Ransomware Filtering and Recovery Services Birmingham

Ransomware : Your Crippling IT Catastrophe
Ransomware has become a modern cyberplague that represents an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Different versions of ransomware like the CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and still inflict destruction. More recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus additional as yet unnamed newcomers, not only perform encryption of on-line information but also infect all configured system protection. Data synchronized to off-premises disaster recovery sites can also be ransomed. In a poorly architected data protection solution, this can render automatic restore operations impossible and basically sets the datacenter back to zero.

Retrieving services and data after a ransomware intrusion becomes a sprint against the clock as the victim struggles to contain, cleanup the ransomware, and resume business-critical operations. Because crypto-ransomware needs time to replicate across a targeted network, penetrations are frequently sprung at night, when successful penetrations typically take longer to identify. This compounds the difficulty of quickly mobilizing and coordinating a knowledgeable response team.

Progent provides an assortment of support services for securing Birmingham organizations from ransomware attacks. These include staff training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based threat protection to identify and suppress zero-day modern malware assaults. Progent in addition can provide the assistance of experienced ransomware recovery engineers with the skills and commitment to reconstruct a breached system as rapidly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a ransomware invasion, sending the ransom demands in cryptocurrency does not guarantee that cyber criminals will respond with the needed codes to unencrypt any or all of your information. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The alternative is to piece back together the vital elements of your IT environment. Absent access to complete information backups, this requires a broad range of skill sets, well-coordinated project management, and the ability to work 24x7 until the recovery project is complete.

For twenty years, Progent has offered expert Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with financial management and ERP software solutions. This breadth of expertise provides Progent the skills to knowledgably identify important systems and re-organize the surviving components of your network environment after a ransomware attack and assemble them into an operational network.

Progent's security group uses powerful project management tools to orchestrate the complex recovery process. Progent understands the importance of acting rapidly and in unison with a client's management and Information Technology resources to assign priority to tasks and to get the most important applications back online as fast as possible.

Business Case Study: A Successful Crypto-Ransomware Virus Recovery
A business sought out Progent after their network was attacked by the Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean state sponsored hackers, possibly using technology leaked from the U.S. National Security Agency. Ryuk targets specific businesses with limited room for disruption and is among the most profitable instances of crypto-ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in Chicago and has around 500 workers. The Ryuk event had paralyzed all essential operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the start of the intrusion and were encrypted. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and hoping for the best, but ultimately called Progent.

Progent worked together with the customer to rapidly understand and assign priority to the most important applications that had to be addressed in order to continue company operations:

• Microsoft Active Directory
• Email
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then completed rebuilding and hard drive recovery of mission critical systems. All Exchange Server data and attributes were intact, which accelerated the restore of Exchange. Progent was able to collect non-encrypted OST data files (Outlook Offline Folder Files) on staff desktop computers and laptops to recover mail information. A recent off-line backup of the businesses manufacturing systems made them able to restore these vital programs back online. Although a lot of work still had to be done to recover fully from the Ryuk virus, essential systems were returned to operations quickly:

Over the next month key milestones in the recovery process were accomplished in close cooperation between Progent team members and the client:

• Self-hosted web sites were restored with no loss of data.
• The MailStore Exchange Server exceeding 4 million archived messages was brought online and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory functions were 100 percent restored.
• A new Palo Alto 850 firewall was brought on-line.
• Ninety percent of the user workstations were back into operation.

Conclusion
A likely business catastrophe was avoided by dedicated experts, a wide spectrum of IT skills, and close teamwork. Although in analyzing the event afterwards the ransomware virus incident described here should have been blocked with up-to-date security systems and NIST Cybersecurity Framework best practices, user and IT administrator training, and well thought out security procedures for data protection and applying software patches, the reality remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's team of professionals has proven experience in ransomware virus defense, removal, and information systems restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Birmingham
For ransomware system recovery expertise in the Birmingham metro area, call Progent at 800-462-8800 or see Contact Progent.