Ransomware Protection and Restoration Solutions Dayton

Crypto-Ransomware : Your Crippling IT Disaster
Crypto-Ransomware has become an escalating cyberplague that poses an enterprise-level danger for organizations vulnerable to an attack. Versions of ransomware like the CryptoLocker, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to cause destruction. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, plus more unnamed newcomers, not only perform encryption of on-line files but also infect any accessible system protection. Data synchronized to cloud environments can also be rendered useless. In a poorly designed data protection solution, this can render automated recovery hopeless and effectively knocks the datacenter back to square one.

Getting back programs and data after a ransomware event becomes a sprint against time as the targeted organization tries its best to contain the damage, clear the ransomware, and resume mission-critical activity. Because crypto-ransomware requires time to replicate throughout a targeted network, assaults are often launched during weekends and nights, when successful attacks may take more time to recognize. This compounds the difficulty of promptly mobilizing and organizing a knowledgeable mitigation team.

Progent provides an assortment of help services for securing Dayton enterprises from crypto-ransomware attacks. These include team education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to detect and suppress day-zero modern malware assaults. Progent also provides the assistance of experienced ransomware recovery consultants with the skills and perseverance to re-deploy a breached system as quickly as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will respond with the needed keys to decrypt any or all of your files. Kaspersky estimated that seventeen percent of crypto-ransomware victims never recovered their files after having paid the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to setup from scratch the essential parts of your IT environment. Absent the availability of full data backups, this calls for a wide complement of skill sets, well-coordinated team management, and the ability to work continuously until the recovery project is done.

For twenty years, Progent has offered certified expert Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned top industry certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in accounting and ERP software solutions. This breadth of experience gives Progent the capability to efficiently understand necessary systems and organize the surviving parts of your network system following a ransomware attack and rebuild them into a functioning system.

Progent's ransomware team deploys best of breed project management tools to coordinate the complex recovery process. Progent appreciates the importance of working quickly and in unison with a client's management and IT staff to assign priority to tasks and to put key applications back online as soon as possible.

Customer Story: A Successful Ransomware Penetration Response
A client hired Progent after their network system was brought down by Ryuk crypto-ransomware. Ryuk is believed to have been launched by North Korean government sponsored cybercriminals, possibly using techniques exposed from the United States National Security Agency. Ryuk targets specific organizations with limited ability to sustain disruption and is one of the most lucrative iterations of ransomware viruses. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturer located in Chicago with about 500 staff members. The Ryuk intrusion had paralyzed all company operations and manufacturing capabilities. The majority of the client's system backups had been directly accessible at the beginning of the attack and were damaged. The client was pursuing financing for paying the ransom (exceeding two hundred thousand dollars) and praying for the best, but ultimately brought in Progent.

Progent worked with the client to quickly understand and prioritize the essential applications that needed to be recovered in order to resume business operations:

• Active Directory
• Electronic Messaging
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then accomplished setup and hard drive recovery of critical applications. All Exchange Server ties and attributes were usable, which greatly helped the restore of Exchange. Progent was able to collect non-encrypted OST data files (Outlook Email Off-Line Folder Files) on team PCs to recover mail data. A recent off-line backup of the client's accounting/ERP systems made it possible to recover these vital services back available to users. Although a large amount of work was left to recover totally from the Ryuk damage, critical services were restored quickly:

During the following couple of weeks key milestones in the recovery process were accomplished in close collaboration between Progent consultants and the client:

• Internal web applications were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server exceeding 4 million historical messages was brought online and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control functions were fully recovered.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Most of the desktops and laptops were being used by staff.

Conclusion
A potential business extinction catastrophe was avoided due to hard-working professionals, a wide array of technical expertise, and close teamwork. Although in retrospect the crypto-ransomware virus attack detailed here could have been identified and stopped with advanced cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and appropriate security procedures for information protection and applying software patches, the fact is that government-sponsored hackers from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware attack, remember that Progent's team of experts has extensive experience in ransomware virus defense, mitigation, and data restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Dayton
For ransomware recovery services in the Dayton area, call Progent at 800-462-8800 or see Contact Progent.