Ransomware Protection and Recovery Expertise Boise

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyberplague that presents an existential danger for organizations unprepared for an assault. Multiple generations of ransomware such as Dharma, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for years and still cause damage. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, plus daily as yet unnamed malware, not only perform encryption of online files but also infect all available system backups. Information synched to cloud environments can also be ransomed. In a poorly designed environment, it can render automatic restore operations hopeless and effectively sets the network back to square one.

Recovering applications and data following a crypto-ransomware event becomes a sprint against the clock as the victim struggles to contain, eradicate the virus, and resume enterprise-critical activity. Because crypto-ransomware requires time to move laterally across a network, assaults are often launched at night, when successful penetrations typically take more time to discover. This compounds the difficulty of rapidly marshalling and coordinating a qualified mitigation team.

Progent offers an assortment of services for securing Boise organizations from ransomware penetrations. These include user training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat protection to discover and extinguish day-zero malware attacks. Progent in addition can provide the services of expert crypto-ransomware recovery engineers with the talent and commitment to re-deploy a breached system as quickly as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a ransomware invasion, paying the ransom in cryptocurrency does not guarantee that distant criminals will return the keys to decrypt any of your files. Kaspersky determined that 17% of crypto-ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The other path is to piece back together the critical elements of your IT environment. Without the availability of essential data backups, this requires a wide complement of IT skills, professional team management, and the willingness to work 24x7 until the recovery project is completed.

For two decades, Progent has made available professional Information Technology services for businesses throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained high-level certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with accounting and ERP application software. This breadth of experience affords Progent the ability to rapidly identify important systems and consolidate the surviving components of your computer network system following a ransomware attack and configure them into a functioning system.

Progent's security group deploys state-of-the-art project management applications to orchestrate the complicated recovery process. Progent appreciates the importance of acting rapidly and in concert with a client's management and IT staff to prioritize tasks and to get key applications back online as fast as humanly possible.

Business Case Study: A Successful Ransomware Attack Restoration
A business sought out Progent after their network system was attacked by Ryuk ransomware. Ryuk is thought to have been launched by North Korean government sponsored hackers, suspected of using algorithms leaked from the United States National Security Agency. Ryuk attacks specific companies with limited room for operational disruption and is one of the most profitable incarnations of ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in the Chicago metro area with around 500 workers. The Ryuk penetration had disabled all essential operations and manufacturing processes. The majority of the client's data protection had been on-line at the start of the attack and were eventually encrypted. The client was evaluating paying the ransom demand (in excess of $200,000) and praying for good luck, but in the end reached out to Progent.

Progent worked hand in hand the customer to quickly determine and prioritize the critical applications that needed to be recovered in order to resume departmental functions:

• Windows Active Directory
• Microsoft Exchange Server
• Accounting/MRP

Within two days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then assisted with reinstallations and hard drive recovery on essential systems. All Exchange Server ties and attributes were intact, which facilitated the restore of Exchange. Progent was able to locate intact OST files (Outlook Email Offline Data Files) on various PCs in order to recover mail data. A not too old offline backup of the customer's manufacturing software made it possible to recover these required applications back available to users. Although a large amount of work was left to recover fully from the Ryuk virus, the most important systems were recovered quickly:

Over the following few weeks important milestones in the recovery project were made in close collaboration between Progent consultants and the customer:

• Self-hosted web applications were restored with no loss of data.
• The MailStore Server exceeding four million historical emails was brought on-line and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory functions were 100% restored.
• A new Palo Alto 850 security appliance was brought online.
• 90% of the desktops and laptops were operational.

Conclusion
A potential company-ending disaster was dodged with hard-working experts, a broad spectrum of subject matter expertise, and close collaboration. Although in analyzing the event afterwards the ransomware penetration detailed here should have been shut down with current security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and well designed incident response procedures for information protection and keeping systems up to date with security patches, the fact remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware incident, feel confident that Progent's roster of experts has substantial experience in ransomware virus blocking, remediation, and information systems disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Boise
For ransomware system recovery expertise in the Boise area, phone Progent at 800-462-8800 or see Contact Progent.