Ransomware Defense and Remediation Consulting Austin

Ransomware : Your Crippling IT Disaster
Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level danger for businesses poorly prepared for an attack. Multiple generations of crypto-ransomware such as Dharma, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been circulating for many years and continue to inflict damage. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, as well as additional as yet unnamed newcomers, not only perform encryption of online information but also infiltrate most accessible system protection mechanisms. Files synched to cloud environments can also be corrupted. In a poorly designed environment, it can make any restore operations impossible and basically knocks the network back to zero.

Recovering services and information following a ransomware event becomes a race against time as the targeted business fights to stop lateral movement, remove the virus, and restore enterprise-critical activity. Because crypto-ransomware takes time to move laterally throughout a network, assaults are frequently sprung during nights and weekends, when successful attacks are likely to take longer to identify. This compounds the difficulty of quickly mobilizing and organizing a qualified response team.

Progent provides an assortment of solutions for securing Austin enterprises from ransomware attacks. These include user training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to discover and disable zero-day malware attacks. Progent also offers the services of experienced ransomware recovery engineers with the skills and commitment to re-deploy a breached environment as urgently as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a ransomware attack, sending the ransom in cryptocurrency does not provide any assurance that cyber hackers will provide the keys to decipher any of your data. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never restored their data after having paid the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to piece back together the key parts of your Information Technology environment. Absent access to complete information backups, this requires a broad complement of IT skills, top notch team management, and the willingness to work continuously until the job is finished.

For twenty years, Progent has made available professional IT services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have attained top certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have garnered internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in accounting and ERP application software. This breadth of expertise provides Progent the skills to rapidly determine important systems and consolidate the remaining parts of your IT environment following a ransomware event and assemble them into a functioning system.

Progent's ransomware team utilizes top notch project management applications to orchestrate the complicated restoration process. Progent knows the urgency of working rapidly and together with a client's management and IT resources to assign priority to tasks and to get essential applications back on-line as fast as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Attack Recovery
A customer engaged Progent after their network was attacked by the Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean government sponsored criminal gangs, suspected of using strategies exposed from the United States National Security Agency. Ryuk attacks specific companies with limited room for disruption and is one of the most profitable versions of ransomware viruses. Headline targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in the Chicago metro area with around 500 staff members. The Ryuk attack had paralyzed all company operations and manufacturing processes. The majority of the client's system backups had been on-line at the time of the intrusion and were destroyed. The client considered paying the ransom (more than $200,000) and praying for the best, but in the end reached out to Progent.

Progent worked together with the customer to quickly identify and assign priority to the mission critical services that needed to be recovered in order to resume departmental operations:

• Active Directory
• Electronic Mail
• Financials/MRP

Within 2 days, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then helped perform rebuilding and hard drive recovery of key systems. All Exchange Server ties and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to find non-encrypted OST data files (Outlook Email Offline Folder Files) on team PCs and laptops in order to recover email information. A not too old off-line backup of the businesses accounting/MRP systems made them able to restore these essential applications back online for users. Although a large amount of work was left to recover completely from the Ryuk damage, critical systems were restored rapidly:

Over the next couple of weeks key milestones in the restoration project were made in close collaboration between Progent engineers and the customer:

• Self-hosted web sites were restored without losing any data.
• The MailStore Microsoft Exchange Server exceeding four million historical emails was brought online and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory functions were 100% functional.
• A new Palo Alto 850 security appliance was installed.
• Most of the user workstations were functioning as before the incident.

Conclusion
A potential business extinction disaster was evaded due to hard-working experts, a wide array of subject matter expertise, and tight teamwork. Although in post mortem the crypto-ransomware attack described here could have been identified and prevented with current cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and well thought out incident response procedures for data protection and keeping systems up to date with security patches, the fact is that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware attack, feel confident that Progent's roster of experts has substantial experience in ransomware virus defense, cleanup, and file disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Austin
For ransomware system recovery consulting in the Austin area, call Progent at 800-462-8800 or visit Contact Progent.