Ransomware Protection and Removal Services San Juan

Ransomware : Your Crippling IT Disaster
Crypto-Ransomware has become a modern cyberplague that represents an existential threat for businesses vulnerable to an assault. Different iterations of ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for a long time and still inflict harm. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, along with frequent unnamed viruses, not only encrypt online files but also infect any configured system protection. Data synched to off-premises disaster recovery sites can also be ransomed. In a poorly designed system, it can make any recovery hopeless and basically knocks the entire system back to zero.

Restoring programs and data after a ransomware attack becomes a sprint against the clock as the targeted organization tries its best to stop the spread, eradicate the ransomware, and restore mission-critical operations. Since ransomware requires time to move laterally across a targeted network, assaults are usually sprung at night, when attacks in many cases take longer to notice. This multiplies the difficulty of quickly marshalling and coordinating a knowledgeable mitigation team.

Progent provides a variety of help services for securing San Juan organizations from crypto-ransomware attacks. These include user education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to discover and suppress day-zero malware assaults. Progent in addition provides the services of experienced ransomware recovery engineers with the skills and commitment to re-deploy a breached network as soon as possible.

Progent's Ransomware Restoration Help
After a ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that cyber criminals will respond with the codes to unencrypt all your files. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The fallback is to setup from scratch the critical elements of your Information Technology environment. Absent the availability of complete system backups, this requires a broad range of skill sets, top notch team management, and the ability to work 24x7 until the recovery project is over.

For decades, Progent has made available certified expert IT services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded high-level certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial systems and ERP application software. This breadth of experience affords Progent the capability to quickly understand important systems and consolidate the remaining parts of your IT system after a crypto-ransomware event and configure them into an operational system.

Progent's ransomware team has top notch project management applications to orchestrate the sophisticated restoration process. Progent appreciates the urgency of acting swiftly and in concert with a customer's management and IT resources to prioritize tasks and to get critical applications back online as soon as humanly possible.

Customer Story: A Successful Ransomware Attack Restoration
A small business escalated to Progent after their network system was attacked by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state sponsored cybercriminals, suspected of using techniques exposed from America's NSA organization. Ryuk goes after specific organizations with little or no tolerance for operational disruption and is among the most profitable instances of crypto-ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer based in the Chicago metro area and has around 500 staff members. The Ryuk penetration had brought down all business operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the time of the intrusion and were encrypted. The client was evaluating paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but ultimately engaged Progent.

Progent worked hand in hand the client to quickly assess and assign priority to the essential systems that had to be recovered to make it possible to continue departmental operations:

• Windows Active Directory
• Exchange Server
• Accounting/MRP

Within two days, Progent was able to re-build Active Directory to its pre-attack state. Progent then completed setup and hard drive recovery on needed applications. All Exchange schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was also able to locate local OST files (Microsoft Outlook Offline Data Files) on team workstations and laptops to recover mail information. A recent offline backup of the client's manufacturing software made them able to return these vital programs back online. Although a large amount of work remained to recover totally from the Ryuk attack, core systems were returned to operations rapidly:

Throughout the following month important milestones in the restoration process were made in close collaboration between Progent team members and the customer:

• Self-hosted web applications were brought back up with no loss of data.
• The MailStore Server containing more than four million historical emails was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control modules were fully functional.
• A new Palo Alto 850 firewall was brought online.
• Most of the user workstations were being used by staff.

Conclusion
A likely enterprise-killing catastrophe was avoided through the efforts of dedicated experts, a broad array of knowledge, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration detailed here would have been identified and prevented with advanced security technology solutions and ISO/IEC 27001 best practices, user and IT administrator training, and well thought out incident response procedures for information backup and applying software patches, the fact remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's roster of experts has substantial experience in ransomware virus blocking, remediation, and information systems disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in San Juan
For ransomware cleanup services in the San Juan metro area, phone Progent at 800-462-8800 or see Contact Progent.