Ransomware Prevention and Removal Solutions Sacramento

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become a modern cyber pandemic that presents an extinction-level threat for businesses poorly prepared for an attack. Different versions of ransomware such as CrySIS, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been replicating for a long time and still cause havoc. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, as well as daily unnamed newcomers, not only perform encryption of online files but also infect all available system restores and backups. Information replicated to cloud environments can also be corrupted. In a poorly designed system, it can render automatic restoration hopeless and effectively knocks the network back to square one.

Getting back applications and information following a crypto-ransomware outage becomes a race against time as the targeted organization struggles to stop the spread, clear the crypto-ransomware, and resume business-critical operations. Since crypto-ransomware takes time to replicate throughout a targeted network, penetrations are often sprung on weekends and holidays, when successful attacks in many cases take longer to recognize. This compounds the difficulty of quickly assembling and orchestrating a capable mitigation team.

Progent has a variety of help services for protecting Sacramento organizations from ransomware attacks. These include team member training to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to detect and disable day-zero modern malware assaults. Progent in addition offers the assistance of veteran ransomware recovery engineers with the talent and commitment to reconstruct a breached environment as quickly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a crypto-ransomware invasion, paying the ransom in cryptocurrency does not ensure that cyber criminals will return the needed keys to decipher any of your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The fallback is to re-install the essential parts of your IT environment. Without the availability of full system backups, this requires a broad complement of IT skills, top notch project management, and the willingness to work continuously until the task is over.

For twenty years, Progent has made available professional IT services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned high-level certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial management and ERP software solutions. This breadth of expertise provides Progent the skills to quickly ascertain necessary systems and re-organize the remaining components of your computer network system after a ransomware event and rebuild them into a functioning system.

Progent's recovery team utilizes powerful project management tools to coordinate the complicated restoration process. Progent understands the urgency of acting quickly and in concert with a client's management and Information Technology resources to prioritize tasks and to get key applications back on line as fast as humanly possible.

Client Story: A Successful Crypto-Ransomware Attack Recovery
A customer engaged Progent after their company was taken over by Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state hackers, possibly adopting approaches leaked from the U.S. National Security Agency. Ryuk attacks specific companies with little or no tolerance for disruption and is among the most profitable examples of ransomware viruses. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer located in Chicago and has around 500 employees. The Ryuk event had shut down all company operations and manufacturing capabilities. Most of the client's backups had been on-line at the beginning of the intrusion and were destroyed. The client considered paying the ransom demand (exceeding two hundred thousand dollars) and hoping for the best, but in the end utilized Progent.

Progent worked with the client to quickly determine and assign priority to the essential elements that had to be restored to make it possible to restart company operations:

• Active Directory (AD)
• Email
• Accounting and Manufacturing Software

Within two days, Progent was able to restore Active Directory to its pre-penetration state. Progent then accomplished rebuilding and hard drive recovery on critical servers. All Exchange ties and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to assemble local OST files (Outlook Off-Line Folder Files) on staff PCs to recover email information. A recent off-line backup of the client's accounting systems made them able to restore these required applications back online for users. Although significant work still had to be done to recover totally from the Ryuk virus, core services were restored rapidly:

During the next month important milestones in the recovery process were accomplished through tight collaboration between Progent consultants and the customer:

• Self-hosted web applications were brought back up with no loss of data.
• The MailStore Server with over 4 million archived messages was brought on-line and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory modules were fully functional.
• A new Palo Alto Networks 850 security appliance was deployed.
• Nearly all of the user desktops were back into operation.

Conclusion
A possible business-ending disaster was avoided by results-oriented professionals, a wide array of knowledge, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware virus attack described here should have been identified and blocked with modern cyber security technology solutions and recognized best practices, team training, and appropriate security procedures for information backup and applying software patches, the reality remains that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware virus, feel confident that Progent's roster of professionals has proven experience in ransomware virus defense, removal, and file recovery.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Sacramento
For ransomware cleanup services in the Sacramento metro area, phone Progent at 800-462-8800 or visit Contact Progent.