Ransomware Protection and Recovery Solutions Long Beach

Ransomware : Your Worst IT Disaster
Ransomware has become a modern cyber pandemic that poses an extinction-level threat for organizations vulnerable to an attack. Different iterations of ransomware like the CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for years and continue to inflict havoc. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as additional unnamed viruses, not only perform encryption of on-line data files but also infiltrate many accessible system protection mechanisms. Data replicated to off-premises disaster recovery sites can also be corrupted. In a poorly architected data protection solution, it can render automated restoration useless and effectively sets the network back to zero.

Getting back on-line applications and information following a ransomware outage becomes a sprint against the clock as the victim fights to contain the damage, remove the ransomware, and restore enterprise-critical operations. Since ransomware needs time to replicate throughout a targeted network, assaults are often launched on weekends and holidays, when penetrations typically take longer to notice. This multiplies the difficulty of quickly marshalling and organizing a qualified response team.

Progent has an assortment of help services for securing Long Beach enterprises from ransomware attacks. Among these are team member education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to identify and disable zero-day modern malware assaults. Progent also can provide the services of seasoned crypto-ransomware recovery professionals with the track record and perseverance to reconstruct a compromised environment as urgently as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the needed codes to decrypt any of your data. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never recovered their data after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The alternative is to re-install the essential components of your IT environment. Absent the availability of complete information backups, this requires a wide range of skills, well-coordinated project management, and the capability to work 24x7 until the job is completed.

For two decades, Progent has offered professional Information Technology services for companies across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained top certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-recognized certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of experience provides Progent the ability to efficiently understand critical systems and re-organize the remaining components of your IT system following a ransomware event and assemble them into an operational network.

Progent's recovery team deploys powerful project management tools to coordinate the complex recovery process. Progent appreciates the urgency of acting rapidly and together with a customer's management and Information Technology team members to prioritize tasks and to get essential systems back on line as fast as humanly possible.

Client Case Study: A Successful Ransomware Virus Restoration
A customer sought out Progent after their network was crashed by the Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state sponsored cybercriminals, possibly using strategies exposed from the U.S. National Security Agency. Ryuk seeks specific organizations with limited ability to sustain operational disruption and is among the most lucrative incarnations of ransomware viruses. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company based in the Chicago metro area with around 500 workers. The Ryuk penetration had paralyzed all essential operations and manufacturing processes. Most of the client's backups had been online at the beginning of the intrusion and were destroyed. The client was pursuing financing for paying the ransom demand (exceeding $200,000) and praying for the best, but in the end utilized Progent.

Progent worked with the client to rapidly determine and assign priority to the critical areas that had to be restored to make it possible to restart company functions:

• Microsoft Active Directory
• Email
• Financials/MRP

Within two days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then helped perform rebuilding and storage recovery of mission critical servers. All Exchange Server ties and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to locate local OST data files (Outlook Off-Line Data Files) on various desktop computers and laptops to recover mail messages. A recent off-line backup of the client's accounting/MRP systems made it possible to restore these essential programs back online for users. Although major work remained to recover totally from the Ryuk damage, critical services were returned to operations quickly:

Over the next month important milestones in the restoration process were achieved through tight cooperation between Progent engineers and the customer:

• Internal web sites were brought back up without losing any data.
• The MailStore Microsoft Exchange Server with over four million historical messages was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control functions were 100% restored.
• A new Palo Alto Networks 850 firewall was deployed.
• Nearly all of the user desktops and notebooks were being used by staff.

Conclusion
A possible enterprise-killing catastrophe was evaded due to hard-working professionals, a broad array of IT skills, and close collaboration. Although upon completion of forensics the crypto-ransomware virus penetration described here should have been shut down with modern cyber security solutions and security best practices, user and IT administrator education, and well thought out security procedures for data backup and keeping systems up to date with security patches, the fact remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware attack, remember that Progent's team of experts has proven experience in ransomware virus blocking, mitigation, and file restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Long Beach
For ransomware cleanup consulting services in the Long Beach metro area, phone Progent at 800-462-8800 or visit Contact Progent.