Ransomware Protection and Removal Consulting Centennial

Ransomware : Your Worst Information Technology Catastrophe
Ransomware has become an escalating cyberplague that represents an extinction-level threat for organizations unprepared for an assault. Different iterations of crypto-ransomware such as CrySIS, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been around for years and continue to inflict destruction. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, plus daily unnamed viruses, not only encrypt online data but also infiltrate most accessible system protection mechanisms. Data synchronized to cloud environments can also be rendered useless. In a poorly designed data protection solution, it can render any restoration useless and effectively knocks the network back to square one.

Getting back on-line services and information following a ransomware event becomes a race against time as the victim fights to stop the spread, clear the ransomware, and resume enterprise-critical activity. Due to the fact that ransomware requires time to replicate throughout a targeted network, assaults are frequently launched at night, when successful penetrations typically take longer to recognize. This compounds the difficulty of quickly assembling and coordinating a capable response team.

Progent provides a range of services for securing Centennial businesses from ransomware penetrations. These include staff training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat protection to detect and suppress day-zero modern malware attacks. Progent also provides the assistance of experienced crypto-ransomware recovery professionals with the skills and commitment to re-deploy a compromised system as quickly as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a ransomware penetration, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will provide the codes to decrypt any of your files. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their data even after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The fallback is to piece back together the key parts of your Information Technology environment. Without the availability of complete information backups, this calls for a wide range of skill sets, top notch project management, and the capability to work continuously until the job is over.

For two decades, Progent has made available certified expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned high-level certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial management and ERP application software. This breadth of expertise gives Progent the skills to quickly identify necessary systems and integrate the remaining pieces of your Information Technology environment following a ransomware attack and assemble them into an operational network.

Progent's recovery group has best of breed project management systems to orchestrate the complex restoration process. Progent knows the urgency of working quickly and in unison with a client's management and Information Technology team members to prioritize tasks and to put the most important services back on-line as soon as possible.

Business Case Study: A Successful Ransomware Attack Response
A client sought out Progent after their organization was penetrated by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean government sponsored hackers, suspected of adopting algorithms exposed from America's National Security Agency. Ryuk seeks specific companies with little or no room for disruption and is among the most lucrative instances of ransomware malware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturer based in the Chicago metro area and has around 500 staff members. The Ryuk event had paralyzed all company operations and manufacturing capabilities. The majority of the client's data backups had been on-line at the beginning of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom (in excess of two hundred thousand dollars) and praying for the best, but in the end brought in Progent.

Progent worked with the client to rapidly understand and prioritize the key elements that had to be addressed to make it possible to restart departmental operations:

• Windows Active Directory
• Microsoft Exchange Email
• MRP System

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-intrusion state. Progent then accomplished reinstallations and hard drive recovery on essential applications. All Exchange Server schema and configuration information were intact, which facilitated the restore of Exchange. Progent was able to find intact OST data files (Outlook Offline Data Files) on user desktop computers and laptops in order to recover mail data. A recent off-line backup of the customer's accounting systems made them able to return these vital services back servicing users. Although a large amount of work still had to be done to recover completely from the Ryuk attack, critical services were restored quickly:

Throughout the next few weeks critical milestones in the restoration project were accomplished through close collaboration between Progent engineers and the customer:

• In-house web sites were brought back up without losing any information.
• The MailStore Microsoft Exchange Server exceeding 4 million historical emails was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory capabilities were 100 percent restored.
• A new Palo Alto 850 firewall was brought on-line.
• Most of the user desktops and notebooks were being used by staff.

Conclusion
A likely business-ending catastrophe was evaded with hard-working experts, a broad range of technical expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware attack described here could have been prevented with current cyber security technology and ISO/IEC 27001 best practices, team training, and properly executed incident response procedures for information protection and keeping systems up to date with security patches, the reality remains that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has proven experience in crypto-ransomware virus defense, remediation, and file recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Centennial
For ransomware cleanup consulting in the Centennial area, call Progent at 800-462-8800 or go to Contact Progent.