Ransomware Defense and Restoration Expertise Honolulu

Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become a modern cyberplague that represents an extinction-level threat for businesses poorly prepared for an assault. Versions of crypto-ransomware such as Reveton, Fusob, Locky, Syskey and MongoLock cryptoworms have been replicating for many years and still inflict harm. More recent variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with more unnamed viruses, not only perform encryption of on-line information but also infect most available system protection mechanisms. Information synchronized to cloud environments can also be encrypted. In a vulnerable data protection solution, this can make automated restoration impossible and effectively sets the datacenter back to square one.

Getting back on-line services and data following a crypto-ransomware outage becomes a race against the clock as the targeted business fights to stop the spread, eradicate the ransomware, and resume business-critical activity. Since ransomware needs time to move laterally across a network, assaults are usually launched at night, when penetrations typically take longer to discover. This multiplies the difficulty of promptly marshalling and orchestrating a capable mitigation team.

Progent makes available a range of help services for securing Honolulu organizations from ransomware penetrations. Among these are team member training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to discover and extinguish day-zero modern malware assaults. Progent also offers the assistance of experienced ransomware recovery consultants with the talent and perseverance to restore a breached environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Services
Soon after a ransomware attack, paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will respond with the keys to unencrypt any or all of your data. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to piece back together the vital components of your Information Technology environment. Without the availability of complete information backups, this requires a broad complement of skills, top notch team management, and the ability to work 24x7 until the job is complete.

For two decades, Progent has offered expert IT services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded high-level certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial systems and ERP applications. This breadth of experience affords Progent the capability to rapidly ascertain necessary systems and consolidate the surviving pieces of your IT environment following a crypto-ransomware attack and rebuild them into an operational network.

Progent's recovery team of experts has powerful project management applications to coordinate the sophisticated recovery process. Progent knows the importance of acting rapidly and in unison with a customer's management and IT staff to assign priority to tasks and to get key applications back on line as soon as humanly possible.

Client Story: A Successful Ransomware Virus Restoration
A business sought out Progent after their organization was penetrated by the Ryuk crypto-ransomware. Ryuk is generally considered to have been launched by North Korean state sponsored criminal gangs, suspected of adopting techniques exposed from the United States NSA organization. Ryuk seeks specific organizations with little or no ability to sustain operational disruption and is one of the most profitable instances of crypto-ransomware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company located in Chicago and has about 500 workers. The Ryuk attack had disabled all company operations and manufacturing capabilities. The majority of the client's system backups had been on-line at the time of the intrusion and were encrypted. The client considered paying the ransom demand (exceeding $200,000) and hoping for good luck, but in the end called Progent.

Progent worked together with the customer to rapidly get our arms around and prioritize the mission critical areas that had to be addressed in order to restart departmental operations:

• Windows Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to re-build Active Directory to its pre-virus state. Progent then initiated rebuilding and storage recovery on essential servers. All Exchange data and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to locate intact OST files (Outlook Email Offline Data Files) on user workstations and laptops to recover mail data. A recent off-line backup of the customer's financials/MRP software made them able to restore these essential applications back online for users. Although major work was left to recover totally from the Ryuk damage, critical services were returned to operations rapidly:

During the following couple of weeks important milestones in the restoration process were achieved through close cooperation between Progent consultants and the customer:

• In-house web applications were restored without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was spun up and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory functions were 100 percent recovered.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• 90% of the user PCs were operational.

Conclusion
A probable enterprise-killing catastrophe was evaded due to hard-working professionals, a wide array of technical expertise, and tight collaboration. Although in hindsight the ransomware virus attack detailed here would have been identified and stopped with advanced cyber security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and properly executed incident response procedures for data backup and keeping systems up to date with security patches, the reality is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's roster of professionals has substantial experience in crypto-ransomware virus defense, removal, and file restoration.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Honolulu
For ransomware recovery services in the Honolulu area, phone Progent at 800-462-8800 or go to Contact Progent.