Ransomware Prevention and Removal Expertise Fort Wayne

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that represents an existential threat for businesses of all sizes vulnerable to an assault. Multiple generations of ransomware like the Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been circulating for years and still inflict havoc. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, as well as more unnamed newcomers, not only encrypt on-line critical data but also infiltrate any accessible system backups. Data synched to the cloud can also be rendered useless. In a poorly architected system, this can make automated restoration useless and effectively sets the network back to square one.

Retrieving services and data following a ransomware attack becomes a race against the clock as the victim tries its best to contain, cleanup the crypto-ransomware, and restore mission-critical operations. Due to the fact that crypto-ransomware takes time to spread throughout a targeted network, attacks are often sprung during nights and weekends, when attacks typically take longer to identify. This compounds the difficulty of rapidly marshalling and coordinating a qualified response team.

Progent has a range of support services for securing Fort Wayne organizations from ransomware penetrations. These include user training to help identify and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to discover and quarantine day-zero malware attacks. Progent also provides the assistance of seasoned crypto-ransomware recovery engineers with the track record and commitment to reconstruct a breached system as quickly as possible.

Progent's Ransomware Restoration Help
After a crypto-ransomware penetration, paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will provide the keys to decrypt all your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to piece back together the vital parts of your IT environment. Absent access to full system backups, this calls for a wide complement of skills, well-coordinated project management, and the ability to work non-stop until the recovery project is done.

For two decades, Progent has offered expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have been awarded high-level industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of expertise affords Progent the skills to efficiently understand critical systems and re-organize the remaining parts of your IT environment following a ransomware event and assemble them into an operational system.

Progent's ransomware group has top notch project management applications to coordinate the complicated restoration process. Progent understands the importance of acting rapidly and together with a customer's management and Information Technology resources to prioritize tasks and to get the most important applications back on line as fast as possible.

Client Case Study: A Successful Ransomware Penetration Restoration
A client engaged Progent after their company was attacked by the Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean state criminal gangs, possibly adopting technology exposed from the U.S. NSA organization. Ryuk attacks specific businesses with limited room for operational disruption and is one of the most lucrative examples of ransomware malware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company based in the Chicago metro area with around 500 employees. The Ryuk intrusion had paralyzed all business operations and manufacturing processes. Most of the client's data backups had been online at the time of the intrusion and were damaged. The client was actively seeking loans for paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for the best, but in the end reached out to Progent.

Progent worked hand in hand the customer to rapidly identify and prioritize the critical services that needed to be restored in order to resume company operations:

• Microsoft Active Directory
• Microsoft Exchange Email
• Accounting/MRP

In less than two days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then accomplished rebuilding and storage recovery of key systems. All Exchange Server schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was also able to locate intact OST data files (Outlook Offline Folder Files) on team workstations to recover email information. A recent offline backup of the customer's financials/ERP systems made them able to return these essential programs back on-line. Although major work remained to recover totally from the Ryuk event, core systems were restored rapidly:

Throughout the following few weeks critical milestones in the restoration process were made in tight cooperation between Progent team members and the client:

• In-house web applications were brought back up without losing any data.
• The MailStore Server with over 4 million archived emails was brought online and available for users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables/Inventory Control modules were 100% operational.
• A new Palo Alto Networks 850 firewall was installed.
• Nearly all of the user desktops and notebooks were being used by staff.

Conclusion
A likely business-ending disaster was avoided through the efforts of top-tier professionals, a broad spectrum of technical expertise, and close teamwork. Although upon completion of forensics the crypto-ransomware attack detailed here should have been stopped with up-to-date security technology and ISO/IEC 27001 best practices, user and IT administrator training, and well thought out security procedures for data protection and keeping systems up to date with security patches, the reality is that state-sponsored cybercriminals from Russia, China and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's roster of professionals has substantial experience in ransomware virus blocking, removal, and information systems restoration.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Fort Wayne
For ransomware system restoration expertise in the Fort Wayne metro area, phone Progent at 800-462-8800 or go to Contact Progent.