Ransomware Protection and Remediation Expertise Fort Myers
Ransomware Mitigation: An Example
Ransomware : Your Feared IT Catastrophe
Ransomware has become a modern cyberplague that poses an extinction-level threat for businesses unprepared for an attack. Multiple generations of crypto-ransomware such as Reveton, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for years and continue to cause harm. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, as well as frequent as yet unnamed malware, not only encrypt on-line data but also infect any accessible system backups. Files replicated to the cloud can also be corrupted. In a poorly designed data protection solution, it can render any restore operations useless and effectively sets the network back to square one.
Recovering applications and information following a crypto-ransomware event becomes a sprint against the clock as the targeted business fights to stop the spread, clear the virus, and resume enterprise-critical activity. Since ransomware requires time to move laterally across a targeted network, attacks are often sprung during weekends and nights, when penetrations in many cases take longer to recognize. This compounds the difficulty of rapidly assembling and orchestrating a knowledgeable mitigation team.
Progent offers a variety of services for protecting Fort Myers businesses from ransomware penetrations. These include user education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to identify and quarantine day-zero malware assaults. Progent in addition can provide the assistance of expert ransomware recovery professionals with the track record and perseverance to reconstruct a compromised system as quickly as possible.
Progent's Crypto-Ransomware Restoration Help
Following a crypto-ransomware event, even paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will respond with the keys to unencrypt any or all of your data. Kaspersky Labs determined that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to setup from scratch the mission-critical elements of your IT environment. Absent access to full data backups, this calls for a wide range of skills, well-coordinated project management, and the ability to work non-stop until the task is finished.
For two decades, Progent has offered professional IT services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have been awarded high-level industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have earned internationally-recognized certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial systems and ERP software solutions. This breadth of experience gives Progent the ability to rapidly ascertain critical systems and organize the remaining parts of your Information Technology environment following a crypto-ransomware attack and rebuild them into a functioning network.
Progent's ransomware team of experts deploys state-of-the-art project management applications to orchestrate the complicated recovery process. Progent understands the urgency of working rapidly and together with a customer's management and Information Technology staff to prioritize tasks and to get the most important services back on line as fast as humanly possible.
Case Study: A Successful Crypto-Ransomware Incident Recovery
A customer escalated to Progent after their organization was taken over by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean government sponsored hackers, suspected of using approaches leaked from the United States NSA organization. Ryuk goes after specific companies with little or no tolerance for disruption and is among the most profitable incarnations of ransomware viruses. Headline targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company based in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had disabled all company operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the start of the attack and were destroyed. The client was pursuing financing for paying the ransom (in excess of two hundred thousand dollars) and hoping for good luck, but in the end utilized Progent.
Progent worked together with the customer to rapidly identify and prioritize the essential services that had to be restored in order to continue business operations:
- Windows Active Directory
- Exchange Server
- Accounting and Manufacturing Software
Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then accomplished setup and storage recovery of the most important servers. All Exchange ties and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to collect intact OST data files (Microsoft Outlook Offline Folder Files) on various desktop computers to recover mail messages. A not too old off-line backup of the businesses financials/ERP software made them able to recover these essential programs back servicing users. Although major work still had to be done to recover completely from the Ryuk attack, core services were recovered quickly:
Throughout the following month critical milestones in the recovery project were made in tight collaboration between Progent team members and the client:
- Self-hosted web applications were restored without losing any data.
- The MailStore Microsoft Exchange Server containing more than four million historical messages was spun up and available for users.
- CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory modules were completely restored.
- A new Palo Alto Networks 850 firewall was brought online.
- Nearly all of the user desktops were being used by staff.
Conclusion
A likely company-ending catastrophe was avoided with hard-working experts, a broad range of technical expertise, and close teamwork. Although in analyzing the event afterwards the ransomware virus attack detailed here could have been shut down with up-to-date cyber security technology solutions and security best practices, staff training, and properly executed security procedures for information backup and applying software patches, the fact is that government-sponsored cyber criminals from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware incursion, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus defense, removal, and file recovery.
Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Services in Fort Myers
For ransomware system recovery consulting services in the Fort Myers metro area, call Progent at
Select Topic: