Ransomware Filtering and Restoration Consulting Wilmington
Ransomware Removal: A Case Study
Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware has become an escalating cyberplague that poses an enterprise-level threat for businesses of all sizes vulnerable to an assault. Multiple generations of crypto-ransomware like the CryptoLocker, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for a long time and still cause havoc. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with daily as yet unnamed newcomers, not only encrypt on-line data files but also infect most available system restores and backups. Information replicated to cloud environments can also be ransomed. In a poorly architected data protection solution, this can make any restore operations useless and effectively sets the network back to zero.
Getting back online programs and data after a crypto-ransomware attack becomes a sprint against the clock as the victim tries its best to contain, cleanup the ransomware, and restore mission-critical activity. Because ransomware takes time to replicate across a targeted network, attacks are usually launched on weekends, when penetrations are likely to take more time to uncover. This multiplies the difficulty of quickly mobilizing and orchestrating a capable mitigation team.
Progent makes available a variety of support services for securing Wilmington enterprises from ransomware penetrations. Among these are staff education to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat defense to identify and quarantine day-zero malware assaults. Progent in addition can provide the services of expert ransomware recovery engineers with the skills and perseverance to restore a breached system as rapidly as possible.
Progent's Ransomware Recovery Help
Subsequent to a ransomware invasion, even paying the ransom demands in cryptocurrency does not ensure that cyber hackers will respond with the needed codes to unencrypt any or all of your data. Kaspersky determined that seventeen percent of ransomware victims never restored their files after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to setup from scratch the key parts of your IT environment. Without the availability of complete data backups, this calls for a wide complement of skill sets, top notch team management, and the capability to work continuously until the recovery project is over.
For decades, Progent has offered certified expert IT services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded advanced certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of experience gives Progent the capability to knowledgably ascertain important systems and organize the remaining components of your Information Technology system following a ransomware attack and assemble them into an operational network.
Progent's security group deploys best of breed project management applications to orchestrate the complex recovery process. Progent appreciates the importance of working quickly and together with a client's management and Information Technology resources to prioritize tasks and to get the most important applications back on line as soon as possible.
Customer Case Study: A Successful Ransomware Penetration Restoration
A small business hired Progent after their network system was crashed by the Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored criminal gangs, suspected of adopting approaches exposed from America's National Security Agency. Ryuk attacks specific organizations with little or no tolerance for disruption and is among the most lucrative examples of ransomware viruses. Headline targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in the Chicago metro area and has about 500 workers. The Ryuk event had brought down all company operations and manufacturing processes. Most of the client's system backups had been directly accessible at the beginning of the intrusion and were encrypted. The client considered paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but in the end brought in Progent.
Progent worked together with the customer to quickly identify and prioritize the essential services that had to be restored in order to resume business functions:
- Active Directory (AD)
- Electronic Messaging
- Accounting and Manufacturing Software
In less than 2 days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then assisted with setup and hard drive recovery of needed systems. All Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to locate local OST files (Outlook Email Off-Line Folder Files) on various desktop computers and laptops in order to recover email information. A recent offline backup of the businesses financials/ERP software made it possible to restore these vital services back available to users. Although significant work still had to be done to recover completely from the Ryuk event, critical systems were returned to operations rapidly:
Throughout the following month key milestones in the restoration project were achieved in tight collaboration between Progent consultants and the client:
- In-house web sites were restored with no loss of data.
- The MailStore Microsoft Exchange Server with over 4 million historical emails was restored to operations and accessible to users.
- CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control functions were 100% functional.
- A new Palo Alto Networks 850 firewall was installed.
- Most of the user desktops were being used by staff.
Conclusion
A possible business-killing catastrophe was averted through the efforts of results-oriented professionals, a broad spectrum of subject matter expertise, and close teamwork. Although in hindsight the crypto-ransomware virus attack described here should have been blocked with up-to-date cyber security systems and NIST Cybersecurity Framework best practices, staff training, and well thought out incident response procedures for information protection and applying software patches, the reality remains that government-sponsored hackers from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware virus, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, mitigation, and data restoration.
Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Services in Wilmington
For ransomware system recovery consulting in the Wilmington area, call Progent at
Select Topic: