Ransomware Prevention and Remediation Consulting Fremont
Crypto-Ransomware Cleanup: An Example
Ransomware : Your Worst IT Catastrophe
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level danger for organizations unprepared for an attack. Multiple generations of ransomware such as Reveton, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for a long time and continue to inflict damage. Newer variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as frequent as yet unnamed newcomers, not only encrypt on-line data but also infiltrate many available system protection mechanisms. Data synched to cloud environments can also be encrypted. In a vulnerable system, it can make automated recovery hopeless and effectively sets the entire system back to square one.
Restoring services and information following a ransomware attack becomes a sprint against time as the targeted business struggles to stop lateral movement, cleanup the virus, and resume enterprise-critical activity. Since ransomware needs time to spread throughout a targeted network, assaults are often launched on weekends and holidays, when attacks in many cases take longer to notice. This multiplies the difficulty of quickly marshalling and organizing a capable mitigation team.
Progent makes available an assortment of solutions for protecting Fremont enterprises from crypto-ransomware attacks. These include user education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to discover and quarantine zero-day modern malware attacks. Progent also offers the services of seasoned ransomware recovery consultants with the talent and commitment to rebuild a breached system as quickly as possible.
Progent's Ransomware Recovery Help
Subsequent to a ransomware attack, paying the ransom in cryptocurrency does not guarantee that merciless criminals will provide the needed keys to decrypt any or all of your information. Kaspersky ascertained that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to re-install the mission-critical components of your Information Technology environment. Without the availability of full system backups, this requires a wide range of IT skills, professional project management, and the ability to work non-stop until the task is complete.
For two decades, Progent has provided certified expert Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have been awarded advanced industry certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in accounting and ERP applications. This breadth of experience gives Progent the ability to efficiently ascertain important systems and consolidate the remaining components of your network system after a ransomware attack and configure them into a functioning system.
Progent's security team uses state-of-the-art project management systems to coordinate the sophisticated restoration process. Progent understands the importance of working quickly and in concert with a customer's management and IT team members to prioritize tasks and to get key applications back online as fast as possible.
Client Case Study: A Successful Ransomware Intrusion Recovery
A customer sought out Progent after their network system was crashed by Ryuk crypto-ransomware. Ryuk is generally considered to have been launched by North Korean state hackers, possibly adopting techniques leaked from the United States National Security Agency. Ryuk attacks specific organizations with little or no room for disruption and is among the most profitable iterations of crypto-ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturer based in Chicago with around 500 workers. The Ryuk event had disabled all essential operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the start of the intrusion and were eventually encrypted. The client was evaluating paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but in the end made the decision to use Progent.
Progent worked hand in hand the customer to quickly identify and assign priority to the essential applications that needed to be restored in order to restart business operations:
- Microsoft Active Directory
- Exchange Server
- MRP System
In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then performed setup and storage recovery of essential applications. All Microsoft Exchange Server data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to locate local OST files (Outlook Off-Line Folder Files) on various PCs and laptops in order to recover mail information. A not too old offline backup of the customer's financials/ERP software made them able to return these vital applications back servicing users. Although significant work needed to be completed to recover fully from the Ryuk virus, essential services were restored rapidly:
Throughout the next couple of weeks key milestones in the recovery project were achieved through close cooperation between Progent team members and the client:
- Internal web applications were restored with no loss of data.
- The MailStore Microsoft Exchange Server with over 4 million archived emails was restored to operations and available for users.
- CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory Control functions were completely operational.
- A new Palo Alto Networks 850 security appliance was installed.
- Most of the user workstations were back into operation.
Conclusion
A potential enterprise-killing catastrophe was evaded with dedicated experts, a broad range of subject matter expertise, and tight teamwork. Although in post mortem the ransomware virus penetration detailed here should have been identified and disabled with up-to-date security systems and NIST Cybersecurity Framework best practices, user education, and properly executed incident response procedures for data protection and keeping systems up to date with security patches, the reality is that government-sponsored hackers from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's team of experts has extensive experience in ransomware virus defense, cleanup, and data disaster recovery.
Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Cleanup Expertise in Fremont
For ransomware recovery consulting in the Fremont metro area, call Progent at
Select Topic: