Ransomware Filtering and Restoration Consulting Salt Lake City
Crypto-Ransomware Cleanup: An Example
Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level threat for organizations vulnerable to an assault. Multiple generations of ransomware such as CrySIS, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to inflict destruction. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, along with additional as yet unnamed viruses, not only perform encryption of on-line data but also infect most accessible system backups. Data replicated to the cloud can also be rendered useless. In a vulnerable environment, it can make automated recovery impossible and basically knocks the network back to zero.
Getting back services and data following a crypto-ransomware intrusion becomes a race against time as the victim fights to contain the damage, clear the crypto-ransomware, and restore enterprise-critical operations. Since ransomware takes time to move laterally across a network, assaults are usually sprung on weekends and holidays, when successful penetrations tend to take more time to recognize. This multiplies the difficulty of quickly marshalling and organizing a capable response team.
Progent provides a variety of support services for protecting Salt Lake City enterprises from crypto-ransomware penetrations. Among these are team education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to identify and disable day-zero modern malware attacks. Progent in addition offers the services of expert ransomware recovery consultants with the talent and perseverance to re-deploy a breached environment as quickly as possible.
Progent's Crypto-Ransomware Restoration Support Services
Soon after a ransomware event, paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will provide the codes to decipher all your data. Kaspersky ascertained that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to re-install the vital elements of your IT environment. Absent access to full system backups, this requires a broad complement of skill sets, professional team management, and the ability to work 24x7 until the task is over.
For decades, Progent has offered professional Information Technology services for companies throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded high-level industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP application software. This breadth of experience affords Progent the capability to efficiently understand important systems and re-organize the remaining pieces of your computer network environment after a ransomware penetration and rebuild them into an operational network.
Progent's security team of experts deploys best of breed project management systems to coordinate the sophisticated recovery process. Progent appreciates the urgency of acting rapidly and in concert with a client's management and IT resources to assign priority to tasks and to put key applications back on line as fast as humanly possible.
Business Case Study: A Successful Crypto-Ransomware Attack Recovery
A business contacted Progent after their company was brought down by the Ryuk ransomware virus. Ryuk is believed to have been created by North Korean state sponsored cybercriminals, possibly adopting technology leaked from the United States NSA organization. Ryuk targets specific companies with limited ability to sustain operational disruption and is one of the most lucrative instances of ransomware malware. Major targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing company located in the Chicago metro area with about 500 workers. The Ryuk penetration had shut down all company operations and manufacturing processes. Most of the client's data protection had been on-line at the time of the attack and were eventually encrypted. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and praying for the best, but ultimately engaged Progent.
Progent worked hand in hand the client to quickly understand and assign priority to the mission critical areas that had to be recovered in order to resume business functions:
- Windows Active Directory
- Electronic Messaging
- Accounting/MRP
In less than 48 hours, Progent was able to rebuild Windows Active Directory to its pre-virus state. Progent then helped perform setup and storage recovery on mission critical applications. All Microsoft Exchange Server ties and attributes were intact, which accelerated the restore of Exchange. Progent was able to find non-encrypted OST data files (Outlook Offline Data Files) on various desktop computers in order to recover email information. A not too old off-line backup of the businesses accounting/ERP systems made them able to return these required applications back servicing users. Although a lot of work was left to recover totally from the Ryuk virus, essential services were restored quickly:
Throughout the following couple of weeks critical milestones in the recovery process were accomplished through close cooperation between Progent consultants and the customer:
- Self-hosted web applications were returned to operation without losing any data.
- The MailStore Server exceeding four million historical messages was spun up and available for users.
- CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were 100 percent recovered.
- A new Palo Alto Networks 850 firewall was set up and programmed.
- Ninety percent of the user workstations were fully operational.
Conclusion
A possible business-killing disaster was averted with hard-working professionals, a broad range of subject matter expertise, and tight collaboration. Although in retrospect the ransomware attack detailed here could have been shut down with current cyber security systems and security best practices, staff training, and well designed security procedures for data protection and proper patching controls, the reality is that government-sponsored hackers from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware incident, feel confident that Progent's roster of professionals has a proven track record in crypto-ransomware virus defense, mitigation, and information systems disaster recovery.
Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Expertise in Salt Lake City
For ransomware recovery consulting in the Salt Lake City area, phone Progent at
Select Topic: