Ransomware Filtering and Recovery Solutions Las Vegas

Crypto-Ransomware : Your Feared IT Catastrophe
Ransomware has become an escalating cyber pandemic that presents an enterprise-level threat for businesses of all sizes unprepared for an assault. Versions of ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for years and continue to inflict damage. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, along with additional unnamed malware, not only encrypt on-line data but also infect all configured system protection. Information synched to the cloud can also be corrupted. In a poorly architected data protection solution, it can render any restoration impossible and effectively sets the network back to zero.

Getting back services and information after a crypto-ransomware event becomes a race against the clock as the targeted business struggles to stop lateral movement, clear the ransomware, and resume mission-critical activity. Because ransomware requires time to move laterally across a targeted network, attacks are often launched on weekends, when successful attacks are likely to take more time to identify. This multiplies the difficulty of rapidly marshalling and coordinating a qualified response team.

Progent offers a range of services for securing Las Vegas enterprises from crypto-ransomware events. These include user training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat defense to detect and disable day-zero modern malware attacks. Progent also can provide the services of seasoned ransomware recovery engineers with the talent and commitment to rebuild a breached environment as soon as possible.

Progent's Ransomware Recovery Help
Following a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will provide the needed codes to unencrypt all your files. Kaspersky determined that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The fallback is to re-install the critical parts of your Information Technology environment. Without access to complete system backups, this requires a wide complement of skills, well-coordinated team management, and the capability to work 24x7 until the job is over.

For twenty years, Progent has made available certified expert IT services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained high-level certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with accounting and ERP applications. This breadth of expertise affords Progent the capability to efficiently identify necessary systems and integrate the surviving parts of your computer network environment after a crypto-ransomware attack and rebuild them into an operational network.

Progent's security team of experts deploys state-of-the-art project management systems to orchestrate the complicated restoration process. Progent knows the importance of working swiftly and together with a client's management and Information Technology resources to prioritize tasks and to get essential applications back on-line as fast as possible.

Client Case Study: A Successful Crypto-Ransomware Incident Response
A small business hired Progent after their organization was attacked by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean state cybercriminals, suspected of adopting technology exposed from the U.S. NSA organization. Ryuk goes after specific organizations with little or no ability to sustain disruption and is one of the most profitable instances of crypto-ransomware. Headline victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company based in the Chicago metro area and has around 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the start of the attack and were damaged. The client considered paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but ultimately brought in Progent.

Progent worked with the client to quickly identify and assign priority to the key applications that had to be restored in order to restart business functions:

• Microsoft Active Directory
• Electronic Messaging
• Financials/MRP

In less than two days, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then charged ahead with rebuilding and storage recovery on mission critical applications. All Exchange Server ties and attributes were usable, which greatly helped the restore of Exchange. Progent was able to locate local OST files (Microsoft Outlook Offline Data Files) on user workstations in order to recover email information. A recent off-line backup of the businesses accounting/ERP software made it possible to recover these required applications back available to users. Although significant work still had to be done to recover totally from the Ryuk damage, the most important services were recovered quickly:

Over the next couple of weeks important milestones in the restoration project were completed in close cooperation between Progent team members and the client:

• In-house web applications were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server with over 4 million historical messages was restored to operations and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory capabilities were 100 percent operational.
• A new Palo Alto 850 firewall was set up and programmed.
• Nearly all of the desktops and laptops were operational.

Conclusion
A probable business catastrophe was averted by dedicated experts, a wide array of knowledge, and tight teamwork. Although in analyzing the event afterwards the ransomware incident detailed here would have been prevented with up-to-date cyber security solutions and recognized best practices, team education, and well designed security procedures for data backup and keeping systems up to date with security patches, the reality is that state-sponsored cyber criminals from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, mitigation, and file restoration.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Las Vegas
For ransomware system recovery consulting in the Las Vegas area, phone Progent at 800-462-8800 or visit Contact Progent.