Ransomware Defense and Restoration Services Oakland

Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Different iterations of ransomware such as CrySIS, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for years and still inflict havoc. Newer variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus daily unnamed newcomers, not only perform encryption of on-line data files but also infect all accessible system backup. Files replicated to cloud environments can also be corrupted. In a poorly designed data protection solution, it can render any restore operations impossible and basically sets the entire system back to zero.

Getting back services and data following a ransomware outage becomes a sprint against time as the victim struggles to stop the spread, clear the ransomware, and restore enterprise-critical activity. Due to the fact that ransomware takes time to spread throughout a network, attacks are often launched during nights and weekends, when penetrations in many cases take more time to identify. This compounds the difficulty of rapidly marshalling and coordinating a qualified response team.

Progent offers an assortment of support services for securing Oakland businesses from ransomware events. Among these are user education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to discover and extinguish zero-day modern malware attacks. Progent also provides the assistance of expert crypto-ransomware recovery professionals with the skills and commitment to rebuild a compromised environment as quickly as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that cyber hackers will respond with the codes to unencrypt all your information. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their information even after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to setup from scratch the mission-critical parts of your Information Technology environment. Without access to essential information backups, this requires a wide complement of skill sets, professional project management, and the willingness to work continuously until the job is complete.

For decades, Progent has provided certified expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded high-level certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of experience gives Progent the capability to rapidly ascertain necessary systems and re-organize the surviving pieces of your IT environment following a crypto-ransomware penetration and rebuild them into an operational system.

Progent's recovery team of experts utilizes top notch project management tools to orchestrate the sophisticated recovery process. Progent appreciates the urgency of acting swiftly and in unison with a client's management and Information Technology team members to prioritize tasks and to put the most important applications back on line as fast as possible.

Customer Case Study: A Successful Crypto-Ransomware Intrusion Response
A business sought out Progent after their company was penetrated by Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean government sponsored hackers, possibly using techniques leaked from the U.S. National Security Agency. Ryuk seeks specific organizations with little ability to sustain disruption and is one of the most profitable examples of ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing company based in Chicago with about 500 workers. The Ryuk event had disabled all company operations and manufacturing processes. Most of the client's backups had been online at the time of the intrusion and were encrypted. The client was evaluating paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but ultimately utilized Progent.

Progent worked hand in hand the client to rapidly assess and prioritize the key systems that needed to be addressed in order to continue business operations:

• Active Directory (AD)
• Microsoft Exchange Email
• Financials/MRP

In less than two days, Progent was able to rebuild Active Directory to its pre-attack state. Progent then performed setup and hard drive recovery on mission critical systems. All Microsoft Exchange Server data and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to locate local OST files (Outlook Email Off-Line Data Files) on team PCs and laptops in order to recover mail information. A recent off-line backup of the customer's manufacturing software made them able to return these required applications back online for users. Although major work was left to recover completely from the Ryuk attack, core systems were returned to operations quickly:

During the next few weeks critical milestones in the restoration project were accomplished through tight collaboration between Progent engineers and the customer:

• Self-hosted web sites were returned to operation without losing any data.
• The MailStore Exchange Server with over four million archived messages was spun up and accessible to users.
• CRM/Customer Orders/Invoices/AP/AR/Inventory capabilities were 100 percent operational.
• A new Palo Alto 850 firewall was set up.
• Nearly all of the desktop computers were back into operation.

Conclusion
A potential business extinction disaster was evaded due to hard-working professionals, a wide array of knowledge, and tight collaboration. Although in post mortem the ransomware virus incident detailed here should have been blocked with advanced cyber security systems and security best practices, user and IT administrator education, and appropriate incident response procedures for data backup and applying software patches, the reality is that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware incursion, remember that Progent's team of experts has substantial experience in ransomware virus defense, remediation, and data restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Oakland
For ransomware system recovery expertise in the Oakland metro area, call Progent at 800-462-8800 or see Contact Progent.