Ransomware Protection and Cleanup Consulting Norfolk

Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become a modern cyber pandemic that represents an extinction-level threat for organizations vulnerable to an assault. Different iterations of ransomware such as CrySIS, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for many years and continue to cause harm. More recent strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as frequent unnamed newcomers, not only encrypt on-line files but also infect many accessible system protection mechanisms. Information synched to off-premises disaster recovery sites can also be ransomed. In a poorly architected data protection solution, this can render any recovery hopeless and basically sets the entire system back to zero.

Restoring programs and information following a ransomware outage becomes a race against the clock as the targeted organization tries its best to stop the spread, cleanup the virus, and restore mission-critical operations. Since ransomware needs time to spread throughout a targeted network, attacks are often sprung during weekends and nights, when successful penetrations are likely to take longer to recognize. This compounds the difficulty of rapidly mobilizing and organizing a knowledgeable response team.

Progent offers a variety of help services for securing Norfolk enterprises from ransomware attacks. These include user education to help identify and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to discover and extinguish zero-day modern malware attacks. Progent in addition provides the services of seasoned ransomware recovery professionals with the skills and perseverance to rebuild a compromised system as soon as possible.

Progent's Ransomware Recovery Services
Subsequent to a ransomware penetration, sending the ransom in cryptocurrency does not ensure that criminal gangs will respond with the needed codes to decrypt all your data. Kaspersky estimated that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The fallback is to setup from scratch the vital elements of your IT environment. Without the availability of essential information backups, this calls for a broad complement of skill sets, professional team management, and the willingness to work continuously until the job is complete.

For two decades, Progent has offered expert IT services for companies across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned advanced certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have earned internationally-recognized certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with accounting and ERP applications. This breadth of expertise affords Progent the skills to rapidly understand necessary systems and consolidate the surviving parts of your IT system after a ransomware event and rebuild them into a functioning system.

Progent's security group uses powerful project management applications to coordinate the sophisticated recovery process. Progent appreciates the urgency of acting quickly and in concert with a client's management and IT resources to prioritize tasks and to put key services back on line as soon as possible.

Customer Story: A Successful Crypto-Ransomware Virus Restoration
A business hired Progent after their network was crashed by the Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean government sponsored criminal gangs, possibly adopting algorithms exposed from the U.S. NSA organization. Ryuk seeks specific companies with limited ability to sustain operational disruption and is among the most profitable examples of crypto-ransomware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in Chicago with around 500 staff members. The Ryuk event had shut down all company operations and manufacturing processes. Most of the client's system backups had been directly accessible at the time of the intrusion and were destroyed. The client was evaluating paying the ransom (in excess of $200,000) and wishfully thinking for the best, but ultimately reached out to Progent.

Progent worked with the client to rapidly identify and prioritize the mission critical services that had to be addressed to make it possible to continue company functions:

• Windows Active Directory
• Email
• Financials/MRP

In less than 2 days, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then accomplished setup and hard drive recovery on mission critical systems. All Exchange ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to assemble local OST data files (Microsoft Outlook Offline Data Files) on user PCs and laptops to recover mail data. A recent off-line backup of the customer's financials/MRP systems made them able to recover these required services back online for users. Although significant work was left to recover completely from the Ryuk virus, core systems were returned to operations quickly:

During the next month critical milestones in the recovery project were made through tight cooperation between Progent consultants and the client:

• In-house web applications were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million archived emails was brought on-line and available for users.
• CRM/Orders/Invoicing/AP/AR/Inventory Control modules were 100 percent operational.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Nearly all of the user desktops and notebooks were functioning as before the incident.

Conclusion
A possible business-ending catastrophe was dodged through the efforts of hard-working professionals, a wide array of knowledge, and tight collaboration. Although in analyzing the event afterwards the ransomware incident described here could have been identified and disabled with up-to-date cyber security systems and best practices, user training, and well designed security procedures for backup and proper patching controls, the reality is that government-sponsored hackers from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware incident, feel confident that Progent's team of professionals has substantial experience in crypto-ransomware virus defense, remediation, and file disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Norfolk
For ransomware system restoration expertise in the Norfolk area, phone Progent at 800-462-8800 or see Contact Progent.