Ransomware Defense and Removal Consulting Hartford

Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become an escalating cyberplague that represents an existential danger for businesses vulnerable to an assault. Different versions of ransomware like the CrySIS, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to inflict havoc. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as daily unnamed viruses, not only perform encryption of on-line information but also infect any configured system protection. Files replicated to cloud environments can also be encrypted. In a poorly designed system, it can render any restore operations hopeless and effectively sets the datacenter back to square one.

Getting back services and information after a crypto-ransomware attack becomes a race against the clock as the targeted business fights to stop lateral movement, clear the ransomware, and resume business-critical activity. Because ransomware needs time to replicate throughout a targeted network, assaults are usually sprung on weekends and holidays, when successful penetrations tend to take more time to notice. This multiplies the difficulty of quickly marshalling and orchestrating a capable response team.

Progent makes available an assortment of services for protecting Hartford organizations from crypto-ransomware penetrations. Among these are team member education to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat protection to identify and extinguish day-zero malware assaults. Progent in addition can provide the services of expert ransomware recovery professionals with the track record and perseverance to re-deploy a breached environment as urgently as possible.

Progent's Ransomware Recovery Help
Following a crypto-ransomware attack, even paying the ransom in cryptocurrency does not ensure that cyber criminals will provide the needed codes to decrypt all your data. Kaspersky estimated that seventeen percent of ransomware victims never restored their data after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to piece back together the critical parts of your IT environment. Without access to complete data backups, this calls for a broad complement of IT skills, well-coordinated project management, and the ability to work non-stop until the recovery project is completed.

For two decades, Progent has offered professional Information Technology services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned advanced industry certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial management and ERP application software. This breadth of expertise gives Progent the capability to knowledgably ascertain critical systems and integrate the surviving pieces of your Information Technology system after a crypto-ransomware penetration and configure them into an operational network.

Progent's ransomware group uses top notch project management systems to coordinate the sophisticated recovery process. Progent appreciates the importance of acting quickly and in unison with a client's management and IT team members to assign priority to tasks and to get the most important services back on-line as fast as humanly possible.

Case Study: A Successful Ransomware Penetration Response
A client sought out Progent after their company was attacked by the Ryuk ransomware. Ryuk is thought to have been launched by North Korean government sponsored cybercriminals, suspected of adopting strategies leaked from America's NSA organization. Ryuk targets specific organizations with little tolerance for operational disruption and is among the most profitable examples of ransomware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in Chicago and has around 500 employees. The Ryuk penetration had shut down all company operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the time of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (more than $200,000) and wishfully thinking for the best, but in the end engaged Progent.

Progent worked hand in hand the client to quickly identify and prioritize the critical services that had to be addressed to make it possible to continue company functions:

• Active Directory
• Microsoft Exchange
• Financials/MRP

Within 2 days, Progent was able to re-build Windows Active Directory to its pre-penetration state. Progent then assisted with rebuilding and storage recovery of key applications. All Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to assemble intact OST files (Outlook Email Offline Data Files) on staff desktop computers in order to recover email information. A not too old off-line backup of the businesses accounting/MRP software made it possible to recover these vital applications back servicing users. Although major work was left to recover fully from the Ryuk damage, essential services were recovered rapidly:

Throughout the following couple of weeks important milestones in the recovery project were made in tight collaboration between Progent engineers and the client:

• In-house web sites were restored with no loss of information.
• The MailStore Exchange Server with over 4 million archived messages was brought online and available for users.
• CRM/Product Ordering/Invoicing/AP/Accounts Receivables (AR)/Inventory functions were fully functional.
• A new Palo Alto Networks 850 security appliance was set up.
• Nearly all of the user PCs were operational.

Conclusion
A likely business disaster was dodged due to top-tier professionals, a broad range of knowledge, and close collaboration. Although upon completion of forensics the ransomware virus incident detailed here could have been identified and stopped with current cyber security solutions and recognized best practices, user and IT administrator training, and properly executed incident response procedures for data protection and applying software patches, the reality remains that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware incursion, remember that Progent's roster of professionals has substantial experience in ransomware virus defense, removal, and information systems restoration.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Hartford
For ransomware recovery expertise in the Hartford metro area, phone Progent at 800-462-8800 or see Contact Progent.