Ransomware Prevention and Cleanup Solutions Cheyenne

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that poses an existential danger for organizations poorly prepared for an attack. Different versions of ransomware such as Reveton, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for a long time and continue to inflict destruction. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as additional as yet unnamed viruses, not only encrypt online information but also infiltrate many configured system backup. Information synched to the cloud can also be corrupted. In a vulnerable system, it can render automated restoration impossible and effectively knocks the network back to zero.

Getting back on-line services and data following a ransomware intrusion becomes a race against the clock as the targeted business tries its best to stop lateral movement, remove the ransomware, and resume business-critical activity. Because ransomware takes time to spread across a network, attacks are often sprung during nights and weekends, when penetrations typically take longer to identify. This compounds the difficulty of quickly assembling and orchestrating an experienced response team.

Progent offers an assortment of solutions for securing Cheyenne enterprises from ransomware events. These include user training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to identify and suppress day-zero malware attacks. Progent in addition offers the assistance of veteran crypto-ransomware recovery engineers with the track record and perseverance to reconstruct a breached system as urgently as possible.

Progent's Ransomware Restoration Support Services
Following a ransomware penetration, sending the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the keys to decipher any or all of your data. Kaspersky Labs estimated that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to setup from scratch the key parts of your IT environment. Without the availability of complete information backups, this requires a broad range of skills, top notch project management, and the willingness to work non-stop until the recovery project is completed.

For decades, Progent has provided certified expert Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have attained top certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial management and ERP software solutions. This breadth of expertise affords Progent the capability to efficiently understand necessary systems and re-organize the remaining parts of your computer network system after a ransomware penetration and rebuild them into a functioning system.

Progent's recovery group has state-of-the-art project management systems to coordinate the sophisticated restoration process. Progent knows the urgency of working swiftly and together with a client's management and IT staff to prioritize tasks and to put essential systems back on line as soon as possible.

Business Case Study: A Successful Ransomware Penetration Recovery
A client contacted Progent after their network system was attacked by Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean state sponsored hackers, suspected of adopting techniques exposed from America's National Security Agency. Ryuk seeks specific organizations with limited room for operational disruption and is among the most lucrative examples of ransomware malware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business headquartered in Chicago with about 500 employees. The Ryuk event had shut down all essential operations and manufacturing processes. The majority of the client's information backups had been on-line at the start of the attack and were encrypted. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but ultimately called Progent.

Progent worked hand in hand the client to quickly determine and assign priority to the most important elements that had to be restored to make it possible to restart company functions:

• Active Directory
• Microsoft Exchange Email
• Accounting/MRP

In less than 48 hours, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then helped perform rebuilding and storage recovery on needed systems. All Microsoft Exchange Server data and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to collect non-encrypted OST data files (Outlook Off-Line Data Files) on various desktop computers and laptops in order to recover email messages. A not too old off-line backup of the client's accounting/MRP systems made it possible to return these essential applications back available to users. Although a lot of work still had to be done to recover completely from the Ryuk virus, critical services were recovered quickly:

During the following couple of weeks critical milestones in the restoration project were made through close collaboration between Progent team members and the customer:

• Internal web applications were restored without losing any data.
• The MailStore Server with over four million historical messages was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable/AR/Inventory modules were fully restored.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• 90% of the user workstations were back into operation.

Conclusion
A potential business-killing catastrophe was avoided due to hard-working professionals, a wide range of IT skills, and tight collaboration. Although in retrospect the crypto-ransomware virus penetration described here could have been prevented with advanced security technology and security best practices, user education, and appropriate security procedures for data backup and proper patching controls, the reality is that government-sponsored hackers from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware virus, feel confident that Progent's team of experts has substantial experience in ransomware virus defense, removal, and data restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Cheyenne
For ransomware cleanup services in the Cheyenne metro area, call Progent at 800-462-8800 or see Contact Progent.