Ransomware Filtering and Recovery Expertise Manaus

Ransomware : Your Worst IT Disaster
Ransomware has become an escalating cyberplague that presents an extinction-level danger for organizations vulnerable to an assault. Different versions of ransomware like the Reveton, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for a long time and still cause harm. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, along with more as yet unnamed viruses, not only perform encryption of on-line data files but also infiltrate any accessible system restores and backups. Information synched to cloud environments can also be rendered useless. In a poorly architected environment, this can make any recovery impossible and basically sets the entire system back to square one.

Retrieving programs and data following a crypto-ransomware attack becomes a race against the clock as the victim fights to stop the spread, clear the ransomware, and resume business-critical operations. Since ransomware needs time to replicate throughout a network, assaults are frequently launched during weekends and nights, when successful penetrations typically take longer to notice. This compounds the difficulty of promptly mobilizing and coordinating a qualified response team.

Progent provides a variety of solutions for protecting Manaus organizations from crypto-ransomware penetrations. These include user education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to identify and quarantine zero-day malware attacks. Progent in addition offers the services of experienced ransomware recovery consultants with the skills and perseverance to rebuild a breached environment as urgently as possible.

Progent's Ransomware Restoration Help
Following a crypto-ransomware penetration, sending the ransom in cryptocurrency does not guarantee that cyber hackers will provide the codes to decrypt any or all of your information. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to re-install the vital components of your IT environment. Absent the availability of essential system backups, this requires a broad complement of skills, top notch team management, and the ability to work continuously until the recovery project is complete.

For two decades, Progent has made available professional Information Technology services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned top certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of experience gives Progent the capability to quickly ascertain important systems and re-organize the surviving pieces of your network environment following a crypto-ransomware event and configure them into an operational network.

Progent's ransomware team deploys powerful project management systems to coordinate the complex recovery process. Progent knows the importance of working swiftly and in unison with a client's management and IT resources to prioritize tasks and to get critical applications back online as soon as possible.

Client Story: A Successful Crypto-Ransomware Attack Restoration
A small business contacted Progent after their organization was penetrated by the Ryuk ransomware virus. Ryuk is believed to have been deployed by North Korean government sponsored hackers, possibly adopting techniques exposed from the U.S. NSA organization. Ryuk attacks specific organizations with little tolerance for disruption and is one of the most lucrative examples of crypto-ransomware. Major victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in the Chicago metro area and has about 500 workers. The Ryuk penetration had brought down all company operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the beginning of the intrusion and were eventually encrypted. The client was pursuing financing for paying the ransom (exceeding $200,000) and hoping for the best, but ultimately utilized Progent.

Progent worked together with the client to quickly determine and assign priority to the mission critical systems that needed to be addressed to make it possible to resume business functions:

• Microsoft Active Directory
• Exchange Server
• MRP System

Within 2 days, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then accomplished rebuilding and hard drive recovery on essential applications. All Exchange Server ties and attributes were usable, which facilitated the restore of Exchange. Progent was also able to locate local OST data files (Outlook Offline Data Files) on user PCs in order to recover mail data. A recent off-line backup of the client's accounting/ERP software made it possible to recover these vital services back available to users. Although significant work was left to recover totally from the Ryuk attack, core systems were restored quickly:

Throughout the next few weeks important milestones in the restoration process were made through tight collaboration between Progent team members and the client:

• Self-hosted web sites were brought back up with no loss of data.
• The MailStore Exchange Server containing more than four million historical emails was spun up and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were completely operational.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Nearly all of the user workstations were fully operational.

Conclusion
A possible business extinction catastrophe was avoided due to hard-working experts, a wide range of knowledge, and close collaboration. Although in post mortem the crypto-ransomware virus incident described here should have been disabled with modern security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and well thought out incident response procedures for data protection and keeping systems up to date with security patches, the fact is that government-sponsored cybercriminals from China, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware virus, feel confident that Progent's team of experts has proven experience in crypto-ransomware virus defense, remediation, and information systems disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Manaus
For ransomware cleanup services in the Manaus metro area, phone Progent at 800-462-8800 or see Contact Progent.