Ransomware Protection and Remediation Expertise Montgomery

Ransomware : Your Worst IT Nightmare
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an existential threat for businesses vulnerable to an assault. Different versions of crypto-ransomware such as Dharma, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for years and still inflict damage. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus daily as yet unnamed malware, not only encrypt on-line critical data but also infiltrate many available system backup. Files synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly architected system, this can make automatic recovery useless and basically sets the datacenter back to zero.

Getting back services and data after a ransomware event becomes a race against time as the targeted organization fights to stop the spread, remove the ransomware, and restore mission-critical operations. Since ransomware requires time to spread throughout a targeted network, assaults are frequently launched on weekends, when successful penetrations are likely to take more time to identify. This compounds the difficulty of quickly marshalling and orchestrating an experienced mitigation team.

Progent makes available a variety of services for protecting Montgomery businesses from crypto-ransomware events. Among these are team training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based threat defense to discover and quarantine day-zero malware attacks. Progent in addition can provide the assistance of seasoned ransomware recovery engineers with the talent and perseverance to reconstruct a compromised network as urgently as possible.

Progent's Ransomware Recovery Support Services
Following a ransomware event, even paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will provide the needed codes to decipher any of your data. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The other path is to re-install the mission-critical parts of your Information Technology environment. Without the availability of complete data backups, this requires a wide complement of skill sets, top notch project management, and the ability to work non-stop until the job is complete.

For decades, Progent has made available expert IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned advanced certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have garnered internationally-recognized certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP applications. This breadth of experience provides Progent the capability to rapidly determine critical systems and re-organize the surviving pieces of your Information Technology system following a ransomware penetration and rebuild them into a functioning system.

Progent's security team utilizes best of breed project management systems to orchestrate the complicated recovery process. Progent appreciates the importance of acting quickly and together with a customer's management and Information Technology staff to assign priority to tasks and to get key services back on-line as fast as humanly possible.

Client Story: A Successful Ransomware Virus Restoration
A client contacted Progent after their organization was crashed by the Ryuk ransomware virus. Ryuk is thought to have been launched by North Korean state sponsored cybercriminals, possibly using technology exposed from America's National Security Agency. Ryuk targets specific businesses with little or no ability to sustain operational disruption and is among the most lucrative instances of ransomware malware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company located in Chicago with about 500 employees. The Ryuk attack had frozen all business operations and manufacturing capabilities. The majority of the client's information backups had been online at the time of the attack and were damaged. The client was pursuing financing for paying the ransom (in excess of $200,000) and wishfully thinking for the best, but ultimately called Progent.

Progent worked together with the client to rapidly assess and assign priority to the essential services that had to be restored in order to continue business operations:

• Windows Active Directory
• Microsoft Exchange Email
• MRP System

In less than 2 days, Progent was able to recover Active Directory to its pre-attack state. Progent then initiated rebuilding and storage recovery of essential applications. All Microsoft Exchange Server ties and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to locate intact OST files (Outlook Offline Data Files) on staff PCs and laptops in order to recover email messages. A not too old off-line backup of the businesses financials/MRP software made them able to restore these vital programs back online for users. Although major work needed to be completed to recover fully from the Ryuk damage, core systems were returned to operations rapidly:

Throughout the next month critical milestones in the recovery process were completed in close collaboration between Progent team members and the customer:

• Internal web applications were brought back up without losing any information.
• The MailStore Exchange Server with over 4 million archived messages was spun up and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory capabilities were 100 percent functional.
• A new Palo Alto Networks 850 firewall was installed.
• 90% of the user PCs were being used by staff.

Conclusion
A likely business-ending disaster was dodged due to top-tier experts, a wide range of IT skills, and close collaboration. Although upon completion of forensics the ransomware virus incident described here should have been identified and stopped with advanced security solutions and security best practices, user education, and appropriate incident response procedures for data protection and keeping systems up to date with security patches, the reality is that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware penetration, remember that Progent's team of experts has extensive experience in crypto-ransomware virus blocking, remediation, and data recovery.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Montgomery
For ransomware recovery consulting services in the Montgomery area, call Progent at 800-462-8800 or visit Contact Progent.