Ransomware Defense and Removal Services Porto Alegre

Crypto-Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become a too-frequent cyberplague that represents an existential danger for businesses of all sizes unprepared for an attack. Multiple generations of ransomware such as CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for many years and continue to inflict havoc. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, plus more unnamed viruses, not only encrypt online data files but also infect most accessible system protection. Data synched to the cloud can also be corrupted. In a poorly architected environment, it can render any restore operations useless and effectively sets the datacenter back to square one.

Recovering applications and data following a ransomware outage becomes a race against the clock as the targeted organization tries its best to stop lateral movement, clear the ransomware, and restore mission-critical activity. Because ransomware takes time to move laterally across a targeted network, attacks are frequently sprung during nights and weekends, when successful attacks in many cases take more time to recognize. This multiplies the difficulty of quickly mobilizing and organizing a knowledgeable response team.

Progent provides a range of help services for protecting Porto Alegre organizations from ransomware penetrations. These include team member education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to detect and quarantine day-zero modern malware attacks. Progent in addition provides the services of veteran ransomware recovery engineers with the track record and commitment to rebuild a compromised network as soon as possible.

Progent's Ransomware Restoration Support Services
Soon after a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not ensure that cyber hackers will provide the keys to decipher any or all of your data. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their data even after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to setup from scratch the critical elements of your IT environment. Without access to essential data backups, this calls for a broad complement of skill sets, top notch team management, and the willingness to work 24x7 until the task is completed.

For two decades, Progent has provided expert IT services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have earned top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of experience affords Progent the ability to quickly identify important systems and re-organize the remaining components of your computer network environment after a ransomware event and configure them into a functioning network.

Progent's recovery team deploys top notch project management applications to orchestrate the complex recovery process. Progent knows the urgency of working quickly and together with a customer's management and Information Technology team members to assign priority to tasks and to get essential services back online as soon as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Incident Restoration
A small business engaged Progent after their network system was brought down by Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean state sponsored hackers, possibly adopting approaches leaked from America's National Security Agency. Ryuk goes after specific companies with limited room for disruption and is one of the most profitable examples of ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in Chicago with around 500 staff members. The Ryuk penetration had shut down all business operations and manufacturing processes. Most of the client's information backups had been on-line at the time of the attack and were encrypted. The client considered paying the ransom (exceeding $200K) and wishfully thinking for the best, but in the end called Progent.

Progent worked hand in hand the client to rapidly assess and assign priority to the critical services that had to be addressed to make it possible to resume departmental operations:

• Windows Active Directory
• Microsoft Exchange Email
• MRP System

In less than 48 hours, Progent was able to re-build Active Directory to its pre-virus state. Progent then initiated reinstallations and storage recovery of critical systems. All Exchange ties and configuration information were usable, which greatly helped the restore of Exchange. Progent was also able to assemble non-encrypted OST data files (Outlook Email Offline Data Files) on team PCs to recover email messages. A recent off-line backup of the businesses accounting/ERP software made it possible to restore these essential programs back servicing users. Although significant work needed to be completed to recover totally from the Ryuk event, the most important systems were returned to operations quickly:

Over the following month important milestones in the recovery project were achieved through close collaboration between Progent engineers and the customer:

• Self-hosted web sites were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server exceeding 4 million archived messages was brought online and available for users.
• CRM/Product Ordering/Invoicing/AP/Accounts Receivables/Inventory Control capabilities were 100 percent restored.
• A new Palo Alto 850 security appliance was installed and configured.
• Nearly all of the desktop computers were back into operation.

Conclusion
A probable business extinction disaster was avoided through the efforts of dedicated professionals, a wide range of subject matter expertise, and close teamwork. Although in post mortem the ransomware virus penetration described here could have been stopped with current security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and properly executed security procedures for data backup and proper patching controls, the reality remains that government-sponsored hackers from China, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware penetration, remember that Progent's team of experts has extensive experience in crypto-ransomware virus defense, mitigation, and data restoration.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Porto Alegre
For ransomware cleanup expertise in the Porto Alegre metro area, phone Progent at 800-462-8800 or see Contact Progent.