Ransomware Defense and Restoration Expertise Cleveland
Crypto-Ransomware Recovery: An Example
Crypto-Ransomware : Your Crippling IT Disaster
Crypto-Ransomware has become a too-frequent cyberplague that represents an existential threat for businesses of all sizes unprepared for an attack. Different iterations of ransomware like the Reveton, Fusob, Locky, NotPetya and MongoLock cryptoworms have been around for many years and continue to cause damage. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, as well as frequent unnamed newcomers, not only perform encryption of online files but also infiltrate any available system backups. Data synchronized to cloud environments can also be ransomed. In a poorly architected data protection solution, this can render automatic restore operations hopeless and effectively knocks the network back to square one.
Getting back online applications and data after a ransomware event becomes a sprint against the clock as the victim struggles to stop lateral movement, cleanup the virus, and restore enterprise-critical activity. Because crypto-ransomware takes time to replicate across a network, penetrations are usually launched during nights and weekends, when successful penetrations in many cases take longer to identify. This multiplies the difficulty of promptly marshalling and orchestrating a knowledgeable response team.
Progent has an assortment of services for protecting Cleveland enterprises from ransomware penetrations. These include team member education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based threat defense to detect and extinguish zero-day modern malware assaults. Progent also provides the services of veteran crypto-ransomware recovery engineers with the skills and commitment to restore a breached network as urgently as possible.
Progent's Crypto-Ransomware Restoration Help
Subsequent to a ransomware event, sending the ransom demands in cryptocurrency does not ensure that distant criminals will respond with the needed codes to decipher any of your data. Kaspersky ascertained that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to setup from scratch the mission-critical parts of your Information Technology environment. Absent the availability of full data backups, this requires a broad complement of IT skills, top notch project management, and the ability to work 24x7 until the task is done.
For twenty years, Progent has made available expert IT services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained top certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of experience provides Progent the capability to efficiently determine critical systems and re-organize the remaining parts of your IT system after a crypto-ransomware event and assemble them into an operational system.
Progent's recovery team of experts utilizes top notch project management tools to coordinate the complex restoration process. Progent knows the importance of working rapidly and together with a client's management and IT staff to assign priority to tasks and to put the most important services back on line as soon as humanly possible.
Customer Case Study: A Successful Ransomware Penetration Response
A small business contacted Progent after their network was penetrated by the Ryuk ransomware virus. Ryuk is believed to have been developed by North Korean government sponsored cybercriminals, possibly adopting technology leaked from America's National Security Agency. Ryuk targets specific companies with little ability to sustain operational disruption and is one of the most profitable iterations of ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer based in Chicago and has about 500 workers. The Ryuk attack had brought down all essential operations and manufacturing capabilities. The majority of the client's system backups had been directly accessible at the time of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom (in excess of $200,000) and wishfully thinking for good luck, but ultimately engaged Progent.
Progent worked with the customer to quickly get our arms around and prioritize the most important services that needed to be addressed to make it possible to restart business operations:
- Windows Active Directory
- Microsoft Exchange
- Financials/MRP
In less than two days, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then completed rebuilding and storage recovery of needed systems. All Microsoft Exchange Server data and attributes were usable, which greatly helped the restore of Exchange. Progent was able to collect local OST data files (Outlook Email Off-Line Data Files) on team PCs in order to recover mail messages. A recent offline backup of the client's financials/MRP systems made it possible to recover these essential applications back online for users. Although major work was left to recover fully from the Ryuk virus, critical systems were restored rapidly:
Throughout the next few weeks key milestones in the recovery process were completed in tight cooperation between Progent consultants and the customer:
- Self-hosted web sites were brought back up without losing any information.
- The MailStore Server exceeding four million archived messages was brought on-line and accessible to users.
- CRM/Product Ordering/Invoicing/AP/AR/Inventory functions were fully functional.
- A new Palo Alto 850 security appliance was installed.
- Ninety percent of the user desktops were being used by staff.
Conclusion
A potential company-ending disaster was dodged by top-tier experts, a broad range of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware penetration described here should have been identified and blocked with advanced cyber security systems and NIST Cybersecurity Framework best practices, staff training, and appropriate incident response procedures for backup and keeping systems up to date with security patches, the fact remains that government-sponsored cybercriminals from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's roster of professionals has proven experience in ransomware virus defense, remediation, and data restoration.
Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Consulting in Cleveland
For ransomware cleanup consulting in the Cleveland area, phone Progent at
Select Topic: