Ransomware Filtering and Cleanup Solutions Kansas City
Crypto-Ransomware Repair: An Example
Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become a modern cyber pandemic that poses an extinction-level danger for businesses of all sizes poorly prepared for an assault. Different iterations of ransomware such as Reveton, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been running rampant for a long time and continue to cause harm. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus daily unnamed malware, not only perform encryption of online data files but also infect most configured system backup. Data synched to the cloud can also be ransomed. In a poorly designed system, it can make automated restoration hopeless and basically sets the entire system back to zero.
Getting back on-line applications and data after a crypto-ransomware attack becomes a race against the clock as the victim tries its best to contain the damage, remove the crypto-ransomware, and restore enterprise-critical operations. Since crypto-ransomware needs time to spread throughout a targeted network, attacks are frequently launched at night, when attacks may take longer to discover. This compounds the difficulty of promptly marshalling and orchestrating a knowledgeable mitigation team.
Progent provides a variety of services for protecting Kansas City businesses from crypto-ransomware attacks. These include team member training to help identify and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat protection to identify and suppress day-zero modern malware attacks. Progent in addition can provide the assistance of seasoned ransomware recovery professionals with the skills and commitment to re-deploy a breached system as urgently as possible.
Progent's Ransomware Recovery Support Services
Subsequent to a ransomware event, sending the ransom demands in cryptocurrency does not guarantee that criminal gangs will provide the needed keys to unencrypt all your data. Kaspersky Labs ascertained that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The alternative is to piece back together the mission-critical elements of your IT environment. Absent the availability of essential data backups, this calls for a wide complement of skills, professional project management, and the ability to work 24x7 until the recovery project is done.
For decades, Progent has made available certified expert IT services for companies throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have been awarded top industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with accounting and ERP applications. This breadth of expertise provides Progent the skills to rapidly identify necessary systems and re-organize the surviving parts of your IT environment following a ransomware event and rebuild them into a functioning system.
Progent's security team deploys top notch project management systems to orchestrate the complex restoration process. Progent understands the urgency of working swiftly and in concert with a customer's management and IT staff to assign priority to tasks and to get key systems back on line as soon as humanly possible.
Case Study: A Successful Crypto-Ransomware Attack Recovery
A business sought out Progent after their organization was attacked by Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean state cybercriminals, possibly adopting strategies leaked from the United States National Security Agency. Ryuk goes after specific organizations with little or no ability to sustain operational disruption and is among the most profitable incarnations of crypto-ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company based in Chicago with around 500 staff members. The Ryuk event had paralyzed all company operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the beginning of the attack and were eventually encrypted. The client was evaluating paying the ransom (exceeding $200K) and wishfully thinking for the best, but in the end reached out to Progent.
Progent worked together with the customer to quickly understand and prioritize the essential elements that needed to be recovered in order to continue business operations:
- Microsoft Active Directory
- Electronic Mail
- Accounting and Manufacturing Software
In less than 2 days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then accomplished reinstallations and hard drive recovery on mission critical applications. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to locate non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on team PCs to recover email messages. A not too old offline backup of the businesses accounting/ERP systems made it possible to recover these essential services back online. Although significant work was left to recover totally from the Ryuk virus, core systems were restored quickly:
During the next couple of weeks critical milestones in the restoration process were accomplished in tight collaboration between Progent team members and the customer:
- Self-hosted web applications were restored without losing any data.
- The MailStore Exchange Server with over four million archived messages was restored to operations and accessible to users.
- CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control functions were 100 percent functional.
- A new Palo Alto 850 security appliance was brought on-line.
- Ninety percent of the user workstations were being used by staff.
Conclusion
A potential business-killing disaster was evaded by dedicated professionals, a wide range of subject matter expertise, and close collaboration. Although in retrospect the crypto-ransomware virus incident detailed here would have been identified and disabled with advanced security solutions and recognized best practices, user and IT administrator training, and well designed security procedures for data protection and applying software patches, the reality is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a crypto-ransomware attack, remember that Progent's roster of experts has proven experience in crypto-ransomware virus blocking, removal, and file recovery.
Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware System Restoration Services in Kansas City
For ransomware system restoration services in the Kansas City metro area, call Progent at
Select Topic: