Ransomware Prevention and Remediation Expertise Thousand Oaks

Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become a too-frequent cyber pandemic that represents an existential threat for organizations unprepared for an attack. Versions of ransomware such as CrySIS, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been replicating for years and still inflict havoc. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, plus more as yet unnamed newcomers, not only perform encryption of online files but also infect all available system protection mechanisms. Files replicated to cloud environments can also be ransomed. In a vulnerable system, it can render automated recovery hopeless and effectively sets the datacenter back to square one.

Recovering applications and information after a ransomware event becomes a sprint against the clock as the targeted organization struggles to stop lateral movement, remove the crypto-ransomware, and restore enterprise-critical activity. Because ransomware takes time to replicate throughout a network, assaults are often sprung on weekends, when penetrations in many cases take longer to identify. This compounds the difficulty of promptly assembling and coordinating a capable mitigation team.

Progent makes available a range of support services for securing Thousand Oaks organizations from crypto-ransomware attacks. Among these are team education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to identify and extinguish zero-day malware attacks. Progent also can provide the assistance of veteran ransomware recovery professionals with the track record and commitment to restore a compromised system as urgently as possible.

Progent's Ransomware Restoration Services
Subsequent to a ransomware event, paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will return the codes to unencrypt any of your information. Kaspersky determined that seventeen percent of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to re-install the essential elements of your Information Technology environment. Without access to full data backups, this requires a wide range of IT skills, professional project management, and the ability to work continuously until the recovery project is complete.

For decades, Progent has offered certified expert IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have been awarded high-level industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial management and ERP software solutions. This breadth of experience affords Progent the capability to knowledgably determine important systems and consolidate the remaining components of your computer network system following a ransomware attack and assemble them into an operational network.

Progent's ransomware team of experts utilizes state-of-the-art project management applications to orchestrate the complicated restoration process. Progent knows the urgency of working swiftly and in unison with a client's management and IT staff to prioritize tasks and to put critical systems back on line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Penetration Restoration
A customer engaged Progent after their organization was taken over by Ryuk ransomware virus. Ryuk is thought to have been created by North Korean state sponsored cybercriminals, suspected of adopting algorithms exposed from America's NSA organization. Ryuk targets specific organizations with little or no room for disruption and is among the most lucrative incarnations of ransomware malware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in Chicago with about 500 workers. The Ryuk intrusion had disabled all company operations and manufacturing capabilities. The majority of the client's backups had been on-line at the time of the attack and were damaged. The client considered paying the ransom demand (in excess of $200K) and praying for good luck, but ultimately made the decision to use Progent.

Progent worked hand in hand the client to rapidly assess and assign priority to the essential elements that needed to be addressed in order to resume departmental operations:

• Microsoft Active Directory
• Electronic Messaging
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to restore Active Directory to its pre-attack state. Progent then initiated reinstallations and hard drive recovery on needed servers. All Exchange schema and attributes were intact, which facilitated the restore of Exchange. Progent was able to collect non-encrypted OST files (Outlook Email Offline Folder Files) on staff desktop computers in order to recover email data. A not too old off-line backup of the client's accounting/MRP software made them able to recover these essential programs back on-line. Although a large amount of work remained to recover fully from the Ryuk event, the most important systems were restored rapidly:

Over the next month important milestones in the recovery process were made in close cooperation between Progent engineers and the client:

• Self-hosted web sites were restored with no loss of data.
• The MailStore Server with over four million archived emails was spun up and accessible to users.
• CRM/Orders/Invoicing/AP/AR/Inventory Control modules were fully operational.
• A new Palo Alto Networks 850 security appliance was deployed.
• Most of the user workstations were operational.

Conclusion
A probable business-ending disaster was avoided due to results-oriented experts, a broad range of knowledge, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware penetration described here would have been stopped with advanced security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator education, and well thought out security procedures for data protection and keeping systems up to date with security patches, the fact is that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's team of experts has proven experience in ransomware virus defense, mitigation, and file recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Thousand Oaks
For ransomware cleanup expertise in the Thousand Oaks area, phone Progent at 800-462-8800 or see Contact Progent.