Ransomware Filtering and Cleanup Services Portland

Crypto-Ransomware : Your Crippling IT Catastrophe
Ransomware has become a modern cyber pandemic that poses an enterprise-level danger for businesses poorly prepared for an attack. Multiple generations of ransomware such as Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been circulating for many years and continue to cause destruction. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus additional unnamed malware, not only perform encryption of on-line data files but also infiltrate most available system backups. Data replicated to the cloud can also be encrypted. In a vulnerable system, it can make any restore operations hopeless and basically sets the entire system back to zero.

Restoring applications and information following a ransomware attack becomes a race against the clock as the targeted business struggles to stop the spread, remove the virus, and resume business-critical operations. Since ransomware takes time to move laterally across a network, attacks are frequently launched on weekends, when penetrations may take more time to discover. This compounds the difficulty of promptly marshalling and organizing a knowledgeable mitigation team.

Progent makes available a range of support services for protecting Portland businesses from crypto-ransomware attacks. Among these are staff education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to detect and quarantine zero-day malware assaults. Progent in addition provides the services of expert ransomware recovery consultants with the talent and perseverance to reconstruct a compromised system as quickly as possible.

Progent's Ransomware Restoration Services
Subsequent to a ransomware penetration, even paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will provide the needed codes to unencrypt any or all of your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to re-install the key components of your Information Technology environment. Absent the availability of essential data backups, this requires a broad range of IT skills, well-coordinated project management, and the ability to work continuously until the job is over.

For two decades, Progent has made available certified expert IT services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded advanced industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP applications. This breadth of experience affords Progent the ability to knowledgably understand important systems and re-organize the remaining pieces of your computer network environment after a ransomware attack and configure them into a functioning network.

Progent's security team of experts utilizes powerful project management tools to orchestrate the complicated recovery process. Progent knows the importance of working rapidly and together with a customer's management and IT team members to prioritize tasks and to get critical services back on-line as soon as possible.

Client Case Study: A Successful Ransomware Penetration Restoration
A business contacted Progent after their network system was penetrated by the Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean government sponsored criminal gangs, suspected of adopting techniques exposed from the U.S. National Security Agency. Ryuk seeks specific businesses with little room for disruption and is among the most lucrative instances of ransomware viruses. Major targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturer located in Chicago with around 500 staff members. The Ryuk attack had shut down all essential operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the beginning of the intrusion and were damaged. The client considered paying the ransom (exceeding $200,000) and wishfully thinking for good luck, but ultimately engaged Progent.

Progent worked hand in hand the client to rapidly determine and assign priority to the mission critical services that needed to be restored in order to restart departmental operations:

• Active Directory
• Microsoft Exchange
• MRP System

In less than two days, Progent was able to rebuild Active Directory to its pre-intrusion state. Progent then assisted with reinstallations and storage recovery of the most important servers. All Exchange Server ties and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to collect local OST data files (Outlook Email Offline Data Files) on user desktop computers to recover mail information. A not too old off-line backup of the customer's manufacturing systems made it possible to recover these essential programs back online. Although a lot of work still had to be done to recover totally from the Ryuk attack, essential services were recovered rapidly:

Over the next month important milestones in the recovery project were made in close collaboration between Progent consultants and the customer:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Server exceeding 4 million archived emails was spun up and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory capabilities were 100% functional.
• A new Palo Alto 850 security appliance was brought on-line.
• Most of the user desktops were fully operational.

Conclusion
A likely enterprise-killing catastrophe was averted with results-oriented experts, a wide range of IT skills, and tight collaboration. Although upon completion of forensics the ransomware virus attack described here could have been shut down with current security systems and security best practices, user and IT administrator education, and well designed security procedures for data backup and applying software patches, the reality is that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's roster of professionals has proven experience in ransomware virus blocking, cleanup, and file restoration.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Portland
For ransomware system recovery consulting in the Portland area, phone Progent at 800-462-8800 or visit Contact Progent.