Ransomware Protection and Restoration Expertise Springfield

Crypto-Ransomware : Your Worst IT Disaster
Ransomware has become a too-frequent cyber pandemic that represents an enterprise-level threat for organizations poorly prepared for an assault. Multiple generations of crypto-ransomware like the CrySIS, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for years and still inflict damage. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus additional as yet unnamed malware, not only encrypt online information but also infiltrate most configured system backup. Files replicated to the cloud can also be rendered useless. In a poorly designed system, it can make automatic restoration useless and basically knocks the datacenter back to zero.

Getting back online programs and information following a ransomware attack becomes a race against time as the victim struggles to contain the damage, eradicate the ransomware, and restore business-critical operations. Due to the fact that crypto-ransomware requires time to spread across a targeted network, assaults are usually launched at night, when successful penetrations tend to take longer to recognize. This multiplies the difficulty of quickly mobilizing and organizing a capable mitigation team.

Progent makes available an assortment of solutions for securing Springfield organizations from crypto-ransomware events. These include team member education to help recognize and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat defense to identify and disable zero-day malware assaults. Progent in addition provides the assistance of experienced crypto-ransomware recovery engineers with the talent and perseverance to rebuild a compromised environment as rapidly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a ransomware event, sending the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will return the codes to decrypt all your information. Kaspersky determined that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to re-install the critical parts of your Information Technology environment. Without access to full data backups, this calls for a wide range of IT skills, professional project management, and the capability to work non-stop until the recovery project is completed.

For decades, Progent has made available expert Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned advanced industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of expertise gives Progent the skills to efficiently identify necessary systems and organize the remaining pieces of your Information Technology environment following a crypto-ransomware attack and assemble them into a functioning network.

Progent's ransomware group utilizes powerful project management applications to orchestrate the complicated restoration process. Progent appreciates the importance of working swiftly and in concert with a customer's management and Information Technology team members to assign priority to tasks and to get the most important systems back on line as fast as possible.

Customer Story: A Successful Crypto-Ransomware Intrusion Restoration
A business hired Progent after their organization was penetrated by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state cybercriminals, possibly using approaches exposed from America's NSA organization. Ryuk targets specific companies with little tolerance for disruption and is among the most profitable examples of ransomware viruses. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing business located in the Chicago metro area and has around 500 workers. The Ryuk event had shut down all business operations and manufacturing processes. Most of the client's backups had been online at the start of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (exceeding $200,000) and praying for good luck, but in the end brought in Progent.

Progent worked together with the customer to rapidly identify and assign priority to the critical applications that needed to be restored to make it possible to resume business functions:

• Windows Active Directory
• E-Mail
• Financials/MRP

Within 2 days, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then helped perform reinstallations and hard drive recovery of needed servers. All Exchange data and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to collect intact OST data files (Microsoft Outlook Off-Line Folder Files) on user desktop computers to recover email data. A recent offline backup of the businesses financials/MRP systems made it possible to recover these vital applications back online for users. Although significant work remained to recover fully from the Ryuk virus, critical services were restored rapidly:

Throughout the next couple of weeks key milestones in the restoration process were accomplished in close cooperation between Progent engineers and the customer:

• Internal web applications were returned to operation with no loss of data.
• The MailStore Exchange Server with over four million historical emails was brought on-line and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory modules were 100% operational.
• A new Palo Alto Networks 850 security appliance was installed.
• Most of the desktops and laptops were fully operational.

Conclusion
A potential enterprise-killing disaster was averted through the efforts of top-tier experts, a broad spectrum of knowledge, and tight collaboration. Although in post mortem the ransomware incident detailed here should have been identified and prevented with advanced security systems and ISO/IEC 27001 best practices, user education, and well designed incident response procedures for data protection and keeping systems up to date with security patches, the reality remains that government-sponsored cyber criminals from China, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware penetration, remember that Progent's roster of professionals has substantial experience in crypto-ransomware virus defense, removal, and information systems restoration.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Springfield
For ransomware cleanup services in the Springfield area, phone Progent at 800-462-8800 or go to Contact Progent.