Ransomware Protection and Restoration Consulting Edison
Ransomware Removal: A Case Study
Ransomware : Your Feared Information Technology Disaster
Ransomware has become a too-frequent cyberplague that presents an enterprise-level threat for businesses poorly prepared for an assault. Versions of crypto-ransomware like the Dharma, WannaCry, Locky, Syskey and MongoLock cryptoworms have been circulating for many years and continue to inflict harm. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, as well as additional as yet unnamed malware, not only perform encryption of on-line data files but also infiltrate all accessible system protection mechanisms. Information synchronized to cloud environments can also be rendered useless. In a vulnerable system, it can render automated recovery hopeless and basically knocks the network back to zero.
Recovering programs and data after a crypto-ransomware attack becomes a race against the clock as the targeted organization tries its best to stop the spread, cleanup the virus, and restore mission-critical activity. Since ransomware takes time to move laterally throughout a network, assaults are usually sprung during nights and weekends, when successful penetrations typically take more time to detect. This compounds the difficulty of promptly mobilizing and coordinating an experienced mitigation team.
Progent makes available an assortment of services for protecting Edison organizations from crypto-ransomware penetrations. Among these are team member education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to discover and disable day-zero modern malware attacks. Progent in addition offers the services of seasoned crypto-ransomware recovery engineers with the track record and commitment to reconstruct a compromised network as rapidly as possible.
Progent's Ransomware Recovery Help
Subsequent to a ransomware attack, paying the ransom demands in cryptocurrency does not guarantee that merciless criminals will return the needed codes to decipher any of your files. Kaspersky estimated that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to piece back together the vital parts of your Information Technology environment. Without access to full system backups, this calls for a broad range of skills, well-coordinated team management, and the ability to work non-stop until the task is done.
For twenty years, Progent has provided professional IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of expertise gives Progent the capability to efficiently identify important systems and organize the remaining components of your computer network environment following a ransomware penetration and rebuild them into an operational system.
Progent's security team of experts deploys state-of-the-art project management systems to orchestrate the sophisticated restoration process. Progent knows the importance of working quickly and in concert with a customer's management and IT resources to assign priority to tasks and to get critical applications back online as soon as humanly possible.
Client Story: A Successful Ransomware Intrusion Response
A client contacted Progent after their network was attacked by Ryuk ransomware virus. Ryuk is generally considered to have been created by North Korean state hackers, suspected of adopting techniques exposed from the United States National Security Agency. Ryuk attacks specific businesses with little or no tolerance for disruption and is among the most lucrative instances of ransomware. Major victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer located in the Chicago metro area and has around 500 workers. The Ryuk event had paralyzed all company operations and manufacturing processes. Most of the client's data protection had been online at the start of the attack and were encrypted. The client was evaluating paying the ransom (exceeding $200K) and wishfully thinking for good luck, but ultimately engaged Progent.
Progent worked with the client to rapidly identify and prioritize the critical elements that needed to be addressed in order to continue business operations:
- Windows Active Directory
- Exchange Server
- Accounting and Manufacturing Software
In less than 48 hours, Progent was able to recover Active Directory services to its pre-penetration state. Progent then helped perform setup and hard drive recovery on key servers. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to collect local OST data files (Outlook Offline Data Files) on user PCs to recover email messages. A not too old offline backup of the customer's accounting systems made them able to recover these essential programs back online for users. Although significant work was left to recover totally from the Ryuk event, critical services were restored rapidly:
Throughout the following couple of weeks critical milestones in the restoration process were accomplished in tight cooperation between Progent engineers and the customer:
- Self-hosted web sites were brought back up with no loss of information.
- The MailStore Microsoft Exchange Server exceeding four million historical messages was brought online and accessible to users.
- CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory Control modules were fully functional.
- A new Palo Alto 850 firewall was installed and configured.
- Most of the user workstations were back into operation.
Conclusion
A possible business extinction catastrophe was evaded through the efforts of hard-working experts, a broad range of knowledge, and tight teamwork. Although upon completion of forensics the ransomware incident detailed here should have been identified and stopped with current security technology and best practices, user education, and properly executed security procedures for information backup and applying software patches, the reality is that government-sponsored hackers from China, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware virus, remember that Progent's team of experts has extensive experience in ransomware virus blocking, cleanup, and information systems restoration.
Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Consulting in Edison
For ransomware system recovery consulting in the Edison metro area, call Progent at
Select Topic: