Ransomware Prevention and Remediation Consulting Uberlândia

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become an escalating cyberplague that poses an existential danger for businesses of all sizes vulnerable to an attack. Multiple generations of ransomware like the CrySIS, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for years and continue to inflict harm. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, along with more as yet unnamed viruses, not only encrypt on-line data but also infiltrate many available system backup. Data synchronized to off-premises disaster recovery sites can also be encrypted. In a poorly architected data protection solution, this can make automated recovery impossible and basically sets the datacenter back to square one.

Getting back online applications and data after a ransomware outage becomes a sprint against the clock as the targeted business tries its best to stop lateral movement, eradicate the ransomware, and restore enterprise-critical operations. Because ransomware needs time to move laterally throughout a targeted network, assaults are usually sprung at night, when successful attacks may take more time to discover. This compounds the difficulty of rapidly mobilizing and coordinating an experienced mitigation team.

Progent provides a range of help services for securing Uberlândia businesses from ransomware attacks. These include staff education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat protection to detect and suppress day-zero modern malware assaults. Progent in addition offers the assistance of experienced ransomware recovery engineers with the track record and commitment to restore a compromised network as soon as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will return the codes to decipher all your data. Kaspersky Labs estimated that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The fallback is to setup from scratch the essential parts of your Information Technology environment. Absent access to essential information backups, this calls for a wide complement of skill sets, top notch project management, and the capability to work non-stop until the job is done.

For twenty years, Progent has provided expert IT services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have been awarded advanced certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of expertise provides Progent the capability to quickly determine critical systems and integrate the surviving parts of your network environment following a ransomware attack and assemble them into an operational network.

Progent's recovery group deploys powerful project management systems to coordinate the complicated recovery process. Progent knows the urgency of working quickly and in concert with a client's management and IT team members to prioritize tasks and to put critical services back online as fast as humanly possible.

Customer Case Study: A Successful Ransomware Incident Response
A customer sought out Progent after their network was penetrated by the Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean government sponsored criminal gangs, possibly using approaches exposed from the U.S. NSA organization. Ryuk goes after specific organizations with little tolerance for disruption and is one of the most profitable examples of ransomware malware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in the Chicago metro area and has around 500 staff members. The Ryuk attack had disabled all essential operations and manufacturing capabilities. Most of the client's system backups had been on-line at the time of the attack and were encrypted. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for the best, but ultimately engaged Progent.

Progent worked hand in hand the client to quickly determine and assign priority to the most important elements that needed to be recovered to make it possible to restart company operations:

• Windows Active Directory
• E-Mail
• Accounting/MRP

In less than two days, Progent was able to re-build Active Directory to its pre-attack state. Progent then accomplished rebuilding and storage recovery of key servers. All Exchange Server ties and attributes were usable, which facilitated the restore of Exchange. Progent was able to assemble non-encrypted OST files (Microsoft Outlook Offline Data Files) on user PCs and laptops in order to recover mail information. A recent off-line backup of the customer's manufacturing software made it possible to recover these vital applications back available to users. Although a lot of work remained to recover completely from the Ryuk attack, core services were returned to operations rapidly:

During the following few weeks important milestones in the restoration project were achieved through close cooperation between Progent team members and the client:

• In-house web sites were returned to operation without losing any information.
• The MailStore Server containing more than four million archived messages was brought online and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables/Inventory capabilities were 100% recovered.
• A new Palo Alto Networks 850 security appliance was deployed.
• Nearly all of the desktops and laptops were back into operation.

Conclusion
A likely business disaster was averted with top-tier professionals, a broad array of subject matter expertise, and close teamwork. Although in analyzing the event afterwards the ransomware incident described here could have been disabled with advanced cyber security solutions and NIST Cybersecurity Framework best practices, user education, and appropriate security procedures for data protection and applying software patches, the fact is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, mitigation, and data disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Uberlândia
For ransomware recovery services in the Uberlândia area, call Progent at 800-462-8800 or see Contact Progent.