Ransomware Prevention and Cleanup Services Fresno

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a modern cyber pandemic that poses an existential danger for organizations poorly prepared for an attack. Different versions of crypto-ransomware such as Reveton, Fusob, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and continue to cause havoc. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, as well as daily unnamed viruses, not only perform encryption of on-line critical data but also infiltrate most available system restores and backups. Files synchronized to the cloud can also be rendered useless. In a poorly architected data protection solution, this can render automated recovery useless and effectively sets the network back to zero.

Retrieving applications and information following a ransomware outage becomes a sprint against the clock as the victim struggles to stop the spread, cleanup the crypto-ransomware, and resume mission-critical operations. Due to the fact that ransomware requires time to spread throughout a network, attacks are frequently launched on weekends, when penetrations are likely to take longer to uncover. This multiplies the difficulty of promptly assembling and orchestrating a knowledgeable mitigation team.

Progent provides an assortment of help services for securing Fresno enterprises from ransomware attacks. These include user education to help recognize and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to discover and extinguish day-zero malware attacks. Progent also offers the assistance of experienced ransomware recovery engineers with the talent and perseverance to re-deploy a breached network as soon as possible.

Progent's Crypto-Ransomware Recovery Services
After a ransomware attack, even paying the ransom in cryptocurrency does not guarantee that cyber hackers will return the keys to decrypt any or all of your files. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never restored their files after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to re-install the essential components of your Information Technology environment. Absent access to complete data backups, this calls for a wide complement of IT skills, professional project management, and the capability to work continuously until the job is complete.

For twenty years, Progent has made available certified expert IT services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained high-level certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in accounting and ERP application software. This breadth of experience gives Progent the ability to rapidly determine critical systems and integrate the remaining pieces of your IT environment following a ransomware event and assemble them into an operational system.

Progent's recovery group utilizes top notch project management applications to coordinate the complicated recovery process. Progent knows the importance of working quickly and together with a client's management and IT resources to assign priority to tasks and to put critical services back on line as fast as humanly possible.

Client Case Study: A Successful Ransomware Incident Restoration
A client engaged Progent after their company was crashed by the Ryuk crypto-ransomware. Ryuk is generally considered to have been deployed by North Korean state cybercriminals, possibly using technology exposed from the United States National Security Agency. Ryuk seeks specific organizations with limited room for operational disruption and is among the most profitable incarnations of ransomware malware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company located in Chicago and has around 500 workers. The Ryuk attack had brought down all company operations and manufacturing processes. The majority of the client's system backups had been on-line at the start of the intrusion and were destroyed. The client considered paying the ransom (exceeding $200,000) and hoping for good luck, but in the end engaged Progent.

Progent worked with the client to quickly determine and assign priority to the critical applications that needed to be recovered in order to resume departmental operations:

• Windows Active Directory
• Electronic Mail
• MRP System

In less than 48 hours, Progent was able to recover Active Directory to its pre-attack state. Progent then completed setup and storage recovery on the most important applications. All Exchange schema and attributes were usable, which facilitated the restore of Exchange. Progent was also able to assemble non-encrypted OST data files (Microsoft Outlook Off-Line Folder Files) on user PCs in order to recover mail information. A recent off-line backup of the customer's financials/MRP systems made it possible to recover these vital services back online. Although a lot of work needed to be completed to recover totally from the Ryuk virus, essential services were returned to operations rapidly:

During the following few weeks key milestones in the recovery project were completed in tight collaboration between Progent consultants and the customer:

• In-house web applications were returned to operation with no loss of data.
• The MailStore Exchange Server exceeding four million archived messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were 100 percent restored.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Ninety percent of the user desktops and notebooks were fully operational.

Conclusion
A possible business-ending disaster was avoided due to results-oriented professionals, a broad array of technical expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware incident described here should have been identified and prevented with advanced cyber security technology solutions and recognized best practices, user education, and well designed security procedures for data backup and proper patching controls, the reality is that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's team of professionals has substantial experience in ransomware virus defense, cleanup, and file restoration.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Fresno
For ransomware system recovery expertise in the Fresno area, call Progent at 800-462-8800 or see Contact Progent.