Ransomware Protection and Removal Consulting Carlsbad

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a modern cyberplague that poses an extinction-level threat for businesses unprepared for an attack. Versions of ransomware such as Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been running rampant for years and continue to inflict harm. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, along with daily as yet unnamed viruses, not only encrypt online data files but also infect most configured system backup. Files replicated to the cloud can also be ransomed. In a vulnerable environment, this can make automated restore operations hopeless and basically knocks the network back to zero.

Getting back online services and information following a ransomware outage becomes a race against time as the targeted business fights to stop the spread, cleanup the ransomware, and restore enterprise-critical operations. Because crypto-ransomware takes time to move laterally across a network, penetrations are frequently sprung during weekends and nights, when successful attacks in many cases take more time to detect. This multiplies the difficulty of rapidly marshalling and coordinating a knowledgeable response team.

Progent has an assortment of support services for protecting Carlsbad businesses from crypto-ransomware penetrations. These include team training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat defense to discover and disable day-zero modern malware attacks. Progent also can provide the services of expert ransomware recovery professionals with the skills and commitment to restore a compromised environment as rapidly as possible.

Progent's Ransomware Restoration Help
After a crypto-ransomware invasion, even paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will provide the needed codes to unencrypt all your information. Kaspersky Labs determined that 17% of ransomware victims never restored their data even after having paid the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The other path is to piece back together the mission-critical parts of your Information Technology environment. Absent the availability of full data backups, this requires a wide complement of IT skills, top notch team management, and the willingness to work continuously until the task is complete.

For decades, Progent has made available expert Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained high-level certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with accounting and ERP software solutions. This breadth of expertise affords Progent the skills to efficiently understand important systems and consolidate the remaining parts of your Information Technology environment after a ransomware event and rebuild them into a functioning system.

Progent's security group has top notch project management tools to orchestrate the sophisticated restoration process. Progent understands the urgency of acting swiftly and in unison with a client's management and IT resources to prioritize tasks and to get essential systems back on-line as soon as humanly possible.

Customer Story: A Successful Ransomware Attack Response
A client escalated to Progent after their company was penetrated by Ryuk ransomware virus. Ryuk is thought to have been launched by North Korean government sponsored criminal gangs, suspected of using techniques exposed from the United States National Security Agency. Ryuk goes after specific organizations with little or no room for disruption and is among the most profitable versions of ransomware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company based in the Chicago metro area and has about 500 employees. The Ryuk attack had paralyzed all essential operations and manufacturing capabilities. The majority of the client's information backups had been online at the time of the intrusion and were destroyed. The client was pursuing financing for paying the ransom demand (exceeding $200,000) and hoping for the best, but in the end reached out to Progent.

Progent worked with the client to quickly understand and assign priority to the key elements that needed to be addressed to make it possible to continue company functions:

• Microsoft Active Directory
• Email
• Accounting/MRP

In less than 2 days, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then helped perform rebuilding and storage recovery on mission critical servers. All Microsoft Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to collect intact OST files (Microsoft Outlook Offline Folder Files) on team desktop computers in order to recover mail data. A recent offline backup of the client's manufacturing systems made it possible to recover these essential services back servicing users. Although significant work remained to recover completely from the Ryuk attack, core systems were returned to operations rapidly:

Throughout the next month critical milestones in the restoration project were made through tight cooperation between Progent team members and the customer:

• Internal web applications were returned to operation with no loss of information.
• The MailStore Exchange Server containing more than 4 million archived messages was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control functions were completely restored.
• A new Palo Alto 850 firewall was brought online.
• Ninety percent of the desktops and laptops were operational.

Conclusion
A likely business-killing disaster was dodged through the efforts of dedicated professionals, a wide array of subject matter expertise, and close collaboration. Although in retrospect the crypto-ransomware virus attack described here could have been identified and blocked with current security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and appropriate incident response procedures for information backup and keeping systems up to date with security patches, the reality is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware incursion, feel confident that Progent's roster of professionals has substantial experience in ransomware virus blocking, removal, and information systems restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Carlsbad
For ransomware recovery expertise in the Carlsbad metro area, call Progent at 800-462-8800 or see Contact Progent.