Ransomware Filtering and Removal Expertise Houston

Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware has become a modern cyber pandemic that represents an enterprise-level threat for businesses unprepared for an assault. Different versions of ransomware like the Reveton, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and continue to inflict destruction. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, plus frequent unnamed newcomers, not only perform encryption of on-line files but also infiltrate many accessible system backup. Data synched to off-premises disaster recovery sites can also be encrypted. In a poorly architected system, it can make automated recovery hopeless and basically knocks the network back to zero.

Getting back on-line programs and data after a ransomware event becomes a race against time as the targeted organization tries its best to contain, cleanup the crypto-ransomware, and resume enterprise-critical activity. Because ransomware takes time to replicate across a network, assaults are frequently launched on weekends, when penetrations tend to take longer to identify. This compounds the difficulty of promptly marshalling and organizing a qualified response team.

Progent has a variety of services for securing Houston businesses from ransomware events. These include user education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat defense to detect and disable day-zero modern malware assaults. Progent also can provide the assistance of expert ransomware recovery professionals with the track record and perseverance to re-deploy a breached environment as urgently as possible.

Progent's Ransomware Recovery Support Services
Soon after a crypto-ransomware invasion, paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will return the codes to decipher any of your files. Kaspersky determined that seventeen percent of ransomware victims never restored their information even after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to re-install the essential parts of your Information Technology environment. Absent the availability of complete system backups, this requires a wide range of skills, well-coordinated project management, and the willingness to work 24x7 until the recovery project is over.

For twenty years, Progent has provided expert IT services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained advanced certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with accounting and ERP applications. This breadth of expertise provides Progent the capability to rapidly understand important systems and consolidate the remaining components of your network environment after a ransomware penetration and assemble them into a functioning network.

Progent's security group deploys powerful project management systems to orchestrate the sophisticated restoration process. Progent appreciates the urgency of working rapidly and together with a customer's management and IT team members to prioritize tasks and to get key applications back online as fast as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Penetration Recovery
A business engaged Progent after their network system was brought down by Ryuk ransomware. Ryuk is thought to have been created by North Korean state criminal gangs, suspected of adopting algorithms leaked from the United States National Security Agency. Ryuk targets specific organizations with little ability to sustain disruption and is one of the most lucrative iterations of ransomware. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in Chicago with about 500 staff members. The Ryuk penetration had paralyzed all essential operations and manufacturing processes. The majority of the client's backups had been online at the beginning of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom demand (more than $200,000) and praying for the best, but ultimately reached out to Progent.

Progent worked with the customer to rapidly determine and assign priority to the essential systems that needed to be restored to make it possible to resume company functions:

• Microsoft Active Directory
• Electronic Mail
• Accounting/MRP

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-attack state. Progent then charged ahead with reinstallations and storage recovery on key servers. All Microsoft Exchange Server schema and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to assemble non-encrypted OST files (Microsoft Outlook Offline Data Files) on team PCs to recover email data. A recent offline backup of the client's accounting/MRP systems made them able to return these essential applications back online for users. Although a large amount of work remained to recover completely from the Ryuk damage, core services were restored quickly:

Throughout the following month critical milestones in the recovery project were accomplished through tight collaboration between Progent engineers and the customer:

• In-house web applications were returned to operation with no loss of information.
• The MailStore Server exceeding 4 million archived messages was brought online and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory modules were 100% recovered.
• A new Palo Alto Networks 850 firewall was installed and configured.
• 90% of the desktops and laptops were being used by staff.

Conclusion
A possible business extinction catastrophe was dodged by top-tier experts, a broad range of subject matter expertise, and tight teamwork. Although upon completion of forensics the ransomware virus incident detailed here should have been disabled with up-to-date security technology and recognized best practices, team education, and appropriate security procedures for information protection and keeping systems up to date with security patches, the fact is that government-sponsored hackers from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's roster of professionals has proven experience in ransomware virus defense, mitigation, and file disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Houston
For ransomware cleanup expertise in the Houston metro area, phone Progent at 800-462-8800 or see Contact Progent.