Ransomware Protection and Recovery Services Raleigh

Crypto-Ransomware : Your Worst IT Disaster
Crypto-Ransomware has become a modern cyber pandemic that presents an extinction-level danger for organizations poorly prepared for an assault. Multiple generations of ransomware such as Reveton, Fusob, Locky, Syskey and MongoLock cryptoworms have been around for many years and continue to inflict harm. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus additional unnamed viruses, not only perform encryption of on-line critical data but also infiltrate most accessible system protection. Data replicated to cloud environments can also be encrypted. In a poorly designed system, it can render automatic restore operations impossible and effectively knocks the datacenter back to square one.

Restoring programs and information following a ransomware outage becomes a race against the clock as the targeted business tries its best to contain, eradicate the ransomware, and restore enterprise-critical operations. Since crypto-ransomware takes time to move laterally across a network, attacks are usually launched on weekends and holidays, when penetrations may take more time to uncover. This multiplies the difficulty of promptly assembling and orchestrating a capable response team.

Progent offers an assortment of services for securing Raleigh enterprises from crypto-ransomware attacks. Among these are staff training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat protection to detect and quarantine zero-day malware attacks. Progent in addition offers the assistance of expert ransomware recovery engineers with the track record and commitment to reconstruct a breached system as rapidly as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a ransomware invasion, even paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will return the codes to decrypt all your information. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to setup from scratch the mission-critical components of your Information Technology environment. Without access to full data backups, this requires a wide complement of skill sets, professional project management, and the willingness to work non-stop until the task is completed.

For decades, Progent has offered expert Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in accounting and ERP applications. This breadth of expertise provides Progent the skills to quickly ascertain necessary systems and consolidate the remaining pieces of your network system following a ransomware attack and rebuild them into an operational network.

Progent's ransomware team deploys state-of-the-art project management tools to orchestrate the complicated recovery process. Progent knows the urgency of working swiftly and in concert with a customer's management and Information Technology team members to prioritize tasks and to get the most important systems back on-line as fast as humanly possible.

Case Study: A Successful Ransomware Intrusion Restoration
A business hired Progent after their company was crashed by the Ryuk ransomware virus. Ryuk is generally considered to have been created by North Korean government sponsored hackers, suspected of using approaches leaked from the United States NSA organization. Ryuk goes after specific businesses with little or no tolerance for operational disruption and is among the most profitable iterations of crypto-ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in the Chicago metro area and has about 500 workers. The Ryuk event had brought down all business operations and manufacturing capabilities. Most of the client's system backups had been on-line at the start of the attack and were damaged. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the client to quickly identify and prioritize the essential areas that had to be recovered in order to restart business functions:

• Windows Active Directory
• Electronic Mail
• MRP System

Within 48 hours, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then assisted with setup and storage recovery on essential servers. All Exchange schema and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to find non-encrypted OST files (Outlook Offline Folder Files) on team PCs and laptops to recover email information. A recent offline backup of the customer's financials/ERP software made them able to return these essential programs back online for users. Although significant work was left to recover totally from the Ryuk damage, core services were returned to operations rapidly:

Throughout the next month critical milestones in the recovery project were achieved in tight cooperation between Progent engineers and the client:

• Self-hosted web applications were restored without losing any data.
• The MailStore Microsoft Exchange Server with over four million historical emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory Control functions were 100% restored.
• A new Palo Alto 850 firewall was installed.
• Nearly all of the desktop computers were operational.

Conclusion
A potential business-ending disaster was averted by dedicated experts, a wide spectrum of knowledge, and close teamwork. Although in post mortem the ransomware virus penetration described here would have been identified and disabled with current security solutions and best practices, user and IT administrator education, and appropriate security procedures for backup and keeping systems up to date with security patches, the reality is that state-sponsored cyber criminals from China, North Korea and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of professionals has substantial experience in crypto-ransomware virus defense, remediation, and file disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Raleigh
For ransomware recovery consulting services in the Raleigh metro area, phone Progent at 800-462-8800 or go to Contact Progent.