Ransomware Protection and Restoration Expertise Los Angeles

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that represents an extinction-level danger for businesses of all sizes poorly prepared for an assault. Different versions of ransomware such as Dharma, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for many years and continue to inflict harm. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with daily as yet unnamed viruses, not only perform encryption of online files but also infect many available system restores and backups. Information replicated to off-premises disaster recovery sites can also be corrupted. In a vulnerable data protection solution, it can render automated recovery hopeless and basically knocks the entire system back to zero.

Getting back on-line programs and information after a ransomware intrusion becomes a race against the clock as the targeted organization tries its best to stop the spread, eradicate the virus, and resume business-critical activity. Because ransomware requires time to spread across a targeted network, assaults are usually launched at night, when attacks in many cases take more time to identify. This multiplies the difficulty of rapidly assembling and orchestrating a capable mitigation team.

Progent makes available a variety of help services for protecting Los Angeles businesses from crypto-ransomware penetrations. Among these are user education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat protection to discover and quarantine day-zero modern malware attacks. Progent in addition offers the services of expert ransomware recovery professionals with the skills and commitment to re-deploy a compromised network as quickly as possible.

Progent's Ransomware Recovery Help
Soon after a ransomware event, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will respond with the codes to decipher any or all of your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their information even after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to piece back together the key components of your Information Technology environment. Absent the availability of full system backups, this calls for a wide complement of skills, top notch team management, and the capability to work continuously until the task is completed.

For decades, Progent has offered professional IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned advanced certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have earned internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in accounting and ERP software solutions. This breadth of expertise affords Progent the capability to efficiently determine important systems and organize the surviving components of your IT environment following a ransomware attack and assemble them into a functioning system.

Progent's security group utilizes state-of-the-art project management applications to coordinate the complicated restoration process. Progent understands the urgency of working swiftly and together with a customer's management and IT team members to prioritize tasks and to put critical applications back online as soon as possible.

Client Case Study: A Successful Crypto-Ransomware Incident Response
A client engaged Progent after their organization was brought down by the Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state hackers, suspected of using strategies leaked from the United States National Security Agency. Ryuk seeks specific businesses with limited room for disruption and is one of the most lucrative instances of crypto-ransomware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company based in Chicago with around 500 workers. The Ryuk penetration had paralyzed all essential operations and manufacturing capabilities. The majority of the client's system backups had been online at the start of the attack and were destroyed. The client was pursuing financing for paying the ransom demand (in excess of $200,000) and praying for the best, but ultimately reached out to Progent.

Progent worked hand in hand the customer to quickly understand and assign priority to the critical systems that had to be addressed to make it possible to continue company operations:

• Windows Active Directory
• Microsoft Exchange
• Accounting/MRP

In less than two days, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then helped perform setup and storage recovery of key applications. All Exchange schema and attributes were usable, which accelerated the restore of Exchange. Progent was also able to collect local OST data files (Microsoft Outlook Off-Line Data Files) on various desktop computers in order to recover email data. A recent off-line backup of the businesses accounting/ERP software made it possible to return these essential programs back available to users. Although a large amount of work needed to be completed to recover fully from the Ryuk attack, essential systems were returned to operations quickly:

Over the following month important milestones in the restoration process were completed in close collaboration between Progent team members and the customer:

• Internal web sites were returned to operation without losing any data.
• The MailStore Exchange Server with over four million archived messages was brought online and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were 100 percent recovered.
• A new Palo Alto 850 firewall was deployed.
• Most of the desktops and laptops were back into operation.

Conclusion
A potential business-killing catastrophe was evaded by top-tier experts, a wide spectrum of technical expertise, and tight collaboration. Although upon completion of forensics the ransomware attack detailed here would have been prevented with current cyber security technology solutions and best practices, staff training, and appropriate security procedures for data backup and proper patching controls, the fact is that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware incursion, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, mitigation, and data disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Los Angeles
For ransomware cleanup services in the Los Angeles area, phone Progent at 800-462-8800 or visit Contact Progent.