Ransomware Protection and Cleanup Services Pasadena

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become an escalating cyberplague that poses an existential threat for businesses of all sizes poorly prepared for an assault. Multiple generations of ransomware like the CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for many years and still inflict destruction. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as additional unnamed newcomers, not only encrypt online critical data but also infiltrate most accessible system restores and backups. Files synched to cloud environments can also be encrypted. In a vulnerable environment, it can make automated restore operations useless and effectively sets the network back to zero.

Recovering programs and information after a crypto-ransomware attack becomes a race against the clock as the targeted organization tries its best to contain, cleanup the virus, and resume enterprise-critical activity. Since ransomware requires time to replicate across a targeted network, attacks are usually sprung during weekends and nights, when penetrations tend to take longer to uncover. This compounds the difficulty of promptly assembling and coordinating a qualified response team.

Progent offers a variety of support services for securing Pasadena organizations from ransomware penetrations. Among these are staff education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to discover and disable day-zero modern malware assaults. Progent in addition provides the assistance of seasoned ransomware recovery engineers with the track record and commitment to reconstruct a compromised system as quickly as possible.

Progent's Ransomware Restoration Services
After a ransomware event, even paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will return the keys to unencrypt all your information. Kaspersky Labs estimated that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The other path is to setup from scratch the essential elements of your IT environment. Absent the availability of full data backups, this calls for a wide complement of skills, top notch project management, and the willingness to work non-stop until the recovery project is done.

For twenty years, Progent has provided expert IT services for businesses across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained top industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of experience gives Progent the ability to knowledgably identify critical systems and integrate the surviving pieces of your computer network environment following a ransomware event and rebuild them into an operational system.

Progent's ransomware group utilizes best of breed project management applications to orchestrate the complicated recovery process. Progent knows the urgency of acting quickly and in concert with a client's management and IT staff to assign priority to tasks and to get key systems back on line as fast as possible.

Customer Case Study: A Successful Ransomware Attack Response
A client hired Progent after their network was penetrated by Ryuk ransomware. Ryuk is thought to have been launched by North Korean government sponsored cybercriminals, suspected of using strategies exposed from America's NSA organization. Ryuk attacks specific organizations with little room for disruption and is among the most profitable examples of ransomware viruses. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company located in Chicago with about 500 workers. The Ryuk intrusion had brought down all company operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the start of the attack and were destroyed. The client was evaluating paying the ransom demand (in excess of $200,000) and praying for good luck, but in the end reached out to Progent.

Progent worked hand in hand the client to rapidly understand and assign priority to the mission critical applications that needed to be restored to make it possible to continue business operations:

• Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

In less than two days, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then charged ahead with setup and hard drive recovery of needed servers. All Exchange schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to find local OST files (Microsoft Outlook Off-Line Folder Files) on team desktop computers in order to recover email information. A recent off-line backup of the client's accounting/MRP systems made them able to restore these vital applications back available to users. Although major work needed to be completed to recover totally from the Ryuk damage, core systems were recovered rapidly:

During the next few weeks important milestones in the recovery project were accomplished through close cooperation between Progent engineers and the client:

• Self-hosted web sites were brought back up with no loss of data.
• The MailStore Exchange Server exceeding four million historical messages was restored to operations and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/AR/Inventory capabilities were 100% restored.
• A new Palo Alto 850 firewall was installed.
• Ninety percent of the user workstations were fully operational.

Conclusion
A probable business-ending disaster was averted with top-tier professionals, a broad array of subject matter expertise, and close teamwork. Although upon completion of forensics the ransomware virus penetration described here should have been disabled with modern security technology and security best practices, user and IT administrator training, and well designed security procedures for information backup and keeping systems up to date with security patches, the reality remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware virus, feel confident that Progent's team of experts has extensive experience in crypto-ransomware virus blocking, cleanup, and file disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Pasadena
For ransomware cleanup consulting in the Pasadena metro area, phone Progent at 800-462-8800 or go to Contact Progent.