Ransomware Protection and Recovery Solutions Virginia Beach

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a modern cyber pandemic that represents an existential threat for organizations poorly prepared for an assault. Different versions of ransomware such as CryptoLocker, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for a long time and still inflict havoc. Modern variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus more unnamed malware, not only perform encryption of online critical data but also infiltrate many configured system backups. Files synched to off-premises disaster recovery sites can also be corrupted. In a poorly architected data protection solution, this can make automated restoration hopeless and effectively knocks the datacenter back to zero.

Restoring services and information after a ransomware outage becomes a race against the clock as the targeted business tries its best to stop the spread, remove the ransomware, and resume business-critical activity. Due to the fact that ransomware takes time to replicate throughout a targeted network, attacks are usually launched during weekends and nights, when attacks are likely to take more time to detect. This multiplies the difficulty of promptly assembling and organizing a knowledgeable response team.

Progent makes available an assortment of help services for securing Virginia Beach enterprises from crypto-ransomware penetrations. Among these are staff training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat defense to detect and disable zero-day modern malware attacks. Progent also offers the assistance of veteran crypto-ransomware recovery consultants with the skills and perseverance to reconstruct a compromised network as quickly as possible.

Progent's Crypto-Ransomware Recovery Services
After a ransomware penetration, paying the ransom demands in cryptocurrency does not guarantee that distant criminals will respond with the needed codes to decipher all your data. Kaspersky estimated that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to re-install the critical components of your Information Technology environment. Absent the availability of complete system backups, this calls for a wide complement of IT skills, professional team management, and the capability to work non-stop until the job is complete.

For two decades, Progent has offered professional Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded high-level industry certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-recognized certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience provides Progent the ability to rapidly determine critical systems and organize the surviving pieces of your computer network system after a crypto-ransomware event and configure them into a functioning system.

Progent's ransomware team deploys state-of-the-art project management systems to orchestrate the sophisticated recovery process. Progent appreciates the importance of working swiftly and in concert with a customer's management and IT team members to assign priority to tasks and to get critical systems back online as fast as possible.

Customer Case Study: A Successful Crypto-Ransomware Virus Recovery
A customer contacted Progent after their network system was penetrated by Ryuk ransomware virus. Ryuk is thought to have been launched by North Korean government sponsored cybercriminals, possibly using techniques exposed from America's NSA organization. Ryuk goes after specific businesses with little or no tolerance for operational disruption and is among the most profitable examples of ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in the Chicago metro area with about 500 workers. The Ryuk penetration had disabled all company operations and manufacturing capabilities. The majority of the client's system backups had been online at the beginning of the attack and were destroyed. The client was taking steps for paying the ransom (in excess of $200,000) and praying for the best, but ultimately utilized Progent.

Progent worked hand in hand the customer to quickly determine and assign priority to the most important systems that needed to be addressed in order to continue business operations:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting/MRP

In less than 48 hours, Progent was able to restore Active Directory to its pre-attack state. Progent then assisted with setup and storage recovery on needed systems. All Microsoft Exchange Server schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to find non-encrypted OST files (Outlook Off-Line Data Files) on team PCs in order to recover mail information. A not too old off-line backup of the client's accounting software made it possible to recover these required programs back available to users. Although a large amount of work was left to recover totally from the Ryuk attack, essential services were recovered rapidly:

Over the next few weeks critical milestones in the recovery project were achieved in close collaboration between Progent engineers and the client:

• In-house web applications were brought back up with no loss of data.
• The MailStore Server exceeding four million archived emails was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control capabilities were 100% restored.
• A new Palo Alto Networks 850 security appliance was installed.
• Ninety percent of the user workstations were fully operational.

Conclusion
A likely business catastrophe was evaded with hard-working experts, a wide spectrum of knowledge, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware virus attack detailed here could have been disabled with modern security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and well thought out incident response procedures for data backup and proper patching controls, the fact remains that government-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's team of experts has proven experience in ransomware virus blocking, mitigation, and file disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Virginia Beach
For ransomware recovery consulting in the Virginia Beach metro area, call Progent at 800-462-8800 or visit Contact Progent.