Ransomware Prevention and Recovery Expertise Tucson

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that presents an enterprise-level threat for businesses unprepared for an attack. Versions of ransomware such as Dharma, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for many years and continue to inflict destruction. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, along with additional unnamed newcomers, not only perform encryption of on-line information but also infect most configured system protection. Data synched to cloud environments can also be encrypted. In a vulnerable system, it can make any restore operations impossible and effectively knocks the network back to zero.

Retrieving programs and information after a crypto-ransomware outage becomes a sprint against the clock as the targeted organization struggles to contain, cleanup the ransomware, and resume business-critical operations. Due to the fact that ransomware requires time to move laterally across a targeted network, penetrations are frequently launched during weekends and nights, when successful penetrations are likely to take longer to detect. This multiplies the difficulty of quickly assembling and coordinating an experienced mitigation team.

Progent has an assortment of help services for protecting Tucson organizations from ransomware attacks. Among these are user education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based cyberthreat protection to discover and suppress zero-day modern malware attacks. Progent in addition offers the assistance of experienced ransomware recovery consultants with the track record and perseverance to restore a breached network as quickly as possible.

Progent's Ransomware Restoration Services
After a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will return the needed keys to unencrypt any of your information. Kaspersky determined that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to re-install the critical elements of your IT environment. Absent access to essential system backups, this requires a wide complement of IT skills, top notch team management, and the willingness to work non-stop until the task is over.

For decades, Progent has made available expert Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained top certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial management and ERP application software. This breadth of expertise provides Progent the ability to rapidly determine critical systems and re-organize the remaining pieces of your network environment after a crypto-ransomware attack and configure them into an operational system.

Progent's ransomware team deploys powerful project management tools to coordinate the complex restoration process. Progent appreciates the urgency of acting rapidly and in concert with a customer's management and Information Technology team members to assign priority to tasks and to get essential systems back online as fast as possible.

Client Case Study: A Successful Ransomware Virus Response
A customer hired Progent after their company was taken over by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state sponsored hackers, possibly using techniques leaked from the United States NSA organization. Ryuk attacks specific companies with little or no tolerance for disruption and is among the most profitable incarnations of ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing company located in Chicago with about 500 workers. The Ryuk attack had brought down all essential operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the start of the attack and were damaged. The client was evaluating paying the ransom (more than two hundred thousand dollars) and hoping for the best, but in the end made the decision to use Progent.

Progent worked with the client to quickly assess and prioritize the key services that needed to be restored to make it possible to restart departmental operations:

• Active Directory (AD)
• Electronic Messaging
• MRP System

Within 2 days, Progent was able to re-build Active Directory to its pre-virus state. Progent then charged ahead with reinstallations and hard drive recovery of critical systems. All Exchange ties and attributes were intact, which facilitated the rebuild of Exchange. Progent was able to find non-encrypted OST data files (Outlook Email Offline Data Files) on various desktop computers and laptops in order to recover email information. A not too old offline backup of the customer's financials/ERP software made them able to recover these required applications back on-line. Although a lot of work was left to recover totally from the Ryuk event, core systems were returned to operations quickly:

Throughout the following month key milestones in the restoration process were achieved through tight cooperation between Progent consultants and the client:

• Self-hosted web sites were returned to operation with no loss of data.
• The MailStore Server with over four million historical emails was spun up and accessible to users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory Control functions were completely restored.
• A new Palo Alto 850 security appliance was set up.
• Most of the user desktops were fully operational.

Conclusion
A likely enterprise-killing disaster was evaded through the efforts of hard-working experts, a broad spectrum of knowledge, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration described here could have been identified and blocked with up-to-date cyber security systems and ISO/IEC 27001 best practices, team education, and well thought out security procedures for information protection and proper patching controls, the reality is that state-sponsored cybercriminals from China, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware penetration, feel confident that Progent's team of experts has a proven track record in ransomware virus blocking, cleanup, and data restoration.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Tucson
For ransomware cleanup consulting in the Tucson metro area, phone Progent at 800-462-8800 or go to Contact Progent.