Ransomware Protection and Removal Consulting Baton Rouge
Crypto-Ransomware Cleanup: An Example
Ransomware : Your Worst IT Catastrophe
Ransomware has become an escalating cyberplague that poses an existential threat for businesses poorly prepared for an attack. Different iterations of ransomware such as CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for a long time and still inflict destruction. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as frequent as yet unnamed newcomers, not only perform encryption of on-line data files but also infiltrate all configured system protection. Files synched to off-premises disaster recovery sites can also be encrypted. In a vulnerable data protection solution, it can render automatic restore operations useless and basically knocks the entire system back to zero.
Getting back online services and information following a ransomware attack becomes a sprint against the clock as the targeted business fights to stop lateral movement, remove the ransomware, and restore enterprise-critical activity. Because ransomware takes time to replicate throughout a targeted network, assaults are often launched during nights and weekends, when penetrations tend to take more time to uncover. This compounds the difficulty of rapidly marshalling and coordinating a capable mitigation team.
Progent provides an assortment of services for securing Baton Rouge enterprises from ransomware attacks. Among these are user education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to identify and disable zero-day malware attacks. Progent in addition offers the assistance of veteran ransomware recovery professionals with the track record and perseverance to re-deploy a breached environment as soon as possible.
Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that merciless criminals will provide the needed codes to decrypt all your files. Kaspersky determined that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The fallback is to piece back together the critical elements of your Information Technology environment. Without access to full data backups, this calls for a broad range of skills, top notch project management, and the ability to work 24x7 until the task is complete.
For two decades, Progent has offered expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial management and ERP application software. This breadth of expertise provides Progent the skills to rapidly determine important systems and organize the surviving pieces of your IT system after a crypto-ransomware event and rebuild them into an operational network.
Progent's security team uses state-of-the-art project management applications to orchestrate the sophisticated recovery process. Progent understands the urgency of working rapidly and in concert with a customer's management and Information Technology team members to assign priority to tasks and to put critical applications back on line as fast as possible.
Business Case Study: A Successful Ransomware Virus Restoration
A small business engaged Progent after their network was attacked by Ryuk ransomware. Ryuk is thought to have been created by North Korean state hackers, suspected of using algorithms leaked from the United States National Security Agency. Ryuk attacks specific businesses with limited tolerance for operational disruption and is among the most profitable instances of ransomware viruses. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business located in the Chicago metro area with about 500 employees. The Ryuk penetration had frozen all company operations and manufacturing capabilities. The majority of the client's data backups had been directly accessible at the beginning of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (in excess of $200K) and praying for good luck, but in the end reached out to Progent.
Progent worked with the customer to quickly get our arms around and prioritize the essential systems that had to be addressed to make it possible to resume departmental functions:
- Active Directory (AD)
- Electronic Messaging
- MRP System
Within two days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then completed rebuilding and storage recovery on key applications. All Microsoft Exchange Server schema and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to locate non-encrypted OST data files (Outlook Email Offline Data Files) on team workstations in order to recover email information. A not too old offline backup of the businesses manufacturing systems made them able to restore these essential programs back servicing users. Although a lot of work remained to recover completely from the Ryuk event, essential systems were restored rapidly:
During the next month important milestones in the restoration process were achieved in close collaboration between Progent team members and the customer:
- Internal web applications were restored with no loss of data.
- The MailStore Exchange Server with over four million historical emails was spun up and available for users.
- CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory capabilities were completely operational.
- A new Palo Alto Networks 850 firewall was installed.
- Ninety percent of the user desktops and notebooks were being used by staff.
Conclusion
A potential business-ending catastrophe was dodged through the efforts of results-oriented experts, a broad range of IT skills, and tight teamwork. Although in analyzing the event afterwards the crypto-ransomware virus penetration described here would have been identified and disabled with advanced cyber security technology and best practices, team training, and well thought out security procedures for backup and keeping systems up to date with security patches, the fact is that state-sponsored hackers from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus blocking, remediation, and information systems restoration.
Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Cleanup Services in Baton Rouge
For ransomware system recovery services in the Baton Rouge area, call Progent at
Select Topic: