Ransomware Filtering and Recovery Consulting Tukwila
Crypto-Ransomware Repair: An Example
Ransomware : Your Crippling IT Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an extinction-level threat for organizations unprepared for an attack. Versions of ransomware like the CrySIS, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and continue to inflict havoc. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, as well as additional as yet unnamed viruses, not only encrypt online data files but also infiltrate many available system restores and backups. Files synched to cloud environments can also be encrypted. In a poorly designed environment, it can render automatic recovery useless and basically sets the network back to square one.
Getting back services and information after a ransomware attack becomes a race against the clock as the targeted organization tries its best to contain the damage, clear the virus, and resume mission-critical operations. Because ransomware requires time to spread across a network, assaults are frequently sprung during weekends and nights, when successful attacks are likely to take more time to identify. This multiplies the difficulty of promptly assembling and orchestrating an experienced response team.
Progent makes available a range of help services for protecting Tukwila enterprises from ransomware penetrations. Among these are staff training to help identify and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to identify and disable day-zero malware assaults. Progent also provides the assistance of experienced crypto-ransomware recovery professionals with the skills and perseverance to rebuild a compromised environment as urgently as possible.
Progent's Crypto-Ransomware Recovery Support Services
After a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will respond with the codes to decipher any or all of your files. Kaspersky determined that seventeen percent of ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to setup from scratch the mission-critical parts of your IT environment. Absent the availability of complete data backups, this requires a broad complement of skills, professional project management, and the capability to work 24x7 until the recovery project is completed.
For twenty years, Progent has provided certified expert IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded top certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP software solutions. This breadth of experience affords Progent the ability to quickly ascertain necessary systems and consolidate the remaining pieces of your network environment following a ransomware event and assemble them into a functioning network.
Progent's security team of experts has best of breed project management systems to orchestrate the complicated recovery process. Progent appreciates the importance of acting quickly and in concert with a client's management and IT team members to prioritize tasks and to get essential systems back on line as fast as possible.
Client Case Study: A Successful Ransomware Attack Recovery
A client hired Progent after their organization was penetrated by the Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state sponsored criminal gangs, suspected of adopting techniques leaked from America's NSA organization. Ryuk attacks specific businesses with limited room for disruption and is among the most lucrative iterations of crypto-ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in Chicago and has around 500 staff members. The Ryuk event had disabled all business operations and manufacturing processes. Most of the client's backups had been online at the beginning of the intrusion and were destroyed. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for good luck, but ultimately reached out to Progent.
Progent worked together with the customer to quickly assess and assign priority to the key systems that needed to be addressed to make it possible to resume business operations:
- Active Directory
- Electronic Mail
- Accounting and Manufacturing Software
In less than two days, Progent was able to recover Active Directory to its pre-penetration state. Progent then accomplished setup and storage recovery of critical systems. All Exchange Server data and attributes were intact, which greatly helped the restore of Exchange. Progent was also able to find local OST files (Microsoft Outlook Offline Data Files) on user desktop computers and laptops to recover mail data. A not too old off-line backup of the businesses manufacturing software made it possible to restore these vital applications back on-line. Although significant work still had to be done to recover totally from the Ryuk damage, the most important systems were restored rapidly:
Over the following couple of weeks important milestones in the restoration project were completed in close cooperation between Progent engineers and the customer:
- Internal web sites were returned to operation with no loss of information.
- The MailStore Exchange Server with over 4 million archived emails was brought on-line and available for users.
- CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were fully recovered.
- A new Palo Alto 850 firewall was set up.
- Nearly all of the user workstations were fully operational.
Conclusion
A likely business-killing disaster was averted through the efforts of top-tier experts, a wide range of technical expertise, and close collaboration. Although in retrospect the crypto-ransomware attack detailed here could have been shut down with advanced cyber security technology and ISO/IEC 27001 best practices, user training, and well designed security procedures for information protection and keeping systems up to date with security patches, the fact remains that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware virus, feel confident that Progent's team of professionals has a proven track record in ransomware virus blocking, removal, and data restoration.
Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware System Recovery Expertise in Tukwila
For ransomware system restoration expertise in the Tukwila metro area, call Progent at
Select Topic: