Ransomware Filtering and Recovery Consulting Glendale

Crypto-Ransomware : Your Worst IT Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that presents an enterprise-level threat for businesses of all sizes unprepared for an assault. Different iterations of ransomware such as CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been around for years and still cause destruction. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, plus additional as yet unnamed malware, not only encrypt online critical data but also infect any configured system backup. Files synchronized to the cloud can also be corrupted. In a poorly architected environment, this can render automated recovery impossible and effectively sets the datacenter back to zero.

Retrieving applications and data after a ransomware attack becomes a race against time as the targeted business tries its best to contain the damage, remove the ransomware, and resume enterprise-critical activity. Due to the fact that ransomware needs time to move laterally throughout a targeted network, attacks are frequently launched on weekends and holidays, when attacks in many cases take more time to discover. This multiplies the difficulty of promptly mobilizing and orchestrating a capable response team.

Progent has a variety of services for protecting Glendale businesses from crypto-ransomware penetrations. Among these are team education to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat protection to identify and quarantine zero-day malware attacks. Progent also offers the services of veteran ransomware recovery consultants with the track record and commitment to rebuild a compromised environment as soon as possible.

Progent's Ransomware Restoration Support Services
Following a crypto-ransomware event, sending the ransom in cryptocurrency does not guarantee that merciless criminals will return the needed codes to unencrypt all your data. Kaspersky ascertained that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The alternative is to setup from scratch the vital elements of your IT environment. Without the availability of complete system backups, this calls for a broad complement of skill sets, professional team management, and the willingness to work non-stop until the task is completed.

For decades, Progent has provided certified expert IT services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have been awarded top industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial management and ERP applications. This breadth of experience provides Progent the skills to efficiently identify necessary systems and consolidate the surviving parts of your IT system after a crypto-ransomware event and assemble them into a functioning network.

Progent's ransomware team of experts deploys top notch project management tools to orchestrate the sophisticated restoration process. Progent understands the importance of acting swiftly and together with a customer's management and IT team members to prioritize tasks and to put the most important systems back on line as fast as possible.

Customer Story: A Successful Ransomware Intrusion Recovery
A customer sought out Progent after their company was crashed by the Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean state cybercriminals, possibly adopting techniques exposed from the U.S. National Security Agency. Ryuk goes after specific companies with little or no tolerance for operational disruption and is one of the most profitable iterations of ransomware malware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in Chicago and has around 500 staff members. The Ryuk attack had frozen all company operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the time of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (in excess of $200K) and praying for good luck, but in the end made the decision to use Progent.

Progent worked together with the client to quickly get our arms around and prioritize the most important areas that needed to be addressed in order to resume company operations:

• Windows Active Directory
• Microsoft Exchange Server
• MRP System

In less than 48 hours, Progent was able to recover Active Directory to its pre-intrusion state. Progent then assisted with rebuilding and hard drive recovery on essential systems. All Exchange Server schema and configuration information were usable, which accelerated the restore of Exchange. Progent was able to collect local OST files (Outlook Email Offline Folder Files) on team PCs and laptops in order to recover mail data. A not too old offline backup of the businesses financials/ERP systems made them able to return these required applications back on-line. Although a lot of work remained to recover completely from the Ryuk virus, core systems were returned to operations quickly:

Throughout the next month important milestones in the restoration project were achieved in close cooperation between Progent team members and the customer:

• In-house web sites were restored with no loss of data.
• The MailStore Exchange Server with over four million archived emails was restored to operations and available for users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control modules were completely functional.
• A new Palo Alto 850 firewall was set up and programmed.
• Ninety percent of the desktops and laptops were functioning as before the incident.

Conclusion
A potential business-ending catastrophe was evaded through the efforts of dedicated experts, a broad array of IT skills, and close teamwork. Although upon completion of forensics the crypto-ransomware penetration described here could have been stopped with advanced security technology and NIST Cybersecurity Framework best practices, user and IT administrator training, and properly executed security procedures for data backup and proper patching controls, the reality is that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware incursion, remember that Progent's roster of experts has substantial experience in ransomware virus defense, removal, and file disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Glendale
For ransomware recovery consulting in the Glendale metro area, phone Progent at 800-462-8800 or see Contact Progent.