Ransomware Filtering and Cleanup Expertise Skokie

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that represents an existential threat for organizations poorly prepared for an assault. Different versions of crypto-ransomware such as CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been out in the wild for a long time and continue to cause havoc. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, plus more as yet unnamed viruses, not only perform encryption of online information but also infiltrate all available system restores and backups. Files synchronized to off-premises disaster recovery sites can also be ransomed. In a poorly architected system, this can make any restoration impossible and basically sets the entire system back to zero.

Recovering applications and data after a ransomware outage becomes a race against the clock as the victim fights to contain, cleanup the virus, and resume enterprise-critical activity. Due to the fact that ransomware takes time to replicate throughout a network, penetrations are usually launched on weekends and holidays, when successful penetrations tend to take more time to recognize. This compounds the difficulty of quickly marshalling and organizing a qualified mitigation team.

Progent offers a range of solutions for securing Skokie enterprises from ransomware attacks. These include user training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to discover and suppress zero-day malware assaults. Progent also can provide the assistance of seasoned crypto-ransomware recovery consultants with the talent and commitment to re-deploy a breached system as urgently as possible.

Progent's Ransomware Restoration Help
Subsequent to a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not guarantee that cyber criminals will return the needed keys to unencrypt any of your files. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The fallback is to piece back together the essential parts of your IT environment. Absent the availability of complete system backups, this requires a broad range of skills, professional project management, and the capability to work 24x7 until the task is complete.

For twenty years, Progent has provided professional IT services for businesses across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have been awarded high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned industry certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with financial systems and ERP applications. This breadth of experience provides Progent the capability to rapidly determine necessary systems and consolidate the surviving components of your network system after a crypto-ransomware penetration and assemble them into a functioning network.

Progent's security team of experts uses top notch project management systems to orchestrate the complex restoration process. Progent knows the importance of working rapidly and in concert with a client's management and Information Technology team members to assign priority to tasks and to get essential applications back on-line as soon as humanly possible.

Client Case Study: A Successful Ransomware Attack Response
A business sought out Progent after their network was taken over by the Ryuk crypto-ransomware. Ryuk is thought to have been launched by North Korean state sponsored hackers, possibly using approaches leaked from America's NSA organization. Ryuk seeks specific businesses with little or no room for operational disruption and is among the most lucrative iterations of ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in the Chicago metro area and has around 500 employees. The Ryuk penetration had brought down all essential operations and manufacturing capabilities. Most of the client's data protection had been online at the time of the intrusion and were encrypted. The client considered paying the ransom demand (more than $200,000) and wishfully thinking for the best, but ultimately made the decision to use Progent.

Progent worked together with the client to quickly identify and assign priority to the most important elements that needed to be addressed in order to resume departmental functions:

• Active Directory (AD)
• Exchange Server
• Financials/MRP

Within 48 hours, Progent was able to re-build Active Directory to its pre-attack state. Progent then helped perform setup and hard drive recovery on mission critical applications. All Exchange Server schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Offline Data Files) on various PCs and laptops in order to recover email messages. A recent off-line backup of the customer's financials/MRP software made it possible to recover these essential services back servicing users. Although major work remained to recover totally from the Ryuk damage, core services were returned to operations rapidly:

During the following couple of weeks important milestones in the restoration process were made in tight collaboration between Progent engineers and the client:

• Self-hosted web applications were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server exceeding 4 million archived messages was brought on-line and available for users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control functions were completely operational.
• A new Palo Alto 850 security appliance was brought on-line.
• 90% of the user workstations were functioning as before the incident.

Conclusion
A likely enterprise-killing catastrophe was averted due to results-oriented experts, a wide range of IT skills, and tight collaboration. Although in analyzing the event afterwards the ransomware virus incident described here could have been prevented with modern cyber security systems and best practices, team education, and appropriate security procedures for backup and applying software patches, the fact is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware virus, remember that Progent's team of experts has substantial experience in crypto-ransomware virus blocking, remediation, and information systems disaster recovery.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Skokie
For ransomware system recovery expertise in the Skokie area, phone Progent at 800-462-8800 or visit Contact Progent.