Ransomware Filtering and Removal Services Detroit
Ransomware Removal: A Case Study
Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a modern cyberplague that represents an enterprise-level threat for businesses of all sizes unprepared for an attack. Versions of ransomware like the Dharma, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for years and still cause destruction. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, as well as additional unnamed malware, not only encrypt on-line data files but also infect many available system backups. Data replicated to the cloud can also be ransomed. In a poorly architected system, it can make any restore operations impossible and effectively sets the network back to zero.
Restoring applications and information after a crypto-ransomware outage becomes a race against the clock as the targeted organization fights to stop lateral movement, eradicate the virus, and restore business-critical operations. Because ransomware needs time to spread across a network, assaults are often launched at night, when penetrations tend to take longer to discover. This compounds the difficulty of rapidly mobilizing and organizing a qualified mitigation team.
Progent offers a variety of solutions for securing Detroit businesses from ransomware attacks. These include team education to help identify and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to identify and extinguish day-zero modern malware assaults. Progent in addition provides the services of seasoned ransomware recovery engineers with the track record and commitment to rebuild a compromised network as soon as possible.
Progent's Crypto-Ransomware Restoration Services
After a ransomware penetration, sending the ransom demands in cryptocurrency does not ensure that cyber hackers will return the keys to decipher all your data. Kaspersky ascertained that 17% of ransomware victims never recovered their files after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to piece back together the essential parts of your Information Technology environment. Absent access to full system backups, this calls for a wide range of skill sets, top notch team management, and the willingness to work continuously until the recovery project is done.
For twenty years, Progent has provided expert IT services for companies across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have been awarded top industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of experience gives Progent the ability to knowledgably identify necessary systems and consolidate the remaining pieces of your Information Technology environment after a ransomware attack and rebuild them into a functioning system.
Progent's recovery group has top notch project management systems to coordinate the sophisticated restoration process. Progent understands the urgency of acting quickly and in unison with a customer's management and Information Technology resources to assign priority to tasks and to get critical applications back online as soon as possible.
Business Case Study: A Successful Ransomware Penetration Recovery
A customer escalated to Progent after their network system was taken over by the Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored cybercriminals, possibly adopting approaches leaked from the United States National Security Agency. Ryuk attacks specific companies with little ability to sustain disruption and is among the most profitable instances of ransomware malware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in the Chicago metro area with around 500 staff members. The Ryuk penetration had brought down all company operations and manufacturing capabilities. The majority of the client's backups had been on-line at the start of the intrusion and were encrypted. The client considered paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately made the decision to use Progent.
Progent worked with the client to quickly identify and assign priority to the mission critical areas that had to be recovered in order to resume company operations:
- Microsoft Active Directory
- Microsoft Exchange Server
- MRP System
In less than 2 days, Progent was able to rebuild Active Directory to its pre-virus state. Progent then completed setup and storage recovery of the most important servers. All Microsoft Exchange Server data and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to collect local OST data files (Outlook Offline Data Files) on user workstations and laptops to recover email data. A not too old off-line backup of the client's accounting/MRP software made them able to recover these required services back online for users. Although a large amount of work still had to be done to recover fully from the Ryuk event, critical systems were returned to operations rapidly:
Over the next few weeks key milestones in the restoration process were made in close collaboration between Progent consultants and the client:
- Self-hosted web applications were brought back up without losing any data.
- The MailStore Server containing more than four million historical messages was brought online and available for users.
- CRM/Customer Orders/Invoices/Accounts Payable/AR/Inventory Control modules were 100 percent recovered.
- A new Palo Alto 850 security appliance was installed.
- Most of the user desktops and notebooks were back into operation.
Conclusion
A possible business-ending disaster was avoided with dedicated experts, a broad spectrum of IT skills, and tight teamwork. Although in post mortem the ransomware attack described here should have been identified and prevented with up-to-date cyber security technology and recognized best practices, user and IT administrator training, and properly executed incident response procedures for information backup and proper patching controls, the reality remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's team of professionals has extensive experience in ransomware virus blocking, cleanup, and information systems disaster recovery.
Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware System Restoration Expertise in Detroit
For ransomware recovery expertise in the Detroit metro area, phone Progent at
Select Topic: