Ransomware Protection and Cleanup Consulting Broomfield

Ransomware : Your Feared IT Catastrophe
Ransomware has become a too-frequent cyber pandemic that represents an enterprise-level danger for businesses vulnerable to an assault. Versions of ransomware like the Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been out in the wild for a long time and still cause havoc. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as more unnamed viruses, not only encrypt online files but also infect most available system protection. Files replicated to the cloud can also be encrypted. In a poorly designed system, it can render any restore operations useless and basically sets the datacenter back to square one.

Getting back online applications and data after a ransomware outage becomes a sprint against the clock as the victim tries its best to contain, remove the crypto-ransomware, and resume mission-critical activity. Since ransomware takes time to replicate throughout a network, penetrations are often sprung on weekends, when successful penetrations in many cases take longer to discover. This multiplies the difficulty of quickly marshalling and organizing a qualified response team.

Progent makes available an assortment of support services for securing Broomfield enterprises from ransomware events. Among these are staff training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to detect and extinguish day-zero modern malware attacks. Progent in addition offers the services of expert ransomware recovery professionals with the skills and commitment to rebuild a breached system as quickly as possible.

Progent's Ransomware Restoration Services
After a ransomware penetration, sending the ransom in cryptocurrency does not provide any assurance that merciless criminals will respond with the keys to decipher any of your information. Kaspersky estimated that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to re-install the essential elements of your Information Technology environment. Without the availability of essential system backups, this requires a wide range of skills, professional project management, and the willingness to work 24x7 until the recovery project is finished.

For two decades, Progent has offered expert Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained top industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of experience affords Progent the skills to efficiently ascertain important systems and re-organize the surviving components of your Information Technology environment after a crypto-ransomware attack and configure them into a functioning system.

Progent's recovery group utilizes best of breed project management tools to orchestrate the sophisticated restoration process. Progent appreciates the urgency of acting swiftly and in unison with a client's management and Information Technology staff to assign priority to tasks and to put key applications back on line as fast as possible.

Customer Case Study: A Successful Ransomware Intrusion Restoration
A customer engaged Progent after their network system was crashed by Ryuk ransomware. Ryuk is thought to have been created by North Korean government sponsored cybercriminals, possibly using approaches exposed from the U.S. NSA organization. Ryuk goes after specific businesses with little or no tolerance for disruption and is among the most lucrative instances of ransomware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturer based in Chicago with about 500 workers. The Ryuk attack had frozen all business operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the start of the intrusion and were encrypted. The client was evaluating paying the ransom demand (more than $200,000) and wishfully thinking for the best, but in the end brought in Progent.

Progent worked hand in hand the client to rapidly assess and assign priority to the mission critical applications that had to be restored in order to continue business functions:

• Active Directory (AD)
• Microsoft Exchange Email
• Accounting and Manufacturing Software

In less than two days, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then helped perform reinstallations and hard drive recovery of needed servers. All Exchange Server schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was also able to assemble local OST files (Outlook Email Off-Line Folder Files) on user PCs in order to recover mail messages. A not too old off-line backup of the customer's accounting/MRP systems made them able to recover these essential applications back online for users. Although major work still had to be done to recover totally from the Ryuk attack, the most important services were restored quickly:

Throughout the following few weeks important milestones in the restoration process were completed through tight cooperation between Progent engineers and the customer:

• Internal web sites were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory modules were 100% functional.
• A new Palo Alto 850 firewall was brought online.
• Ninety percent of the desktop computers were being used by staff.

Conclusion
A likely business extinction catastrophe was evaded by dedicated experts, a broad range of technical expertise, and close teamwork. Although in hindsight the crypto-ransomware penetration detailed here would have been identified and stopped with up-to-date cyber security systems and recognized best practices, user education, and well thought out security procedures for backup and applying software patches, the fact remains that government-sponsored hackers from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has substantial experience in ransomware virus blocking, removal, and file restoration.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Broomfield
For ransomware system restoration consulting services in the Broomfield metro area, call Progent at 800-462-8800 or visit Contact Progent.