Ransomware Protection and Restoration Solutions Chandler

Ransomware : Your Worst IT Nightmare
Ransomware has become an escalating cyberplague that represents an extinction-level danger for organizations unprepared for an attack. Multiple generations of ransomware like the CryptoLocker, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for many years and still inflict harm. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, along with additional unnamed viruses, not only perform encryption of online data but also infect all configured system protection. Data synched to cloud environments can also be encrypted. In a vulnerable data protection solution, this can render automatic restore operations impossible and basically knocks the datacenter back to zero.

Retrieving applications and data following a ransomware event becomes a sprint against time as the victim fights to contain the damage, clear the ransomware, and resume enterprise-critical operations. Since ransomware requires time to spread across a targeted network, attacks are frequently sprung on weekends and holidays, when penetrations tend to take more time to uncover. This compounds the difficulty of quickly mobilizing and orchestrating a capable mitigation team.

Progent makes available an assortment of support services for securing Chandler enterprises from crypto-ransomware attacks. These include team member education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat defense to identify and quarantine day-zero modern malware attacks. Progent in addition offers the services of seasoned ransomware recovery professionals with the skills and commitment to rebuild a compromised system as rapidly as possible.

Progent's Ransomware Recovery Support Services
Following a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not ensure that distant criminals will return the codes to unencrypt any or all of your files. Kaspersky estimated that 17% of crypto-ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to piece back together the essential components of your IT environment. Without the availability of complete system backups, this calls for a wide complement of skills, well-coordinated project management, and the capability to work 24x7 until the job is done.

For two decades, Progent has provided expert IT services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded high-level certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of experience affords Progent the skills to efficiently ascertain important systems and consolidate the remaining pieces of your Information Technology environment following a crypto-ransomware attack and assemble them into an operational system.

Progent's recovery team of experts deploys powerful project management systems to orchestrate the sophisticated restoration process. Progent appreciates the urgency of working swiftly and in unison with a customer's management and Information Technology resources to assign priority to tasks and to put critical services back on line as soon as humanly possible.

Business Case Study: A Successful Ransomware Penetration Response
A business hired Progent after their company was taken over by the Ryuk ransomware. Ryuk is thought to have been launched by North Korean state hackers, suspected of using techniques exposed from America's NSA organization. Ryuk attacks specific businesses with little or no ability to sustain operational disruption and is one of the most profitable examples of ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in the Chicago metro area with about 500 workers. The Ryuk penetration had brought down all company operations and manufacturing processes. The majority of the client's system backups had been on-line at the time of the intrusion and were damaged. The client considered paying the ransom demand (exceeding $200,000) and praying for the best, but ultimately utilized Progent.

Progent worked together with the client to rapidly identify and assign priority to the critical areas that needed to be recovered in order to resume business functions:

• Microsoft Active Directory
• Email
• Financials/MRP

In less than 2 days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then assisted with reinstallations and storage recovery on needed servers. All Microsoft Exchange Server data and attributes were intact, which greatly helped the restore of Exchange. Progent was able to assemble intact OST data files (Outlook Email Off-Line Data Files) on user workstations and laptops to recover email information. A recent off-line backup of the customer's accounting software made it possible to recover these required services back on-line. Although significant work still had to be done to recover totally from the Ryuk attack, critical systems were restored rapidly:

Throughout the following few weeks critical milestones in the recovery project were achieved through close cooperation between Progent consultants and the customer:

• Self-hosted web sites were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server containing more than 4 million historical messages was brought online and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were fully recovered.
• A new Palo Alto 850 security appliance was brought online.
• 90% of the user workstations were operational.

Conclusion
A likely business catastrophe was evaded due to results-oriented experts, a broad spectrum of technical expertise, and tight collaboration. Although upon completion of forensics the ransomware virus penetration described here should have been shut down with up-to-date cyber security solutions and ISO/IEC 27001 best practices, user education, and appropriate incident response procedures for data protection and proper patching controls, the reality is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's roster of experts has a proven track record in crypto-ransomware virus blocking, removal, and information systems recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Chandler
For ransomware cleanup consulting services in the Chandler area, phone Progent at 800-462-8800 or go to Contact Progent.