Ransomware Prevention and Cleanup Expertise Mesa
Ransomware Rollback: An Example
Ransomware : Your Worst Information Technology Catastrophe
Ransomware has become an escalating cyberplague that presents an existential threat for businesses of all sizes poorly prepared for an assault. Multiple generations of ransomware such as Reveton, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for years and continue to cause destruction. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as more unnamed viruses, not only perform encryption of on-line data but also infiltrate many configured system backup. Data synchronized to cloud environments can also be encrypted. In a vulnerable environment, it can render automated restoration hopeless and basically knocks the network back to zero.
Restoring programs and data following a ransomware outage becomes a sprint against time as the targeted business fights to stop lateral movement, remove the virus, and resume business-critical operations. Due to the fact that ransomware needs time to spread throughout a network, attacks are usually launched during weekends and nights, when attacks tend to take longer to notice. This compounds the difficulty of rapidly mobilizing and orchestrating a capable mitigation team.
Progent has a variety of help services for securing Mesa enterprises from ransomware events. Among these are team member training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to identify and extinguish day-zero modern malware attacks. Progent in addition can provide the services of expert ransomware recovery consultants with the track record and commitment to reconstruct a breached network as rapidly as possible.
Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware event, paying the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will respond with the codes to decipher any of your data. Kaspersky ascertained that 17% of crypto-ransomware victims never restored their information even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to setup from scratch the essential elements of your Information Technology environment. Absent access to complete system backups, this requires a wide complement of IT skills, professional project management, and the capability to work non-stop until the task is finished.
For twenty years, Progent has offered certified expert Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have been awarded high-level industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of expertise gives Progent the ability to rapidly understand important systems and organize the surviving parts of your computer network environment following a crypto-ransomware attack and rebuild them into an operational system.
Progent's ransomware group deploys state-of-the-art project management tools to coordinate the complex recovery process. Progent knows the importance of working quickly and in concert with a customer's management and Information Technology team members to prioritize tasks and to put the most important systems back online as soon as humanly possible.
Customer Story: A Successful Ransomware Attack Response
A business sought out Progent after their network system was taken over by Ryuk ransomware virus. Ryuk is believed to have been deployed by North Korean government sponsored cybercriminals, possibly using techniques exposed from the U.S. NSA organization. Ryuk seeks specific businesses with limited room for operational disruption and is among the most lucrative versions of ransomware. Major targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business based in Chicago with about 500 workers. The Ryuk event had brought down all essential operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the start of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom (in excess of $200,000) and wishfully thinking for the best, but in the end reached out to Progent.
Progent worked hand in hand the client to quickly assess and prioritize the critical services that needed to be restored in order to restart departmental operations:
- Active Directory (AD)
- Electronic Mail
- MRP System
Within two days, Progent was able to recover Active Directory to its pre-virus state. Progent then charged ahead with rebuilding and storage recovery of mission critical applications. All Exchange Server data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to locate local OST files (Microsoft Outlook Offline Folder Files) on various desktop computers in order to recover mail messages. A not too old offline backup of the businesses financials/ERP software made them able to recover these vital programs back on-line. Although major work still had to be done to recover totally from the Ryuk attack, the most important systems were recovered rapidly:
Throughout the following couple of weeks key milestones in the restoration project were accomplished through close cooperation between Progent consultants and the customer:
- In-house web sites were restored without losing any information.
- The MailStore Exchange Server containing more than 4 million historical messages was brought on-line and accessible to users.
- CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory capabilities were 100 percent recovered.
- A new Palo Alto Networks 850 firewall was installed and configured.
- 90% of the user desktops were operational.
Conclusion
A potential enterprise-killing catastrophe was averted due to hard-working professionals, a wide spectrum of IT skills, and close collaboration. Although in analyzing the event afterwards the ransomware penetration detailed here would have been disabled with up-to-date security systems and best practices, team training, and properly executed incident response procedures for information backup and applying software patches, the fact remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware penetration, feel confident that Progent's roster of experts has extensive experience in ransomware virus defense, removal, and information systems restoration.
Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Expertise in Mesa
For ransomware cleanup services in the Mesa metro area, call Progent at
Select Topic: