Ransomware Defense and Remediation Expertise Fort Worth

Crypto-Ransomware : Your Worst IT Disaster
Ransomware has become a modern cyber pandemic that presents an extinction-level threat for businesses vulnerable to an assault. Different iterations of crypto-ransomware such as CrySIS, Fusob, Locky, Syskey and MongoLock cryptoworms have been running rampant for a long time and still inflict damage. Modern variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with more as yet unnamed newcomers, not only perform encryption of online files but also infect most configured system backups. Data synchronized to off-premises disaster recovery sites can also be ransomed. In a poorly designed system, it can make automatic recovery hopeless and basically sets the entire system back to square one.

Getting back services and information following a ransomware attack becomes a sprint against the clock as the targeted business tries its best to contain the damage, cleanup the crypto-ransomware, and resume enterprise-critical operations. Due to the fact that ransomware requires time to replicate across a targeted network, penetrations are frequently sprung during nights and weekends, when successful penetrations typically take longer to detect. This multiplies the difficulty of quickly assembling and organizing an experienced response team.

Progent offers a range of services for protecting Fort Worth businesses from crypto-ransomware penetrations. Among these are staff training to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based threat protection to discover and suppress zero-day malware attacks. Progent also can provide the assistance of seasoned ransomware recovery professionals with the talent and commitment to restore a breached system as quickly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a ransomware invasion, even paying the ransom in cryptocurrency does not guarantee that cyber hackers will return the codes to decrypt any of your information. Kaspersky determined that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to piece back together the vital parts of your IT environment. Without the availability of essential system backups, this requires a broad range of skills, top notch team management, and the capability to work continuously until the recovery project is completed.

For two decades, Progent has offered expert IT services for companies throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have earned internationally-renowned certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial management and ERP application software. This breadth of experience provides Progent the capability to quickly ascertain critical systems and re-organize the remaining parts of your computer network environment after a ransomware event and rebuild them into an operational network.

Progent's ransomware group has state-of-the-art project management systems to coordinate the complex recovery process. Progent understands the urgency of acting quickly and in concert with a client's management and Information Technology team members to assign priority to tasks and to get key systems back online as soon as possible.

Client Case Study: A Successful Ransomware Incident Recovery
A client engaged Progent after their organization was attacked by the Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean government sponsored hackers, possibly using strategies leaked from America's NSA organization. Ryuk targets specific businesses with little or no room for disruption and is among the most profitable versions of crypto-ransomware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in the Chicago metro area with around 500 employees. The Ryuk penetration had brought down all essential operations and manufacturing processes. The majority of the client's information backups had been on-line at the time of the attack and were eventually encrypted. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and hoping for the best, but ultimately utilized Progent.

Progent worked hand in hand the client to rapidly assess and assign priority to the essential systems that had to be restored to make it possible to resume business operations:

• Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

Within 2 days, Progent was able to restore Active Directory to its pre-virus state. Progent then initiated rebuilding and storage recovery on mission critical systems. All Microsoft Exchange Server ties and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to assemble local OST data files (Outlook Email Offline Data Files) on team PCs in order to recover email messages. A recent offline backup of the customer's manufacturing systems made it possible to return these essential applications back online for users. Although major work needed to be completed to recover totally from the Ryuk attack, the most important systems were restored quickly:

Throughout the following few weeks critical milestones in the recovery process were accomplished through tight cooperation between Progent consultants and the customer:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Server containing more than 4 million archived messages was brought on-line and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory capabilities were completely recovered.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Ninety percent of the desktops and laptops were functioning as before the incident.

Conclusion
A probable enterprise-killing disaster was dodged due to hard-working experts, a broad spectrum of IT skills, and tight teamwork. Although upon completion of forensics the ransomware attack detailed here should have been stopped with current security solutions and NIST Cybersecurity Framework best practices, user education, and well designed incident response procedures for information protection and proper patching controls, the reality remains that government-sponsored cyber criminals from China, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware penetration, feel confident that Progent's roster of experts has substantial experience in ransomware virus blocking, removal, and file recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Fort Worth
For ransomware cleanup consulting services in the Fort Worth area, call Progent at 800-462-8800 or go to Contact Progent.