Ransomware Protection and Recovery Expertise Omaha

Crypto-Ransomware : Your Crippling IT Nightmare
Ransomware has become a too-frequent cyberplague that represents an extinction-level danger for businesses vulnerable to an assault. Different versions of ransomware like the CrySIS, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for a long time and still inflict havoc. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, along with more unnamed malware, not only perform encryption of online data files but also infiltrate all accessible system backups. Data synchronized to the cloud can also be encrypted. In a poorly architected system, this can make any restoration impossible and basically sets the entire system back to square one.

Getting back online programs and data following a ransomware intrusion becomes a race against time as the victim fights to stop lateral movement, clear the virus, and restore mission-critical operations. Since crypto-ransomware requires time to move laterally across a targeted network, penetrations are usually sprung during weekends and nights, when successful penetrations may take longer to recognize. This multiplies the difficulty of promptly mobilizing and coordinating an experienced mitigation team.

Progent provides a variety of help services for securing Omaha enterprises from crypto-ransomware attacks. These include team member education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat defense to discover and disable zero-day malware assaults. Progent in addition can provide the assistance of veteran ransomware recovery consultants with the talent and commitment to restore a compromised environment as urgently as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware penetration, even paying the ransom in cryptocurrency does not ensure that cyber criminals will return the codes to unencrypt all your data. Kaspersky estimated that seventeen percent of ransomware victims never restored their information after having paid the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to piece back together the mission-critical components of your Information Technology environment. Absent the availability of essential system backups, this calls for a broad complement of skills, professional project management, and the capability to work continuously until the recovery project is over.

For decades, Progent has provided certified expert Information Technology services for companies across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have been awarded top industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial systems and ERP software solutions. This breadth of expertise affords Progent the ability to efficiently identify critical systems and consolidate the surviving pieces of your computer network environment after a ransomware event and assemble them into a functioning system.

Progent's recovery team of experts uses state-of-the-art project management systems to coordinate the complex recovery process. Progent understands the urgency of acting swiftly and in unison with a customer's management and IT staff to prioritize tasks and to get essential systems back online as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Intrusion Response
A business hired Progent after their organization was penetrated by the Ryuk crypto-ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored criminal gangs, suspected of adopting technology leaked from the U.S. NSA organization. Ryuk seeks specific organizations with limited room for operational disruption and is among the most lucrative incarnations of ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company located in the Chicago metro area and has about 500 employees. The Ryuk penetration had brought down all essential operations and manufacturing capabilities. Most of the client's backups had been directly accessible at the start of the attack and were encrypted. The client was actively seeking loans for paying the ransom (exceeding $200K) and wishfully thinking for the best, but in the end brought in Progent.

Progent worked together with the client to quickly understand and prioritize the most important elements that had to be restored in order to continue company operations:

• Active Directory (AD)
• Exchange Server
• Accounting/MRP

In less than 48 hours, Progent was able to restore Active Directory to its pre-virus state. Progent then performed rebuilding and storage recovery on the most important servers. All Exchange Server schema and attributes were usable, which facilitated the restore of Exchange. Progent was able to locate local OST files (Microsoft Outlook Off-Line Data Files) on staff desktop computers to recover mail data. A recent off-line backup of the client's accounting/ERP systems made it possible to return these required services back available to users. Although significant work still had to be done to recover totally from the Ryuk event, the most important systems were returned to operations rapidly:

During the next month critical milestones in the recovery project were accomplished in tight cooperation between Progent team members and the client:

• Self-hosted web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than 4 million historical emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were 100% operational.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Nearly all of the user desktops were back into operation.

Conclusion
A possible business extinction catastrophe was evaded through the efforts of hard-working professionals, a wide spectrum of subject matter expertise, and close collaboration. Although upon completion of forensics the ransomware virus attack described here should have been stopped with current security technology and recognized best practices, user and IT administrator education, and well thought out security procedures for data protection and proper patching controls, the fact remains that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's roster of experts has a proven track record in ransomware virus defense, removal, and file restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Omaha
For ransomware system recovery consulting services in the Omaha metro area, call Progent at 800-462-8800 or visit Contact Progent.