Ransomware Filtering and Removal Services Reno

Ransomware : Your Feared IT Nightmare
Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for organizations vulnerable to an attack. Multiple generations of ransomware like the CrySIS, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for a long time and still inflict harm. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus additional as yet unnamed newcomers, not only perform encryption of on-line critical data but also infiltrate most accessible system backups. Information replicated to off-premises disaster recovery sites can also be ransomed. In a poorly architected system, it can render automatic restore operations hopeless and basically sets the entire system back to square one.

Restoring programs and information after a crypto-ransomware event becomes a race against time as the targeted organization struggles to stop lateral movement, eradicate the crypto-ransomware, and restore business-critical activity. Because ransomware requires time to spread across a targeted network, penetrations are frequently launched on weekends and holidays, when successful penetrations in many cases take more time to identify. This multiplies the difficulty of quickly marshalling and orchestrating an experienced response team.

Progent offers an assortment of help services for securing Reno enterprises from ransomware events. Among these are user education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to detect and extinguish zero-day malware attacks. Progent also can provide the assistance of veteran crypto-ransomware recovery professionals with the track record and commitment to restore a compromised environment as quickly as possible.

Progent's Ransomware Restoration Services
Soon after a ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that merciless criminals will provide the keys to decipher all your information. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their information even after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to piece back together the key elements of your IT environment. Without access to essential information backups, this calls for a wide range of IT skills, well-coordinated team management, and the ability to work non-stop until the recovery project is finished.

For two decades, Progent has provided professional Information Technology services for companies across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have attained top industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of expertise affords Progent the ability to knowledgably determine necessary systems and organize the surviving pieces of your IT environment after a ransomware attack and rebuild them into a functioning network.

Progent's security group deploys top notch project management applications to coordinate the complex recovery process. Progent understands the importance of working quickly and in concert with a client's management and Information Technology staff to prioritize tasks and to put critical applications back on line as soon as possible.

Case Study: A Successful Crypto-Ransomware Intrusion Response
A business engaged Progent after their network system was attacked by Ryuk crypto-ransomware. Ryuk is believed to have been developed by North Korean government sponsored criminal gangs, suspected of using techniques leaked from the United States National Security Agency. Ryuk targets specific businesses with limited ability to sustain operational disruption and is one of the most lucrative examples of ransomware viruses. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer based in Chicago and has around 500 staff members. The Ryuk penetration had disabled all essential operations and manufacturing capabilities. Most of the client's information backups had been on-line at the start of the attack and were destroyed. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and praying for good luck, but in the end utilized Progent.

Progent worked hand in hand the customer to rapidly understand and prioritize the essential elements that had to be addressed to make it possible to continue company operations:

• Active Directory (AD)
• E-Mail
• MRP System

In less than 2 days, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then completed reinstallations and storage recovery on mission critical servers. All Exchange Server data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to find non-encrypted OST files (Microsoft Outlook Offline Data Files) on user desktop computers and laptops in order to recover mail information. A not too old offline backup of the client's accounting/MRP software made them able to return these vital programs back on-line. Although a lot of work still had to be done to recover totally from the Ryuk event, critical services were returned to operations rapidly:

During the following few weeks critical milestones in the restoration process were achieved through close cooperation between Progent engineers and the customer:

• Internal web applications were returned to operation with no loss of data.
• The MailStore Server exceeding four million historical messages was spun up and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control modules were fully operational.
• A new Palo Alto 850 firewall was installed.
• 90% of the desktop computers were functioning as before the incident.

Conclusion
A potential business extinction catastrophe was dodged by top-tier professionals, a broad array of IT skills, and close collaboration. Although in hindsight the crypto-ransomware penetration described here should have been disabled with up-to-date cyber security solutions and NIST Cybersecurity Framework best practices, staff training, and appropriate incident response procedures for data backup and proper patching controls, the fact is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's team of professionals has substantial experience in ransomware virus blocking, removal, and information systems disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Reno
For ransomware recovery consulting in the Reno metro area, phone Progent at 800-462-8800 or go to Contact Progent.