Ransomware Defense and Cleanup Expertise Alpharetta

Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become a too-frequent cyberplague that poses an extinction-level threat for businesses of all sizes poorly prepared for an assault. Versions of crypto-ransomware such as CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been around for a long time and still inflict damage. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, plus frequent unnamed viruses, not only encrypt online data but also infiltrate many configured system backups. Files synched to cloud environments can also be encrypted. In a poorly designed data protection solution, this can render automatic restore operations useless and effectively knocks the entire system back to square one.

Retrieving applications and data following a ransomware intrusion becomes a sprint against time as the targeted business tries its best to stop the spread, eradicate the crypto-ransomware, and restore enterprise-critical activity. Due to the fact that ransomware needs time to spread throughout a targeted network, assaults are usually sprung during nights and weekends, when successful attacks in many cases take more time to recognize. This compounds the difficulty of quickly marshalling and organizing a capable mitigation team.

Progent offers a variety of help services for protecting Alpharetta enterprises from crypto-ransomware penetrations. These include team education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to detect and disable zero-day modern malware attacks. Progent also offers the services of veteran crypto-ransomware recovery professionals with the talent and perseverance to reconstruct a breached environment as quickly as possible.

Progent's Crypto-Ransomware Restoration Help
Following a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will return the needed keys to unencrypt all your data. Kaspersky Labs estimated that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to piece back together the vital parts of your IT environment. Absent the availability of complete information backups, this requires a broad range of skills, top notch team management, and the capability to work non-stop until the task is completed.

For twenty years, Progent has offered certified expert Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded advanced industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in financial systems and ERP applications. This breadth of experience affords Progent the skills to quickly identify important systems and integrate the surviving components of your computer network system following a ransomware event and configure them into an operational network.

Progent's recovery team has top notch project management systems to coordinate the complicated restoration process. Progent appreciates the importance of working quickly and in concert with a client's management and IT team members to assign priority to tasks and to get key systems back online as soon as humanly possible.

Customer Story: A Successful Crypto-Ransomware Virus Recovery
A customer contacted Progent after their network system was brought down by Ryuk ransomware. Ryuk is thought to have been developed by North Korean state sponsored hackers, possibly using technology exposed from America's NSA organization. Ryuk goes after specific organizations with little or no tolerance for operational disruption and is one of the most profitable instances of ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in Chicago with around 500 staff members. The Ryuk intrusion had shut down all company operations and manufacturing capabilities. The majority of the client's system backups had been online at the start of the attack and were eventually encrypted. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but in the end reached out to Progent.

Progent worked with the customer to quickly get our arms around and prioritize the key services that had to be addressed to make it possible to continue company functions:

• Microsoft Active Directory
• Email
• Financials/MRP

In less than two days, Progent was able to restore Active Directory to its pre-virus state. Progent then helped perform rebuilding and hard drive recovery of the most important systems. All Exchange Server schema and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to assemble intact OST files (Outlook Offline Folder Files) on user workstations to recover email data. A not too old off-line backup of the businesses financials/ERP software made them able to restore these vital services back servicing users. Although a lot of work remained to recover totally from the Ryuk event, the most important systems were returned to operations quickly:

During the following few weeks critical milestones in the recovery process were accomplished in tight cooperation between Progent team members and the client:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million archived emails was brought on-line and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/AR/Inventory functions were fully restored.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Ninety percent of the desktops and laptops were operational.

Conclusion
A likely company-ending disaster was dodged by dedicated professionals, a broad spectrum of subject matter expertise, and close teamwork. Although upon completion of forensics the crypto-ransomware virus attack described here would have been prevented with modern security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and properly executed security procedures for information protection and keeping systems up to date with security patches, the fact remains that government-sponsored hackers from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware incident, feel confident that Progent's team of experts has substantial experience in ransomware virus blocking, mitigation, and data recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Alpharetta
For ransomware recovery consulting in the Alpharetta metro area, call Progent at 800-462-8800 or go to Contact Progent.