Ransomware Defense and Remediation Services Ipanema

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become a too-frequent cyberplague that poses an existential threat for organizations unprepared for an attack. Versions of crypto-ransomware such as Dharma, Fusob, Locky, NotPetya and MongoLock cryptoworms have been around for many years and continue to cause destruction. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, along with daily as yet unnamed malware, not only perform encryption of online data but also infect any available system protection mechanisms. Data synched to the cloud can also be encrypted. In a poorly designed data protection solution, this can make any recovery useless and basically knocks the entire system back to square one.

Recovering programs and data following a ransomware attack becomes a race against the clock as the targeted organization struggles to contain the damage, cleanup the ransomware, and resume business-critical operations. Because ransomware requires time to move laterally throughout a targeted network, attacks are often sprung at night, when successful penetrations tend to take more time to notice. This compounds the difficulty of rapidly marshalling and orchestrating an experienced response team.

Progent offers an assortment of services for securing Ipanema enterprises from ransomware attacks. Among these are user education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based threat protection to detect and disable zero-day malware assaults. Progent in addition can provide the assistance of experienced crypto-ransomware recovery engineers with the skills and commitment to rebuild a compromised network as quickly as possible.

Progent's Ransomware Restoration Support Services
Following a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will provide the needed codes to unencrypt any or all of your information. Kaspersky Labs determined that 17% of crypto-ransomware victims never restored their files after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to re-install the essential elements of your Information Technology environment. Without access to full system backups, this calls for a broad complement of skills, top notch project management, and the ability to work 24x7 until the task is finished.

For decades, Progent has offered professional IT services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained advanced industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of experience provides Progent the skills to quickly determine necessary systems and integrate the remaining parts of your computer network environment following a ransomware attack and rebuild them into an operational network.

Progent's recovery group uses top notch project management applications to orchestrate the complex restoration process. Progent knows the importance of working quickly and together with a client's management and Information Technology team members to prioritize tasks and to get essential applications back online as fast as humanly possible.

Customer Case Study: A Successful Ransomware Virus Response
A business sought out Progent after their company was brought down by Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored criminal gangs, possibly adopting strategies exposed from the U.S. National Security Agency. Ryuk seeks specific companies with little ability to sustain disruption and is one of the most lucrative instances of ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in the Chicago metro area and has around 500 workers. The Ryuk penetration had frozen all essential operations and manufacturing processes. Most of the client's data backups had been online at the beginning of the intrusion and were damaged. The client considered paying the ransom demand (more than $200,000) and wishfully thinking for the best, but ultimately made the decision to use Progent.

Progent worked with the customer to quickly get our arms around and assign priority to the essential services that had to be restored in order to restart company operations:

• Microsoft Active Directory
• Microsoft Exchange Email
• Accounting and Manufacturing Software

In less than two days, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then initiated reinstallations and hard drive recovery of the most important systems. All Exchange Server data and attributes were usable, which greatly helped the restore of Exchange. Progent was also able to assemble local OST files (Outlook Off-Line Data Files) on various workstations to recover email messages. A recent off-line backup of the client's accounting/ERP software made them able to restore these vital services back on-line. Although a large amount of work needed to be completed to recover completely from the Ryuk damage, core systems were returned to operations rapidly:

During the following month important milestones in the restoration project were achieved in tight collaboration between Progent engineers and the customer:

• Internal web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million archived emails was brought online and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were fully operational.
• A new Palo Alto 850 security appliance was brought online.
• Nearly all of the user PCs were fully operational.

Conclusion
A probable business extinction disaster was dodged through the efforts of top-tier professionals, a broad range of knowledge, and tight teamwork. Although in retrospect the crypto-ransomware penetration described here would have been prevented with advanced cyber security technology and security best practices, user and IT administrator education, and properly executed incident response procedures for information protection and applying software patches, the reality remains that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware virus, remember that Progent's team of experts has a proven track record in ransomware virus blocking, mitigation, and file restoration.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Ipanema
For ransomware recovery services in the Ipanema metro area, phone Progent at 800-462-8800 or see Contact Progent.