Ransomware Protection and Restoration Solutions Chatsworth

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware has become a modern cyber pandemic that represents an existential threat for businesses of all sizes vulnerable to an attack. Multiple generations of ransomware such as CrySIS, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and still cause destruction. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with frequent as yet unnamed malware, not only encrypt online files but also infect any accessible system backup. Files replicated to the cloud can also be ransomed. In a poorly designed data protection solution, this can make automatic recovery useless and basically knocks the datacenter back to square one.

Getting back online applications and data after a ransomware outage becomes a race against the clock as the victim struggles to contain, eradicate the ransomware, and restore mission-critical operations. Due to the fact that ransomware requires time to spread throughout a network, assaults are often sprung on weekends and holidays, when successful attacks may take longer to detect. This multiplies the difficulty of quickly marshalling and organizing a knowledgeable response team.

Progent makes available a variety of solutions for protecting Chatsworth enterprises from crypto-ransomware penetrations. Among these are staff training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat defense to discover and suppress day-zero malware assaults. Progent also can provide the services of expert ransomware recovery professionals with the skills and perseverance to reconstruct a compromised environment as urgently as possible.

Progent's Ransomware Recovery Help
After a crypto-ransomware event, paying the ransom in cryptocurrency does not guarantee that cyber hackers will provide the codes to decrypt all your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to piece back together the vital parts of your IT environment. Absent access to essential data backups, this calls for a broad complement of skills, well-coordinated team management, and the capability to work continuously until the job is complete.

For decades, Progent has provided professional Information Technology services for companies across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-recognized certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of expertise affords Progent the ability to knowledgably ascertain critical systems and re-organize the remaining parts of your Information Technology system following a ransomware penetration and assemble them into a functioning system.

Progent's security group uses powerful project management systems to orchestrate the complex restoration process. Progent knows the urgency of acting rapidly and in concert with a client's management and IT resources to prioritize tasks and to put essential services back on-line as fast as possible.

Customer Story: A Successful Ransomware Attack Response
A client sought out Progent after their network system was attacked by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean government sponsored criminal gangs, suspected of adopting techniques leaked from the United States National Security Agency. Ryuk attacks specific organizations with little or no tolerance for operational disruption and is among the most profitable examples of ransomware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing company based in Chicago with about 500 employees. The Ryuk event had disabled all business operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for good luck, but in the end made the decision to use Progent.

Progent worked together with the customer to quickly assess and prioritize the critical services that had to be addressed in order to continue business operations:

• Active Directory
• Email
• Financials/MRP

Within 2 days, Progent was able to rebuild Active Directory to its pre-penetration state. Progent then completed rebuilding and storage recovery of needed systems. All Microsoft Exchange Server ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to assemble intact OST data files (Outlook Off-Line Data Files) on various desktop computers to recover mail messages. A recent offline backup of the customer's manufacturing systems made them able to recover these essential services back online. Although a large amount of work was left to recover totally from the Ryuk event, the most important systems were returned to operations quickly:

During the following couple of weeks important milestones in the recovery process were completed in tight collaboration between Progent consultants and the client:

• In-house web applications were returned to operation without losing any information.
• The MailStore Exchange Server containing more than 4 million archived messages was spun up and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables/Inventory Control functions were 100 percent operational.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Nearly all of the desktops and laptops were being used by staff.

Conclusion
A possible company-ending catastrophe was avoided with hard-working professionals, a wide range of subject matter expertise, and close teamwork. Although upon completion of forensics the ransomware incident described here should have been stopped with modern cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and appropriate incident response procedures for backup and applying software patches, the reality is that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware incident, feel confident that Progent's roster of professionals has substantial experience in ransomware virus defense, mitigation, and file restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Chatsworth
For ransomware system recovery consulting in the Chatsworth metro area, call Progent at 800-462-8800 or visit Contact Progent.