived emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/AP/AR/Inventory functions were fully recovered.
• A new Palo Alto Networks 850 security appliance was installed.
• Most of the user desktops were back into operation.

Conclusion
A possible enterprise-killing catastrophe was averted through the efforts of top-tier experts, a broad spectrum of subject matter expertise, and close teamwork. Although in analyzing the event afterwards the ransomware penetration detailed here would have been identified and stopped with up-to-date security systems and ISO/IEC 27001 best practices, staff education, and properly executed security procedures for information protection and proper patching controls, the reality remains that state-sponsored hackers from China, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware incident, feel confident that Progent's team of experts has substantial experience in ransomware virus defense, mitigation, and file recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Birmingham
For ransomware cleanup expertise in the Birmingham area, phone Progent at 800-462-8800 or see Contact Progent.