Ransomware Protection and Cleanup Services Morgan Hill
Ransomware Mitigation: An Example
Ransomware : Your Worst Information Technology Disaster
Ransomware has become a modern cyberplague that represents an existential danger for organizations unprepared for an assault. Multiple generations of crypto-ransomware like the Reveton, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for many years and still cause havoc. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with daily as yet unnamed viruses, not only perform encryption of on-line data but also infiltrate all accessible system protection mechanisms. Data synched to the cloud can also be corrupted. In a poorly designed environment, this can render any restoration impossible and basically sets the datacenter back to square one.
Recovering applications and information after a ransomware event becomes a sprint against time as the targeted organization fights to contain the damage, eradicate the ransomware, and resume mission-critical activity. Because crypto-ransomware needs time to move laterally across a network, assaults are often launched on weekends, when penetrations may take more time to uncover. This compounds the difficulty of rapidly marshalling and orchestrating an experienced response team.
Progent has a variety of help services for securing Morgan Hill businesses from crypto-ransomware penetrations. These include staff training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to discover and extinguish zero-day modern malware assaults. Progent also provides the services of seasoned crypto-ransomware recovery engineers with the talent and commitment to restore a compromised environment as soon as possible.
Progent's Ransomware Restoration Support Services
Subsequent to a ransomware attack, paying the ransom in cryptocurrency does not ensure that criminal gangs will provide the keys to unencrypt any of your data. Kaspersky determined that seventeen percent of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The other path is to piece back together the critical elements of your Information Technology environment. Without access to essential system backups, this requires a broad range of skill sets, top notch project management, and the willingness to work non-stop until the recovery project is over.
For twenty years, Progent has made available certified expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded high-level industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial management and ERP applications. This breadth of expertise provides Progent the skills to quickly identify important systems and re-organize the remaining components of your Information Technology environment following a ransomware event and configure them into an operational network.
Progent's ransomware team utilizes best of breed project management tools to coordinate the sophisticated recovery process. Progent appreciates the urgency of working swiftly and together with a client's management and Information Technology resources to prioritize tasks and to put essential systems back on-line as fast as possible.
Client Story: A Successful Ransomware Penetration Restoration
A client engaged Progent after their network was crashed by the Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean state hackers, possibly adopting algorithms leaked from the United States NSA organization. Ryuk targets specific organizations with limited room for operational disruption and is one of the most lucrative versions of ransomware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in Chicago and has around 500 workers. The Ryuk attack had shut down all company operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the start of the attack and were damaged. The client was evaluating paying the ransom demand (more than two hundred thousand dollars) and hoping for the best, but ultimately brought in Progent.
Progent worked with the customer to rapidly determine and prioritize the mission critical systems that had to be restored in order to continue departmental functions:
- Active Directory
- Electronic Messaging
- Accounting and Manufacturing Software
Within 48 hours, Progent was able to restore Active Directory to its pre-attack state. Progent then initiated reinstallations and storage recovery of mission critical systems. All Exchange schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to find intact OST data files (Outlook Offline Data Files) on staff workstations to recover mail information. A recent off-line backup of the businesses manufacturing systems made them able to restore these essential programs back online. Although significant work was left to recover fully from the Ryuk virus, essential systems were returned to operations quickly:
Throughout the following couple of weeks important milestones in the restoration project were completed in close collaboration between Progent team members and the client:
- Internal web sites were restored without losing any data.
- The MailStore Microsoft Exchange Server exceeding 4 million historical emails was restored to operations and accessible to users.
- CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control modules were 100% restored.
- A new Palo Alto Networks 850 firewall was brought on-line.
- Ninety percent of the desktop computers were operational.
Conclusion
A likely business-killing catastrophe was evaded through the efforts of top-tier professionals, a broad spectrum of technical expertise, and tight teamwork. Although in post mortem the ransomware virus penetration described here would have been disabled with advanced cyber security solutions and recognized best practices, team education, and properly executed incident response procedures for information protection and applying software patches, the reality remains that state-sponsored hackers from Russia, China and elsewhere are relentless and are not going away. If you do fall victim to a ransomware incident, feel confident that Progent's team of professionals has proven experience in crypto-ransomware virus defense, remediation, and data disaster recovery.
Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Expertise in Morgan Hill
For ransomware recovery services in the Morgan Hill area, call Progent at
Select Topic: