Ransomware Filtering and Remediation Solutions Bakersfield

Crypto-Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that poses an enterprise-level danger for organizations unprepared for an assault. Different versions of crypto-ransomware such as Dharma, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for years and still cause destruction. More recent strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, as well as more unnamed malware, not only perform encryption of on-line files but also infect most accessible system protection. Data synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly architected data protection solution, this can make automated restoration hopeless and basically knocks the datacenter back to square one.

Getting back online programs and data following a ransomware event becomes a race against the clock as the targeted business struggles to contain, cleanup the ransomware, and resume business-critical operations. Since ransomware needs time to spread across a targeted network, penetrations are often sprung on weekends, when penetrations in many cases take more time to discover. This multiplies the difficulty of quickly mobilizing and organizing an experienced response team.

Progent offers a range of solutions for protecting Bakersfield businesses from ransomware penetrations. These include staff education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to discover and quarantine day-zero malware attacks. Progent also can provide the assistance of experienced crypto-ransomware recovery consultants with the talent and perseverance to reconstruct a breached network as urgently as possible.

Progent's Ransomware Recovery Services
Following a ransomware penetration, sending the ransom demands in cryptocurrency does not ensure that cyber hackers will provide the keys to unencrypt any of your data. Kaspersky determined that 17% of ransomware victims never recovered their files even after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to setup from scratch the vital components of your Information Technology environment. Without the availability of complete information backups, this calls for a broad range of skills, top notch team management, and the ability to work 24x7 until the task is done.

For decades, Progent has provided professional Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned top industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized industry certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of expertise affords Progent the ability to knowledgably determine critical systems and re-organize the surviving parts of your Information Technology environment after a ransomware attack and configure them into a functioning network.

Progent's recovery team deploys top notch project management systems to coordinate the complex recovery process. Progent knows the importance of working rapidly and together with a customer's management and IT team members to prioritize tasks and to put the most important systems back on line as fast as possible.

Business Case Study: A Successful Crypto-Ransomware Incident Response
A small business contacted Progent after their company was brought down by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state hackers, possibly using approaches exposed from America's National Security Agency. Ryuk goes after specific organizations with limited room for operational disruption and is one of the most lucrative instances of crypto-ransomware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing business based in Chicago and has about 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing capabilities. The majority of the client's data backups had been online at the time of the intrusion and were destroyed. The client was pursuing financing for paying the ransom demand (exceeding $200K) and praying for good luck, but ultimately reached out to Progent.

Progent worked with the client to rapidly get our arms around and assign priority to the critical areas that needed to be restored in order to restart business operations:

• Active Directory
• E-Mail
• Accounting/MRP

In less than 2 days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then accomplished reinstallations and storage recovery on the most important servers. All Exchange Server schema and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to collect local OST data files (Outlook Email Offline Folder Files) on staff desktop computers to recover email data. A not too old off-line backup of the customer's manufacturing systems made them able to return these required services back on-line. Although significant work needed to be completed to recover totally from the Ryuk virus, the most important services were recovered rapidly:

Over the following month important milestones in the restoration process were accomplished in close collaboration between Progent team members and the customer:

• Self-hosted web applications were brought back up without losing any information.
• The MailStore Server exceeding 4 million historical emails was brought online and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/AR/Inventory capabilities were fully operational.
• A new Palo Alto 850 firewall was brought on-line.
• Ninety percent of the desktops and laptops were back into operation.

Conclusion
A possible business disaster was averted through the efforts of results-oriented professionals, a broad array of IT skills, and close teamwork. Although upon completion of forensics the ransomware virus penetration detailed here could have been prevented with modern cyber security solutions and recognized best practices, user and IT administrator education, and appropriate incident response procedures for information backup and keeping systems up to date with security patches, the fact remains that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, mitigation, and information systems disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Bakersfield
For ransomware system recovery consulting services in the Bakersfield metro area, call Progent at 800-462-8800 or see Contact Progent.