Ransomware Protection and Cleanup Expertise Parsippany

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that represents an enterprise-level danger for organizations poorly prepared for an attack. Different iterations of ransomware like the Dharma, WannaCry, Locky, Syskey and MongoLock cryptoworms have been running rampant for many years and still cause havoc. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, as well as daily unnamed newcomers, not only encrypt online data files but also infiltrate all configured system restores and backups. Files replicated to the cloud can also be corrupted. In a vulnerable environment, it can render automated restoration hopeless and effectively knocks the network back to square one.

Restoring programs and information after a crypto-ransomware attack becomes a race against the clock as the targeted business struggles to contain, eradicate the virus, and restore enterprise-critical operations. Because ransomware needs time to move laterally across a targeted network, assaults are usually sprung during nights and weekends, when penetrations may take more time to notice. This multiplies the difficulty of quickly marshalling and orchestrating a knowledgeable response team.

Progent has a range of help services for protecting Parsippany businesses from ransomware penetrations. Among these are staff education to help identify and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to identify and suppress day-zero malware assaults. Progent also provides the assistance of experienced ransomware recovery professionals with the skills and perseverance to reconstruct a compromised environment as soon as possible.

Progent's Ransomware Recovery Support Services
Soon after a crypto-ransomware invasion, paying the ransom in cryptocurrency does not guarantee that criminal gangs will return the needed codes to decrypt all your files. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their files even after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The fallback is to piece back together the essential components of your IT environment. Absent access to essential data backups, this calls for a broad complement of IT skills, top notch team management, and the ability to work continuously until the job is over.

For twenty years, Progent has made available expert Information Technology services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded high-level industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of experience provides Progent the ability to knowledgably ascertain important systems and integrate the surviving pieces of your IT system after a ransomware attack and configure them into a functioning network.

Progent's ransomware team of experts utilizes top notch project management tools to coordinate the sophisticated recovery process. Progent knows the urgency of acting swiftly and in concert with a customer's management and IT team members to assign priority to tasks and to put the most important applications back on line as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Attack Response
A business sought out Progent after their network was crashed by Ryuk ransomware. Ryuk is believed to have been created by North Korean government sponsored hackers, suspected of using techniques leaked from the United States National Security Agency. Ryuk seeks specific organizations with little or no room for disruption and is among the most profitable incarnations of ransomware malware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer based in the Chicago metro area and has about 500 employees. The Ryuk event had frozen all business operations and manufacturing processes. Most of the client's data backups had been on-line at the start of the intrusion and were encrypted. The client was taking steps for paying the ransom (more than $200,000) and hoping for the best, but ultimately made the decision to use Progent.

Progent worked with the customer to rapidly determine and assign priority to the essential systems that had to be restored to make it possible to resume business functions:

• Windows Active Directory
• Electronic Messaging
• MRP System

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-virus state. Progent then accomplished rebuilding and storage recovery of the most important applications. All Microsoft Exchange Server data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to locate intact OST data files (Microsoft Outlook Off-Line Data Files) on staff PCs and laptops in order to recover email data. A not too old offline backup of the client's accounting/ERP systems made it possible to return these essential services back on-line. Although major work was left to recover completely from the Ryuk event, essential services were recovered rapidly:

Over the following few weeks key milestones in the restoration project were achieved through tight cooperation between Progent consultants and the customer:

• Internal web applications were brought back up with no loss of data.
• The MailStore Exchange Server with over four million archived messages was brought on-line and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/AR/Inventory functions were 100% functional.
• A new Palo Alto 850 security appliance was brought online.
• Nearly all of the user workstations were operational.

Conclusion
A probable business extinction catastrophe was avoided with top-tier experts, a wide array of technical expertise, and tight teamwork. Although in post mortem the ransomware virus attack detailed here would have been shut down with current security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and well thought out security procedures for backup and keeping systems up to date with security patches, the reality is that government-sponsored hackers from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's team of experts has substantial experience in ransomware virus defense, remediation, and information systems recovery.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Parsippany
For ransomware recovery services in the Parsippany metro area, call Progent at 800-462-8800 or go to Contact Progent.