Ransomware Defense and Recovery Services Albuquerque

Crypto-Ransomware : Your Worst IT Catastrophe
Ransomware has become an escalating cyber pandemic that poses an extinction-level danger for businesses unprepared for an assault. Multiple generations of crypto-ransomware such as Dharma, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for a long time and continue to inflict damage. More recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, as well as additional unnamed newcomers, not only perform encryption of on-line files but also infiltrate most accessible system protection mechanisms. Files synchronized to off-premises disaster recovery sites can also be ransomed. In a vulnerable data protection solution, this can render automated restoration useless and effectively knocks the entire system back to zero.

Recovering services and information after a ransomware outage becomes a sprint against the clock as the targeted organization tries its best to stop the spread, cleanup the ransomware, and resume mission-critical operations. Since ransomware takes time to spread across a network, attacks are usually sprung at night, when successful attacks may take longer to identify. This compounds the difficulty of promptly marshalling and orchestrating a qualified response team.

Progent has a variety of help services for securing Albuquerque businesses from crypto-ransomware attacks. Among these are team training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat defense to detect and extinguish day-zero malware attacks. Progent in addition can provide the services of experienced ransomware recovery engineers with the talent and commitment to rebuild a breached network as quickly as possible.

Progent's Crypto-Ransomware Recovery Services
Soon after a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will provide the codes to decrypt all your files. Kaspersky Labs estimated that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The other path is to piece back together the critical parts of your IT environment. Without access to full information backups, this requires a wide complement of skills, top notch team management, and the ability to work 24x7 until the task is completed.

For twenty years, Progent has offered professional IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained top industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial systems and ERP applications. This breadth of expertise provides Progent the ability to rapidly understand critical systems and integrate the remaining components of your Information Technology environment after a ransomware penetration and rebuild them into a functioning system.

Progent's security group has state-of-the-art project management tools to coordinate the complicated recovery process. Progent appreciates the importance of acting quickly and in concert with a client's management and IT resources to assign priority to tasks and to get the most important applications back online as fast as humanly possible.

Client Case Study: A Successful Ransomware Virus Restoration
A business escalated to Progent after their network was penetrated by the Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean state criminal gangs, suspected of adopting technology exposed from the U.S. NSA organization. Ryuk attacks specific organizations with limited room for operational disruption and is among the most lucrative examples of ransomware viruses. Headline targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago with around 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the time of the attack and were damaged. The client was taking steps for paying the ransom demand (more than $200,000) and hoping for the best, but in the end engaged Progent.

Progent worked hand in hand the client to quickly get our arms around and prioritize the mission critical services that had to be addressed in order to resume business operations:

• Windows Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

Within 2 days, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then performed rebuilding and hard drive recovery of needed servers. All Microsoft Exchange Server data and attributes were intact, which accelerated the restore of Exchange. Progent was also able to find non-encrypted OST files (Outlook Off-Line Folder Files) on various PCs to recover mail messages. A not too old off-line backup of the client's accounting software made them able to return these vital services back on-line. Although a lot of work was left to recover fully from the Ryuk attack, essential services were restored quickly:

Throughout the following few weeks critical milestones in the restoration process were made in close collaboration between Progent consultants and the client:

• Internal web applications were restored without losing any data.
• The MailStore Exchange Server with over 4 million historical emails was spun up and available for users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory modules were completely functional.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Nearly all of the user PCs were fully operational.

Conclusion
A likely enterprise-killing catastrophe was averted by results-oriented experts, a wide spectrum of knowledge, and tight collaboration. Although upon completion of forensics the ransomware attack detailed here would have been stopped with current security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and properly executed security procedures for information protection and proper patching controls, the fact remains that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, remember that Progent's roster of professionals has extensive experience in ransomware virus blocking, cleanup, and data restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Albuquerque
For ransomware system recovery consulting services in the Albuquerque metro area, phone Progent at 800-462-8800 or see Contact Progent.