Ransomware Protection and Recovery Solutions Clearwater

Ransomware : Your Feared IT Catastrophe
Ransomware has become a modern cyber pandemic that poses an extinction-level danger for businesses of all sizes unprepared for an assault. Different versions of ransomware like the CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for a long time and continue to inflict damage. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, plus frequent as yet unnamed newcomers, not only perform encryption of online data but also infiltrate most accessible system backup. Information replicated to off-premises disaster recovery sites can also be rendered useless. In a poorly architected system, it can render any restore operations impossible and basically sets the network back to zero.

Getting back programs and data after a crypto-ransomware intrusion becomes a race against time as the targeted organization fights to stop the spread, cleanup the ransomware, and resume business-critical operations. Due to the fact that crypto-ransomware needs time to spread throughout a network, penetrations are usually launched on weekends and holidays, when penetrations are likely to take more time to detect. This compounds the difficulty of promptly marshalling and organizing an experienced mitigation team.

Progent offers a range of help services for securing Clearwater organizations from ransomware penetrations. These include user education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to identify and disable day-zero modern malware attacks. Progent also provides the assistance of seasoned crypto-ransomware recovery consultants with the track record and perseverance to restore a breached network as urgently as possible.

Progent's Ransomware Recovery Help
Following a ransomware attack, paying the ransom in cryptocurrency does not provide any assurance that distant criminals will return the needed keys to decipher any or all of your information. Kaspersky Labs estimated that seventeen percent of ransomware victims never recovered their information after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to re-install the critical elements of your Information Technology environment. Without the availability of complete information backups, this calls for a broad complement of IT skills, top notch project management, and the ability to work non-stop until the task is finished.

For decades, Progent has made available professional Information Technology services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have earned top certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-recognized certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial systems and ERP application software. This breadth of expertise gives Progent the ability to knowledgably identify important systems and integrate the surviving pieces of your network system following a ransomware penetration and rebuild them into a functioning system.

Progent's recovery team of experts utilizes state-of-the-art project management tools to coordinate the complicated restoration process. Progent knows the importance of working quickly and together with a client's management and IT staff to prioritize tasks and to get the most important applications back on line as soon as humanly possible.

Business Case Study: A Successful Ransomware Penetration Recovery
A client escalated to Progent after their network was brought down by the Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state hackers, possibly using algorithms leaked from the United States NSA organization. Ryuk goes after specific companies with little or no ability to sustain operational disruption and is among the most profitable instances of ransomware viruses. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business located in the Chicago metro area with about 500 employees. The Ryuk intrusion had paralyzed all essential operations and manufacturing processes. Most of the client's data backups had been on-line at the time of the attack and were encrypted. The client was evaluating paying the ransom (exceeding $200K) and praying for good luck, but ultimately reached out to Progent.

Progent worked together with the customer to rapidly get our arms around and assign priority to the essential systems that needed to be recovered to make it possible to continue departmental functions:

• Windows Active Directory
• Electronic Mail
• Financials/MRP

In less than 48 hours, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then accomplished setup and storage recovery on needed servers. All Microsoft Exchange Server ties and attributes were intact, which accelerated the restore of Exchange. Progent was able to locate local OST files (Microsoft Outlook Offline Data Files) on various desktop computers to recover mail information. A not too old off-line backup of the client's accounting/MRP software made them able to return these vital applications back online. Although a large amount of work needed to be completed to recover fully from the Ryuk damage, essential systems were restored rapidly:

Over the following couple of weeks critical milestones in the restoration project were achieved through tight collaboration between Progent team members and the customer:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Exchange Server containing more than four million historical messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory modules were completely recovered.
• A new Palo Alto 850 security appliance was installed.
• Nearly all of the user desktops were being used by staff.

Conclusion
A potential business extinction disaster was dodged with dedicated experts, a broad spectrum of knowledge, and tight collaboration. Although upon completion of forensics the ransomware penetration described here should have been identified and disabled with up-to-date security solutions and security best practices, staff education, and properly executed security procedures for data protection and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's team of experts has a proven track record in ransomware virus blocking, removal, and data disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Clearwater
For ransomware recovery consulting services in the Clearwater metro area, phone Progent at 800-462-8800 or go to Contact Progent.