Ransomware Defense and Cleanup Expertise Cambridge

Ransomware : Your Worst Information Technology Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that represents an extinction-level threat for organizations vulnerable to an assault. Different versions of ransomware such as Reveton, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for many years and continue to inflict destruction. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as more unnamed viruses, not only perform encryption of online information but also infiltrate many configured system restores and backups. Files synchronized to the cloud can also be rendered useless. In a poorly designed data protection solution, this can render any restore operations impossible and basically knocks the entire system back to square one.

Retrieving programs and data after a crypto-ransomware attack becomes a race against the clock as the targeted business struggles to stop the spread, eradicate the crypto-ransomware, and resume mission-critical operations. Due to the fact that crypto-ransomware takes time to spread across a targeted network, attacks are often sprung during nights and weekends, when penetrations are likely to take more time to notice. This multiplies the difficulty of quickly mobilizing and orchestrating a qualified response team.

Progent has a range of services for protecting Cambridge organizations from ransomware events. Among these are team member training to help identify and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to detect and quarantine day-zero malware assaults. Progent in addition offers the services of expert crypto-ransomware recovery professionals with the talent and perseverance to re-deploy a breached network as quickly as possible.

Progent's Crypto-Ransomware Restoration Services
After a crypto-ransomware event, paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will return the needed codes to decrypt any or all of your information. Kaspersky estimated that seventeen percent of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to re-install the vital elements of your IT environment. Without the availability of full system backups, this calls for a broad complement of skill sets, well-coordinated team management, and the willingness to work 24x7 until the task is completed.

For twenty years, Progent has offered certified expert IT services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained top industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP software solutions. This breadth of expertise affords Progent the capability to rapidly determine important systems and organize the remaining pieces of your Information Technology system following a crypto-ransomware penetration and configure them into an operational system.

Progent's ransomware group utilizes powerful project management systems to orchestrate the sophisticated recovery process. Progent appreciates the urgency of acting swiftly and together with a customer's management and IT resources to assign priority to tasks and to get essential services back on line as soon as humanly possible.

Customer Story: A Successful Ransomware Attack Recovery
A business sought out Progent after their company was penetrated by the Ryuk ransomware. Ryuk is thought to have been launched by North Korean government sponsored hackers, possibly adopting technology leaked from the United States NSA organization. Ryuk goes after specific companies with limited ability to sustain disruption and is among the most profitable versions of ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in the Chicago metro area with about 500 workers. The Ryuk intrusion had shut down all company operations and manufacturing processes. Most of the client's information backups had been on-line at the start of the attack and were encrypted. The client was evaluating paying the ransom demand (exceeding $200,000) and wishfully thinking for good luck, but in the end made the decision to use Progent.

Progent worked hand in hand the client to quickly determine and prioritize the most important elements that needed to be restored to make it possible to restart company operations:

• Active Directory (AD)
• Microsoft Exchange Email
• Financials/MRP

Within 2 days, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then helped perform reinstallations and hard drive recovery of key servers. All Exchange schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to collect local OST files (Microsoft Outlook Off-Line Data Files) on team desktop computers and laptops in order to recover mail information. A not too old offline backup of the customer's financials/ERP systems made it possible to restore these required programs back servicing users. Although major work was left to recover fully from the Ryuk attack, the most important systems were returned to operations rapidly:

During the next month critical milestones in the recovery project were achieved in close cooperation between Progent engineers and the customer:

• In-house web applications were brought back up without losing any information.
• The MailStore Server exceeding 4 million archived messages was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory Control capabilities were 100% restored.
• A new Palo Alto 850 security appliance was set up and programmed.
• Most of the user PCs were fully operational.

Conclusion
A probable business-killing catastrophe was avoided due to top-tier professionals, a broad range of IT skills, and tight collaboration. Although upon completion of forensics the ransomware virus attack detailed here should have been prevented with modern cyber security technology solutions and best practices, user and IT administrator education, and well thought out incident response procedures for data backup and keeping systems up to date with security patches, the fact remains that state-sponsored cybercriminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, cleanup, and data disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Cambridge
For ransomware cleanup consulting in the Cambridge metro area, call Progent at 800-462-8800 or see Contact Progent.