Ransomware Prevention and Remediation Solutions Chesapeake

Ransomware : Your Crippling IT Catastrophe
Ransomware has become a modern cyber pandemic that represents an existential danger for businesses unprepared for an assault. Different versions of ransomware like the Dharma, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for a long time and still cause destruction. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as additional unnamed malware, not only encrypt on-line data but also infect any available system protection mechanisms. Information synchronized to the cloud can also be corrupted. In a poorly designed data protection solution, it can make automated restoration impossible and basically sets the datacenter back to zero.

Getting back on-line programs and information after a ransomware intrusion becomes a sprint against time as the targeted business tries its best to stop lateral movement, cleanup the crypto-ransomware, and resume enterprise-critical activity. Due to the fact that ransomware requires time to replicate throughout a targeted network, attacks are often sprung on weekends and holidays, when penetrations may take more time to notice. This multiplies the difficulty of promptly marshalling and coordinating an experienced mitigation team.

Progent has an assortment of support services for securing Chesapeake organizations from ransomware penetrations. Among these are staff training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to identify and quarantine zero-day malware assaults. Progent in addition offers the assistance of veteran ransomware recovery engineers with the talent and commitment to re-deploy a compromised network as urgently as possible.

Progent's Ransomware Restoration Services
Soon after a crypto-ransomware event, even paying the ransom in cryptocurrency does not ensure that criminal gangs will provide the keys to decrypt all your data. Kaspersky determined that 17% of ransomware victims never recovered their information even after having paid the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to re-install the essential parts of your Information Technology environment. Without the availability of full data backups, this calls for a broad range of IT skills, professional team management, and the ability to work continuously until the recovery project is finished.

For decades, Progent has offered certified expert IT services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have been awarded high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of expertise gives Progent the skills to efficiently determine critical systems and organize the surviving parts of your Information Technology environment following a ransomware event and assemble them into a functioning system.

Progent's recovery team of experts has best of breed project management systems to orchestrate the complex recovery process. Progent appreciates the importance of acting rapidly and in concert with a client's management and Information Technology resources to prioritize tasks and to get essential applications back on-line as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Penetration Restoration
A business contacted Progent after their organization was penetrated by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state criminal gangs, suspected of adopting technology exposed from the U.S. National Security Agency. Ryuk targets specific businesses with limited room for disruption and is among the most lucrative versions of ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in Chicago with about 500 workers. The Ryuk event had disabled all business operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the start of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but ultimately brought in Progent.

Progent worked together with the client to rapidly get our arms around and prioritize the critical services that had to be restored in order to restart business functions:

• Active Directory (AD)
• Electronic Messaging
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to restore Active Directory services to its pre-penetration state. Progent then performed reinstallations and storage recovery on needed servers. All Exchange Server schema and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to assemble intact OST files (Outlook Offline Folder Files) on user workstations and laptops in order to recover email information. A recent off-line backup of the customer's financials/ERP software made it possible to recover these essential applications back servicing users. Although a lot of work needed to be completed to recover totally from the Ryuk event, core systems were restored rapidly:

Throughout the following couple of weeks critical milestones in the recovery project were completed through tight cooperation between Progent consultants and the client:

• In-house web sites were restored without losing any data.
• The MailStore Server exceeding 4 million archived messages was brought online and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory modules were 100 percent functional.
• A new Palo Alto 850 security appliance was installed and configured.
• 90% of the desktop computers were functioning as before the incident.

Conclusion
A probable enterprise-killing catastrophe was avoided with dedicated experts, a broad spectrum of technical expertise, and tight collaboration. Although in retrospect the crypto-ransomware incident detailed here would have been blocked with up-to-date cyber security solutions and NIST Cybersecurity Framework best practices, staff training, and appropriate security procedures for data backup and proper patching controls, the fact remains that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of professionals has substantial experience in ransomware virus blocking, remediation, and information systems restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Chesapeake
For ransomware cleanup expertise in the Chesapeake metro area, call Progent at 800-462-8800 or visit Contact Progent.