Ransomware Defense and Removal Solutions Cincinnati

Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become an escalating cyberplague that represents an existential threat for businesses of all sizes poorly prepared for an attack. Multiple generations of crypto-ransomware like the CrySIS, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been replicating for many years and continue to cause havoc. Newer variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, plus frequent as yet unnamed malware, not only perform encryption of on-line data files but also infiltrate many available system backups. Data replicated to the cloud can also be ransomed. In a vulnerable environment, it can make any restore operations useless and basically knocks the datacenter back to zero.

Getting back applications and data after a crypto-ransomware event becomes a race against the clock as the victim fights to stop the spread, cleanup the virus, and resume enterprise-critical activity. Due to the fact that ransomware requires time to replicate throughout a network, penetrations are frequently sprung on weekends, when successful attacks typically take longer to recognize. This multiplies the difficulty of promptly assembling and orchestrating a qualified response team.

Progent makes available a variety of services for securing Cincinnati enterprises from ransomware attacks. Among these are team training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat protection to discover and quarantine zero-day modern malware attacks. Progent also offers the assistance of veteran ransomware recovery consultants with the track record and commitment to reconstruct a breached system as rapidly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a ransomware penetration, even paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will provide the needed codes to decipher any of your files. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The fallback is to piece back together the vital elements of your Information Technology environment. Without access to essential data backups, this calls for a wide complement of IT skills, well-coordinated team management, and the capability to work continuously until the job is completed.

For twenty years, Progent has offered expert Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have garnered internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial management and ERP applications. This breadth of expertise provides Progent the skills to efficiently identify critical systems and integrate the remaining parts of your computer network environment following a ransomware penetration and rebuild them into a functioning network.

Progent's recovery team of experts has best of breed project management systems to orchestrate the sophisticated restoration process. Progent understands the urgency of acting swiftly and in concert with a customer's management and Information Technology resources to prioritize tasks and to put key services back on-line as soon as humanly possible.

Case Study: A Successful Ransomware Virus Response
A business hired Progent after their network was attacked by Ryuk ransomware. Ryuk is believed to have been launched by North Korean state criminal gangs, suspected of adopting strategies leaked from the U.S. NSA organization. Ryuk goes after specific companies with limited ability to sustain operational disruption and is among the most lucrative instances of ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business based in the Chicago metro area and has about 500 employees. The Ryuk attack had disabled all essential operations and manufacturing processes. Most of the client's information backups had been on-line at the beginning of the attack and were destroyed. The client considered paying the ransom demand (in excess of $200,000) and hoping for the best, but in the end called Progent.

Progent worked with the customer to quickly understand and assign priority to the most important services that needed to be recovered to make it possible to resume business functions:

• Windows Active Directory
• Email
• Accounting and Manufacturing Software

In less than two days, Progent was able to recover Active Directory to its pre-virus state. Progent then initiated reinstallations and storage recovery of essential applications. All Microsoft Exchange Server data and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to collect non-encrypted OST files (Outlook Email Offline Folder Files) on various desktop computers to recover mail information. A recent offline backup of the customer's financials/ERP software made it possible to recover these vital applications back servicing users. Although major work still had to be done to recover fully from the Ryuk attack, essential services were restored rapidly:

During the following couple of weeks key milestones in the restoration process were made through close collaboration between Progent team members and the client:

• In-house web sites were restored with no loss of information.
• The MailStore Exchange Server exceeding 4 million archived emails was spun up and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control functions were 100% recovered.
• A new Palo Alto 850 security appliance was installed.
• Most of the user PCs were back into operation.

Conclusion
A potential business disaster was averted due to hard-working professionals, a wide range of subject matter expertise, and close collaboration. Although in post mortem the ransomware attack described here would have been identified and prevented with modern cyber security technology solutions and security best practices, team education, and well thought out security procedures for backup and applying software patches, the fact is that government-sponsored hackers from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, mitigation, and file recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Cincinnati
For ransomware system restoration expertise in the Cincinnati metro area, call Progent at 800-462-8800 or visit Contact Progent.