Ransomware Filtering and Cleanup Expertise London

Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that represents an extinction-level danger for businesses unprepared for an attack. Different versions of ransomware such as Dharma, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for years and continue to cause destruction. More recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, along with additional unnamed newcomers, not only perform encryption of on-line data but also infect many configured system backup. Files synched to cloud environments can also be corrupted. In a vulnerable system, this can render automatic recovery impossible and basically sets the entire system back to square one.

Getting back online programs and data following a ransomware event becomes a sprint against the clock as the targeted business fights to stop the spread, eradicate the crypto-ransomware, and resume mission-critical activity. Since ransomware requires time to replicate throughout a network, assaults are often sprung on weekends, when successful penetrations tend to take more time to discover. This compounds the difficulty of promptly assembling and coordinating a capable mitigation team.

Progent has an assortment of services for protecting London organizations from crypto-ransomware penetrations. These include team training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat protection to discover and disable zero-day modern malware attacks. Progent in addition provides the assistance of seasoned ransomware recovery consultants with the track record and perseverance to rebuild a breached network as soon as possible.

Progent's Ransomware Restoration Help
After a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not ensure that cyber hackers will return the keys to decrypt any or all of your files. Kaspersky Labs determined that 17% of crypto-ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to piece back together the mission-critical parts of your IT environment. Absent access to essential system backups, this requires a broad complement of skill sets, well-coordinated project management, and the ability to work 24x7 until the task is over.

For decades, Progent has made available certified expert Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned advanced certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience provides Progent the capability to knowledgably determine important systems and integrate the surviving components of your Information Technology system after a ransomware event and assemble them into an operational system.

Progent's security group has top notch project management systems to coordinate the complicated recovery process. Progent knows the importance of acting rapidly and in unison with a customer's management and IT resources to assign priority to tasks and to get the most important applications back on-line as fast as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Incident Response
A client engaged Progent after their organization was attacked by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean state sponsored cybercriminals, possibly adopting techniques exposed from America's NSA organization. Ryuk seeks specific companies with little ability to sustain disruption and is one of the most lucrative instances of ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company based in Chicago and has about 500 employees. The Ryuk event had paralyzed all business operations and manufacturing processes. Most of the client's data backups had been on-line at the beginning of the attack and were destroyed. The client was pursuing financing for paying the ransom (in excess of $200,000) and hoping for good luck, but in the end engaged Progent.

Progent worked with the customer to rapidly determine and prioritize the critical systems that had to be restored to make it possible to resume business functions:

• Microsoft Active Directory
• E-Mail
• Financials/MRP

Within 2 days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then helped perform rebuilding and hard drive recovery of the most important servers. All Exchange schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to assemble local OST data files (Microsoft Outlook Offline Data Files) on team PCs and laptops to recover mail information. A not too old off-line backup of the businesses financials/MRP systems made it possible to restore these vital programs back online for users. Although major work still had to be done to recover completely from the Ryuk attack, the most important systems were recovered quickly:

Over the following few weeks important milestones in the restoration process were achieved through close cooperation between Progent engineers and the customer:

• In-house web applications were brought back up with no loss of data.
• The MailStore Exchange Server exceeding four million historical emails was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory modules were fully restored.
• A new Palo Alto 850 security appliance was deployed.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A potential business-killing catastrophe was averted by dedicated experts, a wide spectrum of subject matter expertise, and close teamwork. Although in hindsight the ransomware attack detailed here should have been prevented with advanced cyber security technology and recognized best practices, staff training, and well designed security procedures for data backup and keeping systems up to date with security patches, the fact is that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware attack, remember that Progent's team of experts has substantial experience in ransomware virus defense, mitigation, and data restoration.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in London
For ransomware cleanup services in the London area, call Progent at 800-462-8800 or go to Contact Progent.