Ransomware Protection and Recovery Expertise Garland

Ransomware : Your Worst IT Catastrophe
Ransomware has become a too-frequent cyberplague that presents an extinction-level danger for organizations vulnerable to an attack. Versions of ransomware such as CryptoLocker, Fusob, Locky, NotPetya and MongoLock cryptoworms have been around for years and still cause damage. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with frequent unnamed newcomers, not only encrypt online critical data but also infect many accessible system protection. Information synched to off-premises disaster recovery sites can also be rendered useless. In a vulnerable data protection solution, this can render any restore operations useless and basically knocks the network back to square one.

Recovering services and data after a ransomware attack becomes a sprint against the clock as the targeted organization tries its best to contain the damage, cleanup the ransomware, and restore business-critical activity. Because ransomware needs time to replicate across a network, attacks are often sprung on weekends, when penetrations are likely to take more time to discover. This compounds the difficulty of quickly marshalling and coordinating an experienced mitigation team.

Progent has a range of services for protecting Garland businesses from ransomware penetrations. These include team member training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to detect and quarantine zero-day modern malware assaults. Progent also can provide the assistance of experienced crypto-ransomware recovery engineers with the talent and commitment to rebuild a breached system as soon as possible.

Progent's Crypto-Ransomware Recovery Support Services
Soon after a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not ensure that cyber criminals will return the needed keys to unencrypt any of your files. Kaspersky Labs determined that 17% of ransomware victims never recovered their information after having paid the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to setup from scratch the critical elements of your Information Technology environment. Without access to complete system backups, this calls for a wide complement of skill sets, top notch team management, and the willingness to work continuously until the recovery project is done.

For twenty years, Progent has provided expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained advanced certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP software solutions. This breadth of expertise provides Progent the capability to efficiently identify necessary systems and consolidate the remaining components of your network environment after a crypto-ransomware penetration and rebuild them into an operational system.

Progent's security team of experts uses best of breed project management applications to orchestrate the complex restoration process. Progent appreciates the importance of working rapidly and together with a client's management and IT staff to prioritize tasks and to get the most important services back online as fast as humanly possible.

Business Case Study: A Successful Ransomware Incident Response
A customer escalated to Progent after their network system was penetrated by Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored criminal gangs, possibly using techniques leaked from the U.S. NSA organization. Ryuk targets specific businesses with little tolerance for disruption and is one of the most profitable instances of ransomware malware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in the Chicago metro area and has about 500 workers. The Ryuk event had paralyzed all company operations and manufacturing processes. The majority of the client's system backups had been online at the beginning of the intrusion and were encrypted. The client considered paying the ransom (more than $200,000) and hoping for the best, but ultimately reached out to Progent.

Progent worked together with the client to quickly get our arms around and assign priority to the mission critical applications that needed to be restored in order to restart departmental functions:

• Active Directory (AD)
• Microsoft Exchange
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then accomplished rebuilding and storage recovery on mission critical servers. All Microsoft Exchange Server schema and configuration information were usable, which facilitated the restore of Exchange. Progent was able to assemble local OST data files (Outlook Offline Folder Files) on various PCs to recover email data. A not too old off-line backup of the client's financials/ERP software made them able to return these essential applications back available to users. Although a lot of work still had to be done to recover totally from the Ryuk event, critical services were restored rapidly:

During the next couple of weeks important milestones in the recovery process were made through tight cooperation between Progent team members and the client:

• In-house web applications were brought back up without losing any data.
• The MailStore Microsoft Exchange Server containing more than four million archived emails was brought online and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 security appliance was installed.
• Nearly all of the user PCs were back into operation.

Conclusion
A likely business extinction catastrophe was averted with results-oriented professionals, a broad range of knowledge, and close collaboration. Although upon completion of forensics the crypto-ransomware virus attack detailed here could have been disabled with advanced cyber security technology solutions and security best practices, user education, and well thought out incident response procedures for information protection and proper patching controls, the reality is that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware penetration, feel confident that Progent's team of experts has proven experience in ransomware virus defense, removal, and information systems restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Garland
For ransomware system recovery services in the Garland metro area, phone Progent at 800-462-8800 or see Contact Progent.