Ransomware Protection and Removal Solutions Southlake

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a modern cyberplague that poses an existential threat for businesses of all sizes poorly prepared for an attack. Different versions of crypto-ransomware like the CryptoLocker, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been running rampant for many years and continue to inflict damage. More recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with daily as yet unnamed malware, not only encrypt on-line data files but also infect many configured system backups. Information synched to cloud environments can also be encrypted. In a poorly designed data protection solution, it can make automated restore operations impossible and basically knocks the network back to zero.

Retrieving programs and information following a crypto-ransomware event becomes a sprint against time as the targeted business struggles to stop lateral movement, remove the ransomware, and resume business-critical activity. Due to the fact that crypto-ransomware takes time to move laterally across a network, attacks are often launched on weekends, when successful attacks in many cases take more time to notice. This compounds the difficulty of promptly marshalling and organizing a knowledgeable mitigation team.

Progent provides an assortment of support services for protecting Southlake businesses from crypto-ransomware events. Among these are team member education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat defense to detect and quarantine day-zero modern malware attacks. Progent also provides the assistance of seasoned ransomware recovery engineers with the skills and commitment to reconstruct a breached network as quickly as possible.

Progent's Ransomware Recovery Services
Following a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that cyber hackers will respond with the needed codes to decrypt all your data. Kaspersky determined that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to re-install the mission-critical components of your IT environment. Absent access to complete system backups, this requires a wide complement of skills, top notch team management, and the ability to work non-stop until the task is completed.

For decades, Progent has provided expert Information Technology services for businesses across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded top industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial systems and ERP software solutions. This breadth of expertise provides Progent the skills to rapidly determine important systems and re-organize the remaining components of your network system following a crypto-ransomware event and rebuild them into an operational system.

Progent's recovery group deploys state-of-the-art project management applications to coordinate the sophisticated restoration process. Progent knows the importance of working rapidly and in unison with a client's management and Information Technology resources to assign priority to tasks and to put essential applications back online as fast as humanly possible.

Business Case Study: A Successful Ransomware Virus Recovery
A business escalated to Progent after their company was brought down by the Ryuk ransomware. Ryuk is believed to have been created by North Korean state cybercriminals, possibly adopting algorithms leaked from the U.S. NSA organization. Ryuk targets specific companies with little or no room for disruption and is one of the most lucrative incarnations of crypto-ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturer based in the Chicago metro area and has about 500 staff members. The Ryuk penetration had disabled all essential operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the start of the attack and were destroyed. The client was actively seeking loans for paying the ransom (in excess of $200,000) and hoping for good luck, but in the end called Progent.

Progent worked hand in hand the client to rapidly determine and assign priority to the key systems that had to be addressed in order to restart business functions:

• Active Directory (AD)
• Email
• MRP System

Within two days, Progent was able to restore Active Directory services to its pre-attack state. Progent then charged ahead with rebuilding and storage recovery on the most important servers. All Microsoft Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to find local OST data files (Outlook Email Offline Folder Files) on user desktop computers to recover mail messages. A not too old off-line backup of the client's accounting/ERP software made it possible to return these required programs back on-line. Although a large amount of work was left to recover totally from the Ryuk event, the most important systems were recovered quickly:

During the following few weeks critical milestones in the recovery process were accomplished through close collaboration between Progent team members and the customer:

• Internal web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server with over four million archived messages was brought on-line and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/AR/Inventory Control modules were 100 percent operational.
• A new Palo Alto Networks 850 firewall was installed.
• Ninety percent of the user PCs were operational.

Conclusion
A likely business extinction disaster was avoided by results-oriented professionals, a wide array of IT skills, and tight teamwork. Although in post mortem the crypto-ransomware virus incident detailed here could have been shut down with up-to-date cyber security technology solutions and security best practices, user education, and well designed security procedures for data protection and proper patching controls, the reality remains that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware attack, remember that Progent's roster of experts has extensive experience in ransomware virus blocking, remediation, and file recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Southlake
For ransomware system recovery consulting services in the Southlake metro area, phone Progent at 800-462-8800 or go to Contact Progent.