Ransomware Prevention and Removal Services Cabo Frio

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that presents an extinction-level danger for organizations unprepared for an attack. Versions of ransomware such as CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for a long time and continue to cause harm. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with additional unnamed malware, not only encrypt on-line critical data but also infiltrate any accessible system restores and backups. Information synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly architected system, this can make automated restoration hopeless and basically sets the datacenter back to square one.

Getting back programs and data after a crypto-ransomware event becomes a sprint against time as the targeted organization tries its best to stop the spread, remove the crypto-ransomware, and restore business-critical operations. Because crypto-ransomware needs time to spread throughout a targeted network, assaults are often launched during weekends and nights, when successful penetrations are likely to take more time to notice. This multiplies the difficulty of quickly mobilizing and coordinating an experienced mitigation team.

Progent has a variety of solutions for protecting Cabo Frio organizations from crypto-ransomware attacks. Among these are team member education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to identify and quarantine zero-day malware attacks. Progent also offers the services of seasoned ransomware recovery consultants with the talent and commitment to restore a compromised network as soon as possible.

Progent's Ransomware Recovery Support Services
After a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will respond with the needed codes to unencrypt any of your data. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their data even after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to piece back together the vital elements of your IT environment. Absent access to complete information backups, this calls for a wide range of skill sets, professional team management, and the capability to work non-stop until the recovery project is finished.

For two decades, Progent has offered expert Information Technology services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded high-level industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP application software. This breadth of expertise provides Progent the capability to rapidly determine necessary systems and integrate the surviving parts of your network environment following a ransomware attack and assemble them into an operational system.

Progent's recovery group uses powerful project management applications to orchestrate the complicated restoration process. Progent appreciates the urgency of acting quickly and in unison with a client's management and Information Technology team members to assign priority to tasks and to get essential applications back on line as soon as possible.

Client Case Study: A Successful Ransomware Incident Restoration
A business escalated to Progent after their network system was taken over by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state sponsored cybercriminals, suspected of adopting techniques leaked from the U.S. National Security Agency. Ryuk targets specific companies with little or no ability to sustain operational disruption and is one of the most lucrative versions of ransomware malware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company located in Chicago with about 500 employees. The Ryuk event had disabled all business operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the time of the intrusion and were encrypted. The client was pursuing financing for paying the ransom (exceeding $200,000) and hoping for good luck, but ultimately made the decision to use Progent.

Progent worked hand in hand the customer to quickly assess and prioritize the mission critical applications that had to be restored in order to restart company operations:

• Windows Active Directory
• Microsoft Exchange Email
• MRP System

Within 48 hours, Progent was able to restore Active Directory to its pre-intrusion state. Progent then helped perform reinstallations and hard drive recovery on the most important systems. All Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to find local OST data files (Outlook Off-Line Folder Files) on staff desktop computers and laptops to recover email messages. A not too old off-line backup of the customer's accounting/ERP software made it possible to recover these essential services back available to users. Although significant work needed to be completed to recover fully from the Ryuk damage, the most important services were recovered quickly:

Over the following couple of weeks critical milestones in the restoration project were made through tight collaboration between Progent engineers and the client:

• Self-hosted web applications were restored without losing any data.
• The MailStore Microsoft Exchange Server containing more than 4 million archived emails was spun up and available for users.
• CRM/Product Ordering/Invoicing/AP/Accounts Receivables (AR)/Inventory modules were 100 percent recovered.
• A new Palo Alto 850 firewall was installed.
• Nearly all of the desktop computers were fully operational.

Conclusion
A possible business disaster was dodged by top-tier professionals, a wide spectrum of IT skills, and close collaboration. Although in hindsight the crypto-ransomware penetration described here would have been identified and prevented with modern security technology and recognized best practices, team training, and well designed security procedures for information backup and proper patching controls, the reality is that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus blocking, remediation, and file recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Cabo Frio
For ransomware system restoration services in the Cabo Frio metro area, call Progent at 800-462-8800 or visit Contact Progent.