Ransomware Filtering and Remediation Consulting Barueri-Alphaville

Ransomware : Your Worst IT Catastrophe
Ransomware has become a modern cyber pandemic that presents an existential danger for businesses poorly prepared for an assault. Different versions of ransomware like the CrySIS, WannaCry, Locky, Syskey and MongoLock cryptoworms have been circulating for many years and continue to cause harm. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with additional unnamed newcomers, not only encrypt on-line data but also infect most configured system restores and backups. Files replicated to the cloud can also be encrypted. In a poorly designed system, it can render automated restore operations hopeless and effectively knocks the datacenter back to square one.

Getting back online applications and data following a ransomware event becomes a race against the clock as the targeted organization fights to contain, eradicate the ransomware, and resume business-critical operations. Due to the fact that ransomware requires time to replicate throughout a targeted network, penetrations are often sprung at night, when successful penetrations typically take longer to identify. This compounds the difficulty of promptly marshalling and coordinating a knowledgeable response team.

Progent makes available an assortment of support services for protecting Barueri-Alphaville organizations from crypto-ransomware penetrations. Among these are user training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to detect and disable zero-day modern malware assaults. Progent also offers the assistance of experienced crypto-ransomware recovery engineers with the skills and commitment to reconstruct a breached system as quickly as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a crypto-ransomware event, sending the ransom demands in cryptocurrency does not ensure that criminal gangs will respond with the keys to unencrypt all your files. Kaspersky Labs ascertained that seventeen percent of ransomware victims never restored their files even after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The fallback is to setup from scratch the mission-critical components of your Information Technology environment. Without the availability of complete information backups, this calls for a wide complement of IT skills, well-coordinated project management, and the capability to work continuously until the recovery project is completed.

For twenty years, Progent has provided expert IT services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned advanced certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of experience provides Progent the skills to efficiently identify important systems and integrate the surviving parts of your Information Technology environment after a ransomware penetration and rebuild them into a functioning network.

Progent's ransomware group has powerful project management tools to orchestrate the complex restoration process. Progent understands the urgency of acting quickly and in unison with a customer's management and IT resources to assign priority to tasks and to get the most important applications back on line as fast as humanly possible.

Customer Story: A Successful Ransomware Attack Response
A small business sought out Progent after their company was crashed by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored hackers, suspected of using techniques leaked from the U.S. National Security Agency. Ryuk attacks specific companies with limited tolerance for operational disruption and is one of the most lucrative instances of ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in Chicago and has about 500 employees. The Ryuk event had brought down all essential operations and manufacturing capabilities. Most of the client's data protection had been online at the time of the intrusion and were damaged. The client was pursuing financing for paying the ransom demand (exceeding $200K) and wishfully thinking for good luck, but in the end brought in Progent.

Progent worked with the client to quickly identify and prioritize the essential elements that needed to be restored to make it possible to resume departmental operations:

• Active Directory (AD)
• Email
• Accounting/MRP

In less than 2 days, Progent was able to rebuild Active Directory to its pre-intrusion state. Progent then charged ahead with reinstallations and storage recovery of mission critical servers. All Exchange Server data and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Email Off-Line Data Files) on team PCs and laptops to recover email information. A recent off-line backup of the client's financials/ERP software made them able to recover these vital services back online. Although a large amount of work was left to recover totally from the Ryuk attack, the most important systems were recovered quickly:

Throughout the following month critical milestones in the restoration process were completed in tight cooperation between Progent team members and the customer:

• In-house web applications were restored without losing any data.
• The MailStore Server with over 4 million historical messages was restored to operations and available for users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables/Inventory Control capabilities were 100 percent functional.
• A new Palo Alto 850 firewall was deployed.
• Nearly all of the user PCs were back into operation.

Conclusion
A probable business disaster was avoided through the efforts of results-oriented professionals, a broad range of technical expertise, and close teamwork. Although upon completion of forensics the ransomware penetration described here should have been identified and stopped with modern security solutions and best practices, team education, and properly executed incident response procedures for information backup and applying software patches, the reality is that government-sponsored hackers from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware incursion, remember that Progent's roster of professionals has extensive experience in ransomware virus defense, mitigation, and file recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Barueri-Alphaville
For ransomware cleanup services in the Barueri-Alphaville metro area, call Progent at 800-462-8800 or visit Contact Progent.