Ransomware Protection and Restoration Consulting Durham

Ransomware : Your Crippling IT Disaster
Ransomware has become an escalating cyber pandemic that presents an enterprise-level danger for businesses vulnerable to an attack. Different iterations of ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for a long time and continue to cause destruction. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, as well as more unnamed viruses, not only perform encryption of online data but also infiltrate most available system protection mechanisms. Files synched to the cloud can also be encrypted. In a vulnerable environment, this can render any recovery useless and effectively knocks the entire system back to zero.

Retrieving services and information after a crypto-ransomware attack becomes a sprint against time as the targeted organization fights to contain the damage, cleanup the virus, and resume enterprise-critical activity. Since ransomware takes time to spread throughout a targeted network, attacks are frequently sprung at night, when successful penetrations tend to take longer to detect. This multiplies the difficulty of rapidly marshalling and orchestrating an experienced mitigation team.

Progent makes available an assortment of support services for securing Durham businesses from crypto-ransomware penetrations. These include user education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to detect and disable zero-day modern malware assaults. Progent also offers the assistance of experienced ransomware recovery consultants with the track record and commitment to re-deploy a breached network as urgently as possible.

Progent's Ransomware Restoration Support Services
Soon after a ransomware penetration, sending the ransom in cryptocurrency does not ensure that merciless criminals will provide the needed codes to unencrypt all your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their files even after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to re-install the mission-critical parts of your Information Technology environment. Without access to complete data backups, this calls for a wide range of skills, top notch team management, and the willingness to work continuously until the task is complete.

For two decades, Progent has made available professional IT services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained high-level certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of expertise gives Progent the skills to knowledgably understand important systems and consolidate the remaining parts of your IT system after a ransomware penetration and assemble them into a functioning system.

Progent's ransomware team utilizes state-of-the-art project management applications to coordinate the complex recovery process. Progent knows the importance of working quickly and in unison with a customer's management and IT resources to assign priority to tasks and to put the most important systems back on-line as soon as humanly possible.

Customer Story: A Successful Crypto-Ransomware Intrusion Recovery
A business sought out Progent after their network was brought down by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state criminal gangs, possibly using approaches leaked from the United States NSA organization. Ryuk seeks specific organizations with little or no room for operational disruption and is among the most lucrative iterations of ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company located in Chicago and has around 500 workers. The Ryuk attack had paralyzed all business operations and manufacturing capabilities. Most of the client's data backups had been online at the start of the attack and were damaged. The client considered paying the ransom (more than $200,000) and wishfully thinking for good luck, but ultimately engaged Progent.

Progent worked together with the customer to quickly understand and prioritize the essential applications that needed to be recovered to make it possible to restart business functions:

• Active Directory
• Microsoft Exchange Email
• MRP System

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then assisted with rebuilding and hard drive recovery on mission critical servers. All Microsoft Exchange Server ties and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to locate intact OST data files (Outlook Email Offline Data Files) on staff PCs in order to recover email data. A not too old offline backup of the businesses financials/ERP software made them able to restore these essential applications back online. Although a lot of work still had to be done to recover completely from the Ryuk attack, the most important services were recovered rapidly:

Over the next month important milestones in the restoration project were completed in close cooperation between Progent consultants and the client:

• Self-hosted web sites were brought back up without losing any data.
• The MailStore Exchange Server with over four million archived messages was brought on-line and available for users.
• CRM/Product Ordering/Invoicing/AP/Accounts Receivables/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 security appliance was installed and configured.
• 90% of the user desktops and notebooks were operational.

Conclusion
A likely business extinction catastrophe was dodged by results-oriented experts, a broad array of technical expertise, and close teamwork. Although in retrospect the crypto-ransomware virus incident detailed here could have been identified and prevented with up-to-date security technology solutions and security best practices, user and IT administrator education, and well designed incident response procedures for data protection and proper patching controls, the fact remains that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's roster of experts has proven experience in ransomware virus blocking, removal, and information systems disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Durham
For ransomware system restoration consulting in the Durham metro area, phone Progent at 800-462-8800 or see Contact Progent.