Ransomware Filtering and Restoration Consulting Dallas

Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become a too-frequent cyber pandemic that represents an extinction-level danger for organizations vulnerable to an attack. Different iterations of crypto-ransomware such as Reveton, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for a long time and still inflict destruction. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with frequent as yet unnamed viruses, not only encrypt online critical data but also infect any accessible system restores and backups. Information synchronized to cloud environments can also be corrupted. In a poorly architected data protection solution, this can render automated restoration useless and effectively knocks the entire system back to square one.

Getting back programs and information following a ransomware intrusion becomes a sprint against the clock as the victim fights to stop lateral movement, cleanup the virus, and resume enterprise-critical operations. Since ransomware requires time to move laterally across a targeted network, attacks are usually launched during nights and weekends, when successful penetrations tend to take longer to notice. This multiplies the difficulty of rapidly mobilizing and organizing a qualified mitigation team.

Progent provides a range of services for protecting Dallas enterprises from ransomware penetrations. Among these are team member training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to identify and quarantine day-zero modern malware assaults. Progent in addition offers the assistance of expert crypto-ransomware recovery engineers with the track record and commitment to reconstruct a compromised network as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
After a ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that merciless criminals will respond with the keys to unencrypt all your information. Kaspersky determined that 17% of crypto-ransomware victims never restored their data even after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The fallback is to piece back together the key components of your Information Technology environment. Without access to essential data backups, this calls for a wide range of skill sets, professional project management, and the capability to work continuously until the task is completed.

For two decades, Progent has provided professional IT services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained advanced industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with accounting and ERP software solutions. This breadth of experience affords Progent the skills to efficiently understand necessary systems and integrate the remaining parts of your computer network environment after a crypto-ransomware event and rebuild them into a functioning network.

Progent's security group uses powerful project management applications to orchestrate the complicated recovery process. Progent appreciates the importance of acting quickly and in concert with a customer's management and IT resources to assign priority to tasks and to put essential applications back on-line as fast as possible.

Customer Case Study: A Successful Crypto-Ransomware Intrusion Recovery
A client sought out Progent after their company was taken over by Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean state sponsored hackers, possibly using algorithms leaked from the U.S. National Security Agency. Ryuk seeks specific organizations with limited ability to sustain operational disruption and is one of the most lucrative iterations of ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in Chicago and has about 500 workers. The Ryuk intrusion had brought down all business operations and manufacturing capabilities. The majority of the client's backups had been online at the beginning of the intrusion and were damaged. The client was pursuing financing for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but in the end made the decision to use Progent.

Progent worked together with the customer to rapidly determine and prioritize the most important systems that needed to be addressed to make it possible to resume business operations:

• Active Directory (AD)
• Microsoft Exchange Server
• MRP System

In less than 2 days, Progent was able to rebuild Active Directory to its pre-virus state. Progent then assisted with reinstallations and storage recovery on needed systems. All Microsoft Exchange Server schema and attributes were usable, which greatly helped the restore of Exchange. Progent was also able to locate intact OST files (Outlook Offline Data Files) on various workstations and laptops to recover email information. A recent off-line backup of the customer's financials/ERP software made it possible to recover these vital applications back servicing users. Although a large amount of work still had to be done to recover totally from the Ryuk virus, the most important systems were returned to operations rapidly:

Throughout the next couple of weeks important milestones in the recovery project were achieved through tight collaboration between Progent engineers and the client:

• Self-hosted web applications were restored with no loss of data.
• The MailStore Exchange Server containing more than 4 million historical emails was brought on-line and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control modules were 100% functional.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Most of the desktops and laptops were functioning as before the incident.

Conclusion
A potential business-killing catastrophe was evaded with dedicated professionals, a broad range of subject matter expertise, and tight collaboration. Although in post mortem the ransomware virus attack described here could have been prevented with up-to-date cyber security technology and NIST Cybersecurity Framework best practices, team education, and well thought out incident response procedures for information backup and applying software patches, the fact is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware attack, remember that Progent's roster of professionals has substantial experience in ransomware virus defense, mitigation, and data recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Dallas
For ransomware cleanup consulting services in the Dallas metro area, call Progent at 800-462-8800 or go to Contact Progent.