Ransomware Filtering and Removal Solutions Grand Rapids

Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyberplague that represents an existential threat for organizations vulnerable to an assault. Different iterations of crypto-ransomware like the CrySIS, Fusob, Locky, Syskey and MongoLock cryptoworms have been out in the wild for years and still cause damage. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, as well as daily unnamed malware, not only perform encryption of on-line data files but also infiltrate many accessible system protection mechanisms. Data synched to off-premises disaster recovery sites can also be rendered useless. In a poorly architected data protection solution, this can render automated recovery impossible and effectively sets the network back to zero.

Restoring programs and data following a crypto-ransomware intrusion becomes a race against the clock as the targeted organization tries its best to stop lateral movement, cleanup the virus, and restore mission-critical activity. Due to the fact that ransomware takes time to replicate throughout a network, assaults are usually launched during weekends and nights, when successful attacks may take more time to identify. This multiplies the difficulty of rapidly marshalling and organizing a qualified response team.

Progent has a variety of support services for protecting Grand Rapids enterprises from ransomware events. These include user education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to detect and extinguish day-zero malware attacks. Progent also provides the services of veteran ransomware recovery consultants with the track record and commitment to reconstruct a compromised environment as soon as possible.

Progent's Ransomware Recovery Services
Soon after a ransomware penetration, paying the ransom in cryptocurrency does not guarantee that cyber hackers will respond with the codes to decipher any or all of your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to piece back together the key parts of your IT environment. Absent access to full information backups, this calls for a broad range of IT skills, top notch project management, and the capability to work non-stop until the recovery project is over.

For twenty years, Progent has provided professional Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial management and ERP application software. This breadth of expertise affords Progent the capability to efficiently determine critical systems and organize the remaining parts of your network system following a crypto-ransomware event and assemble them into an operational network.

Progent's ransomware team uses powerful project management applications to coordinate the complex recovery process. Progent appreciates the urgency of working swiftly and together with a client's management and IT resources to prioritize tasks and to get essential systems back on-line as soon as humanly possible.

Client Story: A Successful Ransomware Incident Restoration
A small business contacted Progent after their company was attacked by the Ryuk ransomware. Ryuk is generally considered to have been created by North Korean government sponsored cybercriminals, suspected of adopting algorithms leaked from the U.S. NSA organization. Ryuk goes after specific companies with little or no ability to sustain operational disruption and is among the most lucrative iterations of ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturer based in the Chicago metro area and has about 500 workers. The Ryuk intrusion had brought down all company operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (exceeding $200K) and praying for good luck, but in the end utilized Progent.

Progent worked together with the client to quickly understand and assign priority to the critical services that needed to be addressed in order to resume business functions:

• Active Directory
• Exchange Server
• Accounting/MRP

Within 48 hours, Progent was able to restore Active Directory services to its pre-virus state. Progent then accomplished rebuilding and hard drive recovery of needed applications. All Exchange Server data and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to assemble non-encrypted OST data files (Outlook Email Off-Line Folder Files) on team workstations and laptops to recover mail data. A not too old offline backup of the businesses accounting/MRP software made them able to restore these required applications back available to users. Although major work still had to be done to recover fully from the Ryuk virus, critical systems were returned to operations rapidly:

Over the following month critical milestones in the recovery project were achieved in close cooperation between Progent consultants and the customer:

• In-house web applications were restored with no loss of information.
• The MailStore Exchange Server with over 4 million historical emails was restored to operations and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control modules were 100 percent functional.
• A new Palo Alto 850 security appliance was installed.
• 90% of the desktop computers were fully operational.

Conclusion
A likely business catastrophe was avoided through the efforts of dedicated professionals, a wide range of knowledge, and close collaboration. Although in retrospect the crypto-ransomware virus attack detailed here could have been blocked with modern cyber security technology solutions and NIST Cybersecurity Framework best practices, user training, and well thought out incident response procedures for information protection and proper patching controls, the reality is that state-sponsored hackers from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware incursion, remember that Progent's roster of experts has substantial experience in crypto-ransomware virus blocking, cleanup, and file restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Grand Rapids
For ransomware cleanup services in the Grand Rapids area, phone Progent at 800-462-8800 or visit Contact Progent.