Ransomware Prevention and Remediation Consulting Lakeland

Ransomware : Your Crippling IT Nightmare
Ransomware has become an escalating cyber pandemic that poses an enterprise-level danger for organizations poorly prepared for an attack. Multiple generations of ransomware such as CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for a long time and continue to inflict harm. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as additional unnamed malware, not only encrypt online data files but also infect most accessible system restores and backups. Files synchronized to the cloud can also be encrypted. In a poorly architected system, it can make automatic recovery impossible and effectively knocks the entire system back to square one.

Getting back on-line programs and data following a crypto-ransomware outage becomes a race against time as the targeted business fights to stop lateral movement, clear the virus, and resume enterprise-critical activity. Since crypto-ransomware needs time to replicate across a network, attacks are frequently sprung during weekends and nights, when penetrations typically take more time to identify. This compounds the difficulty of quickly mobilizing and organizing a knowledgeable mitigation team.

Progent makes available a range of help services for securing Lakeland enterprises from ransomware events. Among these are team member education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to detect and quarantine zero-day malware assaults. Progent also can provide the services of expert ransomware recovery engineers with the track record and perseverance to reconstruct a breached system as urgently as possible.

Progent's Ransomware Restoration Support Services
After a ransomware event, even paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will return the keys to decipher any or all of your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their information after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to piece back together the vital components of your Information Technology environment. Absent access to full data backups, this calls for a wide range of skill sets, well-coordinated project management, and the willingness to work non-stop until the job is complete.

For decades, Progent has offered certified expert Information Technology services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained high-level industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience gives Progent the capability to knowledgably understand necessary systems and re-organize the surviving components of your network system after a ransomware attack and rebuild them into an operational network.

Progent's ransomware group deploys best of breed project management tools to orchestrate the complex restoration process. Progent appreciates the urgency of working rapidly and together with a customer's management and Information Technology resources to prioritize tasks and to put the most important systems back on-line as fast as humanly possible.

Client Story: A Successful Ransomware Penetration Restoration
A small business hired Progent after their company was taken over by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state sponsored criminal gangs, suspected of using strategies leaked from America's National Security Agency. Ryuk seeks specific organizations with limited ability to sustain disruption and is one of the most lucrative incarnations of ransomware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company located in Chicago and has around 500 employees. The Ryuk intrusion had brought down all company operations and manufacturing capabilities. Most of the client's system backups had been on-line at the time of the intrusion and were damaged. The client was actively seeking loans for paying the ransom demand (more than $200,000) and praying for good luck, but ultimately made the decision to use Progent.

Progent worked together with the customer to quickly get our arms around and prioritize the critical applications that needed to be restored in order to restart business operations:

• Windows Active Directory
• Email
• Accounting and Manufacturing Software

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then accomplished setup and storage recovery on needed servers. All Microsoft Exchange Server data and configuration information were intact, which greatly helped the restore of Exchange. Progent was also able to assemble non-encrypted OST files (Outlook Offline Folder Files) on various workstations to recover email messages. A not too old off-line backup of the businesses accounting software made it possible to restore these required services back online for users. Although major work needed to be completed to recover totally from the Ryuk virus, critical systems were restored quickly:

Over the following few weeks key milestones in the recovery project were achieved in tight cooperation between Progent engineers and the customer:

• In-house web sites were brought back up with no loss of information.
• The MailStore Exchange Server containing more than 4 million archived messages was restored to operations and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables/Inventory Control capabilities were 100 percent functional.
• A new Palo Alto 850 security appliance was brought online.
• Most of the desktops and laptops were operational.

Conclusion
A probable enterprise-killing catastrophe was averted by dedicated professionals, a broad array of IT skills, and close teamwork. Although in post mortem the crypto-ransomware penetration described here could have been stopped with up-to-date security technology solutions and ISO/IEC 27001 best practices, team education, and well thought out incident response procedures for data protection and keeping systems up to date with security patches, the fact remains that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's team of experts has substantial experience in ransomware virus blocking, remediation, and information systems restoration.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Lakeland
For ransomware system restoration services in the Lakeland metro area, call Progent at 800-462-8800 or go to Contact Progent.