Ransomware Prevention and Remediation Services Jersey City
Ransomware Cleanup: An Example
Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a modern cyber pandemic that poses an extinction-level threat for organizations unprepared for an attack. Versions of ransomware such as Reveton, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for a long time and continue to inflict havoc. More recent variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, plus frequent as yet unnamed newcomers, not only perform encryption of on-line files but also infect any accessible system protection mechanisms. Data synched to cloud environments can also be rendered useless. In a poorly designed data protection solution, it can make any restoration hopeless and effectively knocks the datacenter back to square one.
Restoring programs and data following a crypto-ransomware attack becomes a sprint against time as the targeted business tries its best to contain the damage, eradicate the ransomware, and resume enterprise-critical activity. Because ransomware requires time to spread throughout a network, assaults are often launched during weekends and nights, when successful attacks are likely to take more time to recognize. This multiplies the difficulty of rapidly marshalling and organizing an experienced response team.
Progent offers a variety of support services for protecting Jersey City enterprises from crypto-ransomware attacks. Among these are staff education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to identify and disable zero-day modern malware attacks. Progent also provides the assistance of seasoned ransomware recovery professionals with the skills and commitment to rebuild a breached environment as soon as possible.
Progent's Ransomware Restoration Services
Subsequent to a ransomware penetration, paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will return the needed codes to decrypt any or all of your information. Kaspersky determined that seventeen percent of ransomware victims never recovered their information even after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to piece back together the vital components of your IT environment. Absent the availability of essential data backups, this calls for a wide range of skills, well-coordinated team management, and the willingness to work non-stop until the task is completed.
For decades, Progent has provided certified expert Information Technology services for companies across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned advanced certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial management and ERP application software. This breadth of expertise provides Progent the ability to rapidly identify necessary systems and consolidate the surviving components of your Information Technology system after a ransomware event and assemble them into a functioning system.
Progent's recovery team of experts deploys powerful project management systems to orchestrate the complex restoration process. Progent understands the importance of working quickly and together with a client's management and Information Technology staff to prioritize tasks and to put essential services back online as fast as possible.
Customer Case Study: A Successful Ransomware Incident Recovery
A client engaged Progent after their company was penetrated by Ryuk ransomware. Ryuk is thought to have been developed by North Korean state sponsored cybercriminals, possibly using technology leaked from the U.S. National Security Agency. Ryuk attacks specific businesses with little tolerance for operational disruption and is among the most profitable iterations of ransomware malware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company located in Chicago and has about 500 workers. The Ryuk attack had brought down all company operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the start of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (exceeding $200K) and hoping for good luck, but ultimately utilized Progent.
Progent worked with the client to quickly understand and prioritize the critical systems that had to be restored in order to resume departmental operations:
- Active Directory (AD)
- Electronic Messaging
- Financials/MRP
Within two days, Progent was able to re-build Active Directory to its pre-attack state. Progent then helped perform rebuilding and storage recovery on key applications. All Microsoft Exchange Server schema and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to find intact OST files (Microsoft Outlook Offline Data Files) on staff workstations and laptops in order to recover mail data. A recent off-line backup of the customer's accounting/ERP systems made it possible to restore these essential programs back servicing users. Although major work needed to be completed to recover completely from the Ryuk virus, critical services were returned to operations rapidly:
Throughout the following couple of weeks critical milestones in the recovery process were achieved in close collaboration between Progent engineers and the customer:
- In-house web sites were brought back up with no loss of information.
- The MailStore Server containing more than four million historical emails was restored to operations and available for users.
- CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory functions were 100% functional.
- A new Palo Alto Networks 850 security appliance was set up and programmed.
- Nearly all of the user desktops were operational.
Conclusion
A possible company-ending catastrophe was avoided with hard-working professionals, a broad range of IT skills, and close collaboration. Although upon completion of forensics the ransomware incident detailed here would have been blocked with advanced security technology and recognized best practices, user training, and well thought out security procedures for information protection and proper patching controls, the fact is that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware virus, remember that Progent's team of professionals has extensive experience in ransomware virus blocking, cleanup, and information systems disaster recovery.
Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware System Recovery Consulting in Jersey City
For ransomware cleanup consulting in the Jersey City metro area, phone Progent at
Select Topic: