Ransomware Protection and Restoration Solutions Huntington Beach

Crypto-Ransomware : Your Worst IT Disaster
Ransomware has become a too-frequent cyber pandemic that presents an extinction-level danger for organizations unprepared for an assault. Versions of crypto-ransomware such as Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been circulating for a long time and still inflict destruction. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, along with additional as yet unnamed newcomers, not only encrypt on-line data but also infect all configured system backups. Files synched to off-premises disaster recovery sites can also be corrupted. In a poorly designed data protection solution, this can make automated restoration useless and effectively sets the network back to square one.

Getting back online services and information after a crypto-ransomware outage becomes a sprint against time as the targeted business tries its best to contain, eradicate the virus, and resume enterprise-critical operations. Due to the fact that ransomware requires time to spread across a targeted network, penetrations are frequently launched during nights and weekends, when attacks in many cases take more time to uncover. This compounds the difficulty of promptly assembling and coordinating a qualified mitigation team.

Progent provides an assortment of services for protecting Huntington Beach businesses from ransomware penetrations. Among these are user education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to identify and extinguish day-zero modern malware assaults. Progent in addition offers the assistance of expert ransomware recovery professionals with the skills and perseverance to reconstruct a compromised environment as soon as possible.

Progent's Crypto-Ransomware Restoration Services
After a ransomware invasion, even paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will return the keys to decipher all your data. Kaspersky ascertained that 17% of crypto-ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The fallback is to re-install the mission-critical components of your Information Technology environment. Absent access to full data backups, this requires a wide range of IT skills, top notch project management, and the willingness to work 24x7 until the job is over.

For twenty years, Progent has made available certified expert Information Technology services for companies throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned top certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in accounting and ERP application software. This breadth of experience gives Progent the skills to quickly identify necessary systems and consolidate the remaining parts of your Information Technology environment following a ransomware attack and assemble them into an operational network.

Progent's ransomware group uses state-of-the-art project management applications to coordinate the sophisticated recovery process. Progent knows the urgency of working quickly and together with a customer's management and Information Technology team members to assign priority to tasks and to get the most important applications back on line as soon as possible.

Client Case Study: A Successful Ransomware Penetration Restoration
A business contacted Progent after their company was taken over by Ryuk crypto-ransomware. Ryuk is thought to have been developed by North Korean state sponsored hackers, suspected of adopting technology leaked from the U.S. National Security Agency. Ryuk targets specific companies with little or no tolerance for operational disruption and is among the most profitable incarnations of ransomware. Major targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing business headquartered in the Chicago metro area with about 500 staff members. The Ryuk intrusion had frozen all business operations and manufacturing processes. The majority of the client's data protection had been directly accessible at the time of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and praying for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the customer to rapidly understand and prioritize the most important elements that had to be restored to make it possible to resume departmental functions:

• Active Directory
• Electronic Mail
• Financials/MRP

Within two days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then accomplished reinstallations and storage recovery of essential servers. All Exchange ties and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to locate non-encrypted OST files (Outlook Off-Line Data Files) on user workstations in order to recover email data. A recent off-line backup of the client's manufacturing software made it possible to return these essential applications back available to users. Although a large amount of work was left to recover fully from the Ryuk attack, the most important services were returned to operations rapidly:

Throughout the following few weeks key milestones in the restoration project were completed in tight cooperation between Progent engineers and the customer:

• Self-hosted web applications were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server containing more than 4 million archived messages was brought online and available for users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory capabilities were 100% recovered.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Most of the user desktops were back into operation.

Conclusion
A possible business catastrophe was avoided by results-oriented professionals, a wide array of IT skills, and close collaboration. Although in retrospect the ransomware virus attack described here could have been blocked with advanced cyber security systems and recognized best practices, staff education, and well designed incident response procedures for data backup and applying software patches, the fact remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a crypto-ransomware penetration, remember that Progent's team of experts has a proven track record in ransomware virus defense, remediation, and file restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Huntington Beach
For ransomware system restoration services in the Huntington Beach metro area, call Progent at 800-462-8800 or visit Contact Progent.