Ransomware Prevention and Restoration Solutions Madison
Ransomware Rollback: An Example
Crypto-Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become an escalating cyberplague that presents an enterprise-level threat for organizations poorly prepared for an attack. Versions of ransomware like the Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been out in the wild for a long time and continue to inflict destruction. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, plus more as yet unnamed newcomers, not only perform encryption of online data files but also infect any available system backups. Data synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly architected environment, this can make automatic restoration hopeless and basically knocks the entire system back to zero.
Restoring programs and data following a crypto-ransomware intrusion becomes a sprint against the clock as the targeted organization struggles to stop lateral movement, eradicate the virus, and restore mission-critical operations. Since ransomware takes time to replicate across a targeted network, assaults are usually sprung at night, when successful penetrations are likely to take more time to uncover. This compounds the difficulty of rapidly marshalling and orchestrating a knowledgeable response team.
Progent offers an assortment of services for securing Madison businesses from ransomware events. These include team education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to discover and quarantine day-zero modern malware attacks. Progent also can provide the services of veteran ransomware recovery professionals with the skills and commitment to restore a breached network as urgently as possible.
Progent's Ransomware Restoration Services
Soon after a ransomware event, paying the ransom in cryptocurrency does not guarantee that merciless criminals will respond with the keys to decipher any of your files. Kaspersky determined that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to setup from scratch the vital parts of your Information Technology environment. Absent the availability of essential system backups, this calls for a wide range of skill sets, well-coordinated project management, and the capability to work 24x7 until the task is complete.
For twenty years, Progent has made available certified expert Information Technology services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned top industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience gives Progent the ability to efficiently understand necessary systems and organize the remaining parts of your network environment following a ransomware penetration and assemble them into a functioning network.
Progent's ransomware team of experts has top notch project management applications to coordinate the complicated restoration process. Progent knows the urgency of acting quickly and together with a customer's management and Information Technology staff to prioritize tasks and to put essential systems back on line as soon as humanly possible.
Client Story: A Successful Crypto-Ransomware Virus Recovery
A small business contacted Progent after their organization was crashed by the Ryuk ransomware virus. Ryuk is believed to have been created by North Korean government sponsored cybercriminals, possibly adopting approaches leaked from the United States National Security Agency. Ryuk goes after specific businesses with little or no tolerance for disruption and is among the most profitable instances of crypto-ransomware. Major targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in the Chicago metro area with about 500 workers. The Ryuk attack had shut down all essential operations and manufacturing capabilities. The majority of the client's data protection had been online at the start of the attack and were destroyed. The client was taking steps for paying the ransom demand (in excess of $200K) and praying for the best, but ultimately brought in Progent.
Progent worked with the customer to quickly identify and assign priority to the key elements that needed to be restored in order to restart departmental functions:
- Microsoft Active Directory
- MRP System
Within 2 days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then completed rebuilding and hard drive recovery on essential servers. All Microsoft Exchange Server data and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to collect non-encrypted OST data files (Outlook Offline Data Files) on team desktop computers in order to recover email messages. A recent off-line backup of the businesses financials/MRP software made them able to return these essential programs back servicing users. Although a large amount of work was left to recover totally from the Ryuk attack, critical systems were recovered rapidly:
Over the following month critical milestones in the restoration process were completed in close collaboration between Progent consultants and the client:
- Internal web sites were restored without losing any information.
- The MailStore Microsoft Exchange Server exceeding four million historical messages was spun up and available for users.
- CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory functions were fully functional.
- A new Palo Alto Networks 850 security appliance was installed.
- Nearly all of the desktops and laptops were fully operational.
Conclusion
A potential business extinction catastrophe was dodged by top-tier experts, a broad range of knowledge, and close collaboration. Although in analyzing the event afterwards the ransomware incident detailed here would have been prevented with current security solutions and NIST Cybersecurity Framework best practices, staff training, and properly executed security procedures for information protection and applying software patches, the fact remains that government-sponsored hackers from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's team of experts has substantial experience in ransomware virus defense, removal, and data recovery.
Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Cleanup Expertise in Madison
For ransomware system recovery consulting services in the Madison metro area, phone Progent at
Select Topic: