Ransomware Prevention and Remediation Expertise Reston
Ransomware Cleanup: An Example
Ransomware : Your Crippling IT Disaster
Ransomware has become a modern cyberplague that poses an existential danger for businesses poorly prepared for an assault. Versions of crypto-ransomware such as CrySIS, WannaCry, Locky, SamSam and MongoLock cryptoworms have been out in the wild for many years and still inflict damage. Modern variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as daily unnamed viruses, not only encrypt online files but also infiltrate all configured system backups. Files synched to off-premises disaster recovery sites can also be rendered useless. In a vulnerable system, it can render automated restoration useless and basically sets the network back to square one.
Recovering services and data following a ransomware intrusion becomes a sprint against the clock as the targeted business tries its best to contain the damage, cleanup the virus, and resume mission-critical activity. Due to the fact that crypto-ransomware needs time to move laterally throughout a targeted network, penetrations are usually launched on weekends, when penetrations may take longer to uncover. This multiplies the difficulty of quickly assembling and coordinating a qualified mitigation team.
Progent makes available a range of solutions for securing Reston enterprises from crypto-ransomware attacks. Among these are user education to help identify and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to discover and disable zero-day modern malware assaults. Progent in addition offers the assistance of expert ransomware recovery professionals with the track record and perseverance to reconstruct a breached network as urgently as possible.
Progent's Crypto-Ransomware Recovery Support Services
Soon after a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will respond with the keys to decipher any or all of your files. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to setup from scratch the critical parts of your Information Technology environment. Absent access to essential system backups, this calls for a wide complement of skill sets, professional team management, and the capability to work non-stop until the task is completed.
For twenty years, Progent has made available professional IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have earned high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have garnered internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial management and ERP software solutions. This breadth of experience affords Progent the skills to efficiently determine critical systems and re-organize the surviving parts of your IT environment after a crypto-ransomware attack and rebuild them into an operational network.
Progent's recovery team has powerful project management applications to coordinate the complex restoration process. Progent knows the importance of working rapidly and together with a client's management and Information Technology staff to prioritize tasks and to put critical systems back on line as soon as humanly possible.
Customer Case Study: A Successful Ransomware Virus Restoration
A client escalated to Progent after their network was penetrated by the Ryuk ransomware virus. Ryuk is thought to have been created by North Korean state sponsored criminal gangs, possibly adopting strategies exposed from the U.S. NSA organization. Ryuk goes after specific businesses with limited ability to sustain operational disruption and is among the most profitable examples of ransomware viruses. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in Chicago and has around 500 employees. The Ryuk attack had paralyzed all essential operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the beginning of the intrusion and were destroyed. The client was taking steps for paying the ransom (more than $200K) and praying for good luck, but in the end made the decision to use Progent.
Progent worked with the customer to quickly assess and prioritize the essential applications that needed to be addressed to make it possible to continue company operations:
- Microsoft Active Directory
- Microsoft Exchange Email
- Financials/MRP
Within 2 days, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then completed rebuilding and storage recovery on needed servers. All Microsoft Exchange Server schema and attributes were usable, which accelerated the restore of Exchange. Progent was also able to collect local OST files (Microsoft Outlook Offline Folder Files) on various desktop computers and laptops in order to recover mail data. A not too old offline backup of the businesses financials/MRP software made them able to restore these required services back on-line. Although significant work needed to be completed to recover fully from the Ryuk damage, the most important services were restored quickly:
Throughout the next month important milestones in the restoration project were achieved through tight cooperation between Progent consultants and the customer:
- Self-hosted web sites were returned to operation with no loss of data.
- The MailStore Exchange Server containing more than four million historical emails was brought online and accessible to users.
- CRM/Customer Orders/Invoices/AP/AR/Inventory Control capabilities were fully recovered.
- A new Palo Alto Networks 850 security appliance was installed and configured.
- 90% of the user workstations were functioning as before the incident.
Conclusion
A probable business-killing disaster was evaded with dedicated experts, a broad array of knowledge, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware attack detailed here would have been shut down with advanced cyber security technology and security best practices, user and IT administrator training, and appropriate security procedures for data backup and proper patching controls, the fact remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus blocking, remediation, and data restoration.
Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Consulting in Reston
For ransomware system restoration consulting in the Reston metro area, call Progent at
Select Topic: