Ransomware Protection and Removal Consulting Miami Beach

Crypto-Ransomware : Your Worst Information Technology Catastrophe
Ransomware has become a modern cyber pandemic that poses an extinction-level threat for businesses vulnerable to an assault. Versions of ransomware like the CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for many years and continue to cause harm. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, as well as frequent as yet unnamed viruses, not only perform encryption of online files but also infect many accessible system protection mechanisms. Data synchronized to cloud environments can also be ransomed. In a vulnerable environment, this can render automated recovery impossible and basically knocks the entire system back to square one.

Retrieving applications and information following a ransomware event becomes a sprint against time as the victim struggles to contain the damage, remove the virus, and resume mission-critical operations. Since ransomware requires time to spread across a targeted network, assaults are frequently launched during weekends and nights, when successful attacks in many cases take longer to identify. This compounds the difficulty of rapidly assembling and coordinating a qualified mitigation team.

Progent has a range of support services for securing Miami Beach organizations from ransomware penetrations. These include user education to help identify and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based threat defense to discover and disable day-zero modern malware assaults. Progent in addition offers the assistance of expert ransomware recovery professionals with the talent and commitment to reconstruct a breached environment as soon as possible.

Progent's Crypto-Ransomware Restoration Support Services
Subsequent to a ransomware event, even paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will return the codes to decrypt any of your information. Kaspersky Labs estimated that seventeen percent of ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The fallback is to piece back together the vital components of your Information Technology environment. Absent the availability of full information backups, this requires a wide complement of skills, well-coordinated team management, and the willingness to work continuously until the task is complete.

For twenty years, Progent has provided certified expert IT services for businesses throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have earned top certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in accounting and ERP applications. This breadth of expertise provides Progent the skills to knowledgably ascertain important systems and consolidate the surviving pieces of your computer network environment following a ransomware event and rebuild them into an operational network.

Progent's recovery group deploys top notch project management tools to coordinate the sophisticated restoration process. Progent appreciates the importance of working quickly and in concert with a client's management and Information Technology staff to assign priority to tasks and to get essential systems back on-line as fast as possible.

Business Case Study: A Successful Crypto-Ransomware Penetration Restoration
A customer hired Progent after their network system was crashed by Ryuk ransomware. Ryuk is believed to have been launched by North Korean state sponsored cybercriminals, suspected of adopting strategies leaked from the U.S. National Security Agency. Ryuk attacks specific companies with little or no room for operational disruption and is one of the most lucrative instances of ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in the Chicago metro area with around 500 staff members. The Ryuk attack had disabled all company operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the time of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom (exceeding $200K) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked hand in hand the client to rapidly get our arms around and prioritize the critical services that needed to be recovered in order to continue business functions:

• Active Directory
• Electronic Messaging
• Accounting/MRP

Within 48 hours, Progent was able to re-build Windows Active Directory to its pre-penetration state. Progent then performed rebuilding and storage recovery of mission critical servers. All Exchange ties and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to locate intact OST files (Outlook Email Off-Line Data Files) on various workstations and laptops to recover email information. A not too old offline backup of the customer's accounting/ERP software made it possible to restore these vital services back servicing users. Although major work needed to be completed to recover totally from the Ryuk event, essential systems were recovered rapidly:

During the next few weeks important milestones in the restoration process were achieved through close collaboration between Progent consultants and the client:

• Self-hosted web sites were brought back up with no loss of data.
• The MailStore Server with over four million historical messages was restored to operations and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory functions were completely recovered.
• A new Palo Alto 850 security appliance was set up.
• Nearly all of the desktop computers were fully operational.

Conclusion
A potential business-ending disaster was dodged by top-tier experts, a broad spectrum of technical expertise, and close collaboration. Although in analyzing the event afterwards the ransomware attack described here could have been identified and blocked with up-to-date security solutions and NIST Cybersecurity Framework best practices, team training, and well designed security procedures for data protection and applying software patches, the fact is that state-sponsored hackers from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's team of experts has proven experience in ransomware virus blocking, cleanup, and file restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Miami Beach
For ransomware system recovery consulting in the Miami Beach metro area, phone Progent at 800-462-8800 or see Contact Progent.