Ransomware Prevention and Cleanup Expertise Colorado Springs
Crypto-Ransomware Restoration: An Example
Ransomware : Your Worst IT Nightmare
Ransomware has become a too-frequent cyberplague that presents an existential threat for organizations vulnerable to an attack. Versions of crypto-ransomware such as CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for years and still inflict destruction. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as additional as yet unnamed malware, not only encrypt on-line critical data but also infiltrate many available system backups. Data synchronized to the cloud can also be corrupted. In a poorly designed system, it can make automated restore operations impossible and effectively knocks the network back to zero.
Restoring services and information following a crypto-ransomware event becomes a sprint against the clock as the targeted organization tries its best to contain, remove the ransomware, and resume business-critical activity. Since ransomware takes time to spread across a targeted network, penetrations are usually sprung at night, when successful penetrations may take more time to recognize. This multiplies the difficulty of rapidly mobilizing and organizing an experienced mitigation team.
Progent offers a range of solutions for securing Colorado Springs enterprises from ransomware attacks. Among these are staff training to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat defense to discover and extinguish day-zero malware assaults. Progent in addition offers the services of experienced ransomware recovery professionals with the track record and commitment to rebuild a compromised environment as soon as possible.
Progent's Crypto-Ransomware Recovery Help
Subsequent to a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will provide the keys to unencrypt all your files. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to setup from scratch the mission-critical parts of your Information Technology environment. Without the availability of full system backups, this requires a wide complement of skills, well-coordinated team management, and the capability to work continuously until the job is complete.
For two decades, Progent has offered professional Information Technology services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have attained high-level certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-renowned industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP application software. This breadth of experience affords Progent the ability to quickly ascertain critical systems and consolidate the surviving parts of your IT system following a crypto-ransomware event and rebuild them into a functioning network.
Progent's security group utilizes top notch project management tools to orchestrate the complicated recovery process. Progent understands the importance of acting quickly and in concert with a client's management and Information Technology staff to assign priority to tasks and to get key systems back online as soon as possible.
Business Case Study: A Successful Ransomware Penetration Response
A business escalated to Progent after their company was taken over by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored cybercriminals, possibly adopting strategies exposed from the United States National Security Agency. Ryuk goes after specific companies with little room for disruption and is among the most profitable examples of ransomware malware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in Chicago with about 500 staff members. The Ryuk penetration had brought down all company operations and manufacturing capabilities. Most of the client's system backups had been online at the time of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom demand (more than $200K) and hoping for the best, but in the end made the decision to use Progent.
Progent worked hand in hand the customer to quickly determine and assign priority to the essential areas that needed to be recovered in order to restart business operations:
- Windows Active Directory
- Microsoft Exchange Email
- Financials/MRP
Within 2 days, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then initiated rebuilding and hard drive recovery on the most important applications. All Exchange data and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to locate non-encrypted OST files (Outlook Off-Line Folder Files) on user workstations and laptops in order to recover email data. A not too old offline backup of the businesses accounting/MRP systems made it possible to restore these required services back online. Although a large amount of work was left to recover completely from the Ryuk attack, critical services were restored rapidly:
Throughout the next few weeks important milestones in the recovery process were accomplished in close collaboration between Progent consultants and the customer:
- In-house web sites were returned to operation without losing any information.
- The MailStore Exchange Server with over four million archived emails was spun up and available for users.
- CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control modules were 100% recovered.
- A new Palo Alto Networks 850 firewall was deployed.
- Ninety percent of the user desktops were back into operation.
Conclusion
A potential business-ending disaster was avoided due to top-tier experts, a wide spectrum of knowledge, and close teamwork. Although in retrospect the crypto-ransomware virus penetration detailed here would have been identified and blocked with modern cyber security technology solutions and best practices, team education, and properly executed incident response procedures for information protection and proper patching controls, the reality remains that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's roster of experts has a proven track record in ransomware virus blocking, remediation, and data recovery.
Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Services in Colorado Springs
For ransomware recovery consulting services in the Colorado Springs metro area, phone Progent at
Select Topic: