Ransomware Defense and Cleanup Consulting Fort Lauderdale

Ransomware : Your Worst Information Technology Disaster
Ransomware has become a too-frequent cyberplague that represents an existential threat for businesses unprepared for an assault. Versions of ransomware like the CryptoLocker, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for many years and continue to inflict damage. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, plus more as yet unnamed malware, not only encrypt online information but also infiltrate all available system restores and backups. Files synched to off-premises disaster recovery sites can also be ransomed. In a poorly architected system, this can render automatic restoration useless and basically knocks the datacenter back to zero.

Retrieving services and data following a ransomware event becomes a race against the clock as the targeted organization tries its best to stop lateral movement, eradicate the ransomware, and restore mission-critical activity. Due to the fact that crypto-ransomware takes time to spread throughout a network, penetrations are frequently sprung on weekends and holidays, when successful attacks tend to take longer to discover. This multiplies the difficulty of rapidly marshalling and orchestrating a capable mitigation team.

Progent has a range of support services for protecting Fort Lauderdale enterprises from ransomware events. Among these are team training to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to discover and quarantine zero-day malware assaults. Progent in addition provides the services of seasoned ransomware recovery professionals with the track record and commitment to rebuild a compromised system as soon as possible.

Progent's Crypto-Ransomware Restoration Services
Following a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will provide the needed keys to unencrypt any or all of your data. Kaspersky Labs determined that 17% of ransomware victims never recovered their files after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to setup from scratch the vital parts of your Information Technology environment. Absent the availability of complete information backups, this calls for a broad range of skills, top notch project management, and the willingness to work 24x7 until the job is completed.

For decades, Progent has provided expert IT services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained high-level certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of experience gives Progent the ability to knowledgably understand necessary systems and consolidate the surviving pieces of your network system following a ransomware penetration and configure them into a functioning system.

Progent's security team has best of breed project management applications to orchestrate the complicated restoration process. Progent appreciates the urgency of acting quickly and in unison with a customer's management and Information Technology team members to prioritize tasks and to put critical services back on-line as soon as possible.

Customer Story: A Successful Ransomware Intrusion Recovery
A business escalated to Progent after their network system was attacked by Ryuk ransomware. Ryuk is thought to have been developed by North Korean state cybercriminals, possibly using approaches exposed from America's NSA organization. Ryuk seeks specific companies with little room for disruption and is among the most profitable instances of ransomware malware. Major targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer based in the Chicago metro area with around 500 workers. The Ryuk event had brought down all business operations and manufacturing capabilities. The majority of the client's backups had been directly accessible at the beginning of the attack and were destroyed. The client was evaluating paying the ransom demand (more than $200K) and wishfully thinking for the best, but ultimately utilized Progent.

Progent worked together with the customer to rapidly get our arms around and prioritize the most important areas that needed to be recovered to make it possible to continue company functions:

• Active Directory
• Microsoft Exchange Server
• Accounting/MRP

In less than two days, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then assisted with setup and storage recovery on needed applications. All Microsoft Exchange Server ties and configuration information were usable, which facilitated the restore of Exchange. Progent was also able to collect intact OST data files (Outlook Email Offline Data Files) on user desktop computers and laptops in order to recover mail data. A recent off-line backup of the customer's financials/ERP systems made them able to return these essential programs back servicing users. Although significant work was left to recover completely from the Ryuk damage, core systems were returned to operations rapidly:

During the following month critical milestones in the restoration project were made through close collaboration between Progent team members and the customer:

• In-house web sites were restored with no loss of data.
• The MailStore Exchange Server exceeding four million archived messages was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory capabilities were 100% operational.
• A new Palo Alto 850 security appliance was installed.
• Nearly all of the user desktops were functioning as before the incident.

Conclusion
A possible business extinction disaster was evaded with dedicated experts, a broad range of knowledge, and close collaboration. Although upon completion of forensics the ransomware virus attack detailed here would have been disabled with modern security systems and ISO/IEC 27001 best practices, user and IT administrator training, and properly executed incident response procedures for information protection and keeping systems up to date with security patches, the reality is that government-sponsored cybercriminals from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a crypto-ransomware incursion, remember that Progent's team of professionals has extensive experience in ransomware virus blocking, removal, and data restoration.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Fort Lauderdale
For ransomware system recovery services in the Fort Lauderdale area, call Progent at 800-462-8800 or visit Contact Progent.