Ransomware Prevention and Restoration Consulting Boston

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that poses an enterprise-level danger for organizations unprepared for an attack. Versions of ransomware like the Dharma, Fusob, Locky, SamSam and MongoLock cryptoworms have been out in the wild for years and still inflict havoc. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, plus daily unnamed viruses, not only perform encryption of on-line files but also infect many configured system restores and backups. Information synched to the cloud can also be corrupted. In a poorly architected data protection solution, this can make automated recovery useless and effectively sets the network back to square one.

Getting back online applications and information after a crypto-ransomware outage becomes a sprint against the clock as the targeted business fights to stop lateral movement, remove the ransomware, and restore business-critical activity. Due to the fact that crypto-ransomware requires time to move laterally throughout a network, attacks are usually launched during nights and weekends, when attacks tend to take more time to recognize. This compounds the difficulty of quickly assembling and orchestrating a qualified mitigation team.

Progent makes available a variety of solutions for securing Boston organizations from ransomware events. Among these are user education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat protection to discover and extinguish zero-day modern malware assaults. Progent in addition offers the services of experienced ransomware recovery engineers with the skills and perseverance to re-deploy a compromised network as urgently as possible.

Progent's Crypto-Ransomware Restoration Help
Subsequent to a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will return the needed codes to decrypt all your files. Kaspersky determined that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to piece back together the essential components of your IT environment. Absent access to essential data backups, this calls for a wide complement of IT skills, top notch team management, and the capability to work 24x7 until the recovery project is completed.

For two decades, Progent has offered expert Information Technology services for companies throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained high-level certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial management and ERP software solutions. This breadth of experience gives Progent the ability to rapidly determine critical systems and consolidate the surviving parts of your Information Technology system after a ransomware penetration and assemble them into an operational network.

Progent's ransomware group deploys state-of-the-art project management systems to coordinate the sophisticated restoration process. Progent knows the urgency of acting rapidly and in unison with a client's management and Information Technology staff to assign priority to tasks and to put essential services back online as fast as humanly possible.

Client Case Study: A Successful Ransomware Intrusion Recovery
A client engaged Progent after their network system was attacked by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored criminal gangs, possibly using approaches exposed from America's NSA organization. Ryuk goes after specific organizations with little or no tolerance for disruption and is one of the most lucrative versions of crypto-ransomware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer located in the Chicago metro area with around 500 staff members. The Ryuk event had paralyzed all company operations and manufacturing processes. Most of the client's information backups had been online at the beginning of the attack and were encrypted. The client considered paying the ransom (exceeding $200,000) and praying for good luck, but ultimately utilized Progent.

Progent worked with the customer to rapidly determine and assign priority to the key elements that had to be recovered in order to resume departmental operations:

• Windows Active Directory
• Microsoft Exchange Email
• Financials/MRP

Within 48 hours, Progent was able to recover Active Directory services to its pre-virus state. Progent then performed setup and hard drive recovery on key servers. All Microsoft Exchange Server schema and attributes were intact, which greatly helped the restore of Exchange. Progent was also able to assemble intact OST files (Outlook Off-Line Data Files) on various workstations in order to recover mail data. A not too old offline backup of the customer's financials/ERP software made them able to restore these required programs back on-line. Although a lot of work was left to recover totally from the Ryuk virus, the most important services were recovered rapidly:

Over the next few weeks important milestones in the restoration process were made through tight cooperation between Progent consultants and the client:

• Internal web applications were brought back up with no loss of data.
• The MailStore Exchange Server containing more than 4 million archived messages was spun up and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control functions were fully functional.
• A new Palo Alto 850 firewall was set up.
• Nearly all of the desktops and laptops were being used by staff.

Conclusion
A likely business extinction disaster was avoided by hard-working experts, a wide range of knowledge, and close collaboration. Although in analyzing the event afterwards the ransomware virus incident described here could have been shut down with up-to-date security systems and security best practices, team training, and properly executed incident response procedures for backup and proper patching controls, the reality is that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's roster of experts has proven experience in ransomware virus defense, remediation, and file recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Boston
For ransomware system restoration expertise in the Boston metro area, phone Progent at 800-462-8800 or see Contact Progent.