Ransomware Filtering and Removal Consulting Florianópolis

Ransomware : Your Crippling IT Disaster
Ransomware has become an escalating cyberplague that represents an existential threat for organizations poorly prepared for an attack. Different iterations of ransomware like the Reveton, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for years and still inflict harm. Modern strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as more as yet unnamed malware, not only encrypt online files but also infiltrate most configured system restores and backups. Information synchronized to cloud environments can also be corrupted. In a poorly designed system, this can make any restore operations useless and effectively knocks the network back to zero.

Restoring programs and data after a crypto-ransomware attack becomes a sprint against the clock as the targeted business tries its best to contain, clear the ransomware, and resume enterprise-critical operations. Due to the fact that ransomware requires time to replicate across a targeted network, attacks are often sprung on weekends, when successful attacks in many cases take more time to discover. This multiplies the difficulty of quickly marshalling and organizing an experienced mitigation team.

Progent offers a variety of services for protecting Florianópolis enterprises from ransomware penetrations. Among these are user training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat protection to identify and extinguish day-zero malware assaults. Progent also offers the assistance of seasoned ransomware recovery engineers with the skills and perseverance to reconstruct a compromised system as urgently as possible.

Progent's Crypto-Ransomware Recovery Services
Following a ransomware attack, even paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will provide the codes to unencrypt any or all of your information. Kaspersky estimated that seventeen percent of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The other path is to piece back together the key parts of your IT environment. Absent the availability of full information backups, this calls for a broad range of skill sets, professional project management, and the ability to work continuously until the task is finished.

For decades, Progent has made available professional IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have attained top certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of experience gives Progent the ability to efficiently understand critical systems and integrate the surviving parts of your computer network system after a ransomware penetration and configure them into an operational network.

Progent's ransomware group utilizes powerful project management systems to coordinate the complicated restoration process. Progent knows the urgency of working rapidly and in concert with a client's management and IT team members to prioritize tasks and to get essential systems back online as soon as possible.

Business Case Study: A Successful Ransomware Virus Response
A business escalated to Progent after their company was brought down by the Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean government sponsored hackers, suspected of using algorithms exposed from the United States NSA organization. Ryuk attacks specific organizations with little ability to sustain operational disruption and is among the most lucrative incarnations of ransomware malware. Headline targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in the Chicago metro area and has around 500 workers. The Ryuk intrusion had frozen all business operations and manufacturing capabilities. The majority of the client's data backups had been online at the time of the intrusion and were encrypted. The client considered paying the ransom demand (more than two hundred thousand dollars) and praying for good luck, but ultimately made the decision to use Progent.

Progent worked hand in hand the customer to quickly get our arms around and prioritize the mission critical applications that needed to be restored to make it possible to restart company operations:

• Microsoft Active Directory
• E-Mail
• Accounting/MRP

In less than two days, Progent was able to recover Windows Active Directory to its pre-intrusion state. Progent then accomplished reinstallations and storage recovery on key applications. All Microsoft Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to assemble local OST data files (Outlook Off-Line Folder Files) on various workstations and laptops in order to recover mail data. A not too old off-line backup of the client's manufacturing software made them able to restore these vital programs back servicing users. Although a large amount of work was left to recover completely from the Ryuk virus, the most important services were returned to operations rapidly:

During the next couple of weeks important milestones in the restoration process were achieved through tight cooperation between Progent team members and the client:

• Internal web applications were restored without losing any data.
• The MailStore Exchange Server with over 4 million archived messages was brought online and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory Control modules were 100% functional.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• 90% of the user desktops were fully operational.

Conclusion
A potential business-killing catastrophe was dodged due to dedicated experts, a wide spectrum of IT skills, and tight teamwork. Although in hindsight the ransomware virus attack described here should have been identified and prevented with advanced security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and well thought out security procedures for data protection and proper patching controls, the fact is that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware attack, remember that Progent's team of professionals has extensive experience in crypto-ransomware virus defense, mitigation, and information systems disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Florianópolis
For ransomware system restoration consulting in the Florianópolis metro area, call Progent at 800-462-8800 or go to Contact Progent.