Ransomware Prevention and Restoration Consulting Charlotte

Crypto-Ransomware : Your Worst IT Catastrophe
Crypto-Ransomware has become an escalating cyberplague that presents an existential threat for businesses of all sizes vulnerable to an attack. Multiple generations of crypto-ransomware such as Reveton, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for many years and continue to inflict damage. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus additional unnamed malware, not only encrypt on-line data but also infiltrate most accessible system restores and backups. Data replicated to cloud environments can also be rendered useless. In a poorly designed data protection solution, it can render automatic restoration hopeless and basically sets the datacenter back to square one.

Retrieving applications and information after a crypto-ransomware attack becomes a sprint against the clock as the targeted business tries its best to contain, remove the ransomware, and restore business-critical operations. Since ransomware needs time to move laterally throughout a network, attacks are frequently sprung during nights and weekends, when successful penetrations typically take more time to detect. This compounds the difficulty of rapidly marshalling and orchestrating an experienced mitigation team.

Progent provides an assortment of services for protecting Charlotte enterprises from ransomware events. These include staff education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to detect and disable day-zero malware attacks. Progent also offers the services of expert ransomware recovery consultants with the skills and perseverance to restore a compromised system as urgently as possible.

Progent's Ransomware Recovery Services
Following a crypto-ransomware invasion, even paying the ransom demands in cryptocurrency does not guarantee that distant criminals will provide the needed keys to decrypt all your information. Kaspersky ascertained that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to re-install the critical components of your IT environment. Without access to full data backups, this calls for a wide range of skill sets, well-coordinated project management, and the capability to work 24x7 until the task is completed.

For twenty years, Progent has provided certified expert IT services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have been awarded advanced certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in financial management and ERP application software. This breadth of experience affords Progent the ability to quickly determine critical systems and organize the surviving parts of your Information Technology environment after a crypto-ransomware event and assemble them into a functioning network.

Progent's recovery team of experts deploys best of breed project management systems to orchestrate the complicated recovery process. Progent appreciates the importance of acting rapidly and together with a customer's management and IT staff to assign priority to tasks and to put critical applications back on line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Virus Response
A business hired Progent after their network was brought down by Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean state sponsored criminal gangs, possibly using approaches leaked from the United States NSA organization. Ryuk goes after specific organizations with limited room for disruption and is among the most profitable versions of crypto-ransomware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in Chicago with around 500 staff members. The Ryuk event had paralyzed all company operations and manufacturing processes. The majority of the client's backups had been on-line at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom (more than $200K) and praying for good luck, but ultimately utilized Progent.

Progent worked with the client to quickly assess and prioritize the essential areas that needed to be addressed in order to restart company operations:

• Active Directory (AD)
• Exchange Server
• Financials/MRP

In less than 2 days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then performed reinstallations and storage recovery of essential applications. All Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to assemble intact OST data files (Outlook Off-Line Data Files) on various PCs to recover email data. A recent offline backup of the client's financials/ERP systems made it possible to recover these essential applications back on-line. Although a large amount of work needed to be completed to recover completely from the Ryuk damage, core services were returned to operations quickly:

Over the next month critical milestones in the recovery project were made in close collaboration between Progent consultants and the client:

• In-house web sites were restored without losing any information.
• The MailStore Server exceeding 4 million historical messages was brought on-line and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control modules were completely operational.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the user desktops were functioning as before the incident.

Conclusion
A probable business-ending disaster was avoided due to top-tier experts, a broad array of subject matter expertise, and tight teamwork. Although in hindsight the ransomware attack described here could have been shut down with current security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and appropriate security procedures for information protection and proper patching controls, the reality is that state-sponsored cybercriminals from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's roster of professionals has a proven track record in ransomware virus blocking, remediation, and data restoration.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Charlotte
For ransomware system recovery consulting in the Charlotte metro area, call Progent at 800-462-8800 or see Contact Progent.