Ransomware Prevention and Restoration Expertise Midtown Manhattan

Ransomware : Your Worst Information Technology Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that presents an existential danger for organizations poorly prepared for an attack. Versions of ransomware like the CrySIS, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for years and still inflict destruction. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus additional unnamed newcomers, not only encrypt online data files but also infect all configured system protection. Data synched to off-premises disaster recovery sites can also be corrupted. In a vulnerable data protection solution, it can make automatic recovery impossible and effectively sets the datacenter back to zero.

Recovering programs and information after a ransomware intrusion becomes a sprint against time as the targeted business struggles to contain, cleanup the ransomware, and restore mission-critical operations. Because crypto-ransomware needs time to move laterally across a targeted network, attacks are frequently sprung at night, when attacks may take longer to uncover. This compounds the difficulty of promptly mobilizing and coordinating a qualified mitigation team.

Progent offers a variety of help services for protecting Midtown Manhattan enterprises from ransomware penetrations. These include team training to help identify and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to identify and suppress day-zero malware attacks. Progent also offers the assistance of seasoned crypto-ransomware recovery engineers with the skills and perseverance to reconstruct a breached system as urgently as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a crypto-ransomware event, even paying the ransom in cryptocurrency does not ensure that merciless criminals will return the needed keys to decipher any of your information. Kaspersky Labs estimated that seventeen percent of ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to setup from scratch the critical elements of your Information Technology environment. Without access to full data backups, this requires a wide complement of skills, well-coordinated project management, and the willingness to work non-stop until the recovery project is over.

For decades, Progent has made available expert IT services for businesses across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned high-level industry certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of experience provides Progent the capability to knowledgably identify critical systems and organize the surviving parts of your network system after a crypto-ransomware attack and assemble them into an operational system.

Progent's security team of experts utilizes powerful project management systems to coordinate the complex restoration process. Progent understands the importance of working swiftly and in concert with a client's management and IT resources to assign priority to tasks and to get key applications back on line as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Intrusion Response
A business escalated to Progent after their network system was attacked by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state cybercriminals, suspected of using approaches leaked from the United States NSA organization. Ryuk goes after specific organizations with little ability to sustain disruption and is among the most profitable instances of ransomware. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in Chicago with around 500 employees. The Ryuk attack had shut down all business operations and manufacturing processes. Most of the client's system backups had been online at the start of the attack and were encrypted. The client considered paying the ransom (in excess of two hundred thousand dollars) and praying for the best, but in the end made the decision to use Progent.

Progent worked together with the customer to quickly get our arms around and assign priority to the key areas that had to be recovered to make it possible to restart business operations:

• Active Directory
• E-Mail
• Accounting/MRP

Within two days, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then performed reinstallations and storage recovery of essential systems. All Exchange ties and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to find intact OST data files (Microsoft Outlook Offline Data Files) on team workstations and laptops in order to recover email messages. A not too old off-line backup of the businesses financials/ERP software made them able to return these vital programs back online. Although a lot of work remained to recover totally from the Ryuk attack, critical systems were returned to operations quickly:

Over the next couple of weeks critical milestones in the restoration project were accomplished in tight cooperation between Progent team members and the client:

• Internal web applications were restored with no loss of data.
• The MailStore Exchange Server with over four million archived messages was brought online and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory modules were fully functional.
• A new Palo Alto 850 security appliance was installed and configured.
• 90% of the user workstations were operational.

Conclusion
A potential business-ending disaster was averted through the efforts of results-oriented experts, a broad range of knowledge, and tight teamwork. Although upon completion of forensics the ransomware virus incident detailed here would have been blocked with up-to-date security technology and best practices, staff education, and properly executed security procedures for backup and keeping systems up to date with security patches, the fact remains that state-sponsored hackers from Russia, China and elsewhere are tireless and are not going away. If you do fall victim to a ransomware incursion, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, removal, and data disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Midtown Manhattan
For ransomware cleanup consulting services in the Midtown Manhattan metro area, call Progent at 800-462-8800 or see Contact Progent.