Ransomware Filtering and Cleanup Services Schaumburg

Ransomware : Your Worst IT Disaster
Crypto-Ransomware has become an escalating cyberplague that represents an extinction-level danger for businesses of all sizes vulnerable to an attack. Versions of ransomware such as Reveton, Fusob, Locky, SamSam and MongoLock cryptoworms have been circulating for years and still cause havoc. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, plus more as yet unnamed malware, not only perform encryption of on-line information but also infiltrate many configured system protection mechanisms. Data synchronized to off-premises disaster recovery sites can also be encrypted. In a vulnerable data protection solution, this can render automated restore operations impossible and basically knocks the entire system back to square one.

Restoring services and data after a ransomware attack becomes a race against time as the targeted business fights to stop lateral movement, remove the ransomware, and restore mission-critical activity. Due to the fact that ransomware requires time to replicate across a targeted network, attacks are frequently sprung at night, when successful penetrations tend to take more time to discover. This multiplies the difficulty of promptly assembling and orchestrating a knowledgeable mitigation team.

Progent offers a variety of services for protecting Schaumburg businesses from ransomware events. Among these are team member training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based threat protection to identify and suppress zero-day malware attacks. Progent in addition provides the assistance of seasoned ransomware recovery consultants with the track record and perseverance to re-deploy a compromised network as urgently as possible.

Progent's Ransomware Restoration Help
Soon after a ransomware invasion, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will respond with the needed keys to decipher all your information. Kaspersky determined that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to setup from scratch the key elements of your IT environment. Absent the availability of full data backups, this requires a wide range of skills, top notch team management, and the willingness to work non-stop until the job is complete.

For twenty years, Progent has provided expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned advanced certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP application software. This breadth of expertise provides Progent the ability to efficiently identify critical systems and organize the surviving pieces of your Information Technology system after a crypto-ransomware penetration and assemble them into a functioning system.

Progent's security team utilizes top notch project management tools to coordinate the complex recovery process. Progent understands the urgency of working swiftly and in unison with a client's management and Information Technology staff to prioritize tasks and to get critical systems back on line as fast as possible.

Customer Case Study: A Successful Ransomware Virus Response
A business hired Progent after their network was attacked by the Ryuk crypto-ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored cybercriminals, possibly adopting algorithms exposed from the United States National Security Agency. Ryuk goes after specific companies with limited room for disruption and is among the most profitable incarnations of ransomware viruses. Major organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer headquartered in the Chicago metro area and has about 500 employees. The Ryuk event had frozen all essential operations and manufacturing processes. The majority of the client's data protection had been on-line at the start of the attack and were destroyed. The client was pursuing financing for paying the ransom demand (more than $200,000) and wishfully thinking for good luck, but ultimately reached out to Progent.

Progent worked together with the client to quickly identify and assign priority to the critical systems that needed to be addressed to make it possible to continue business operations:

• Windows Active Directory
• Email
• MRP System

Within 48 hours, Progent was able to recover Active Directory services to its pre-virus state. Progent then assisted with reinstallations and hard drive recovery on the most important systems. All Exchange ties and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to collect local OST data files (Microsoft Outlook Offline Folder Files) on staff PCs and laptops to recover email messages. A not too old offline backup of the businesses financials/ERP systems made it possible to return these vital applications back online for users. Although major work needed to be completed to recover completely from the Ryuk attack, the most important services were returned to operations quickly:

Throughout the following couple of weeks key milestones in the restoration project were completed through close collaboration between Progent consultants and the client:

• In-house web sites were restored without losing any information.
• The MailStore Server with over 4 million archived messages was restored to operations and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory functions were completely recovered.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Nearly all of the user workstations were back into operation.

Conclusion
A possible enterprise-killing disaster was averted through the efforts of results-oriented experts, a wide array of knowledge, and close teamwork. Although upon completion of forensics the crypto-ransomware incident detailed here would have been stopped with up-to-date security systems and recognized best practices, staff training, and well thought out security procedures for backup and applying software patches, the fact is that state-sponsored hackers from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, feel confident that Progent's roster of professionals has extensive experience in ransomware virus defense, remediation, and information systems disaster recovery.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Schaumburg
For ransomware recovery services in the Schaumburg area, phone Progent at 800-462-8800 or visit Contact Progent.