Ransomware Protection and Cleanup Expertise Lincoln

Crypto-Ransomware : Your Worst IT Disaster
Ransomware has become an escalating cyberplague that represents an enterprise-level threat for businesses of all sizes vulnerable to an attack. Different versions of crypto-ransomware such as CrySIS, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for many years and still cause destruction. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus more unnamed newcomers, not only perform encryption of on-line critical data but also infect all accessible system protection mechanisms. Files synchronized to cloud environments can also be encrypted. In a poorly designed environment, it can make automatic recovery hopeless and basically knocks the datacenter back to zero.

Restoring programs and data after a ransomware attack becomes a race against time as the targeted business struggles to stop lateral movement, remove the ransomware, and restore enterprise-critical activity. Due to the fact that ransomware requires time to spread across a targeted network, attacks are often sprung on weekends, when successful attacks typically take longer to identify. This compounds the difficulty of rapidly marshalling and organizing a capable response team.

Progent makes available an assortment of solutions for securing Lincoln businesses from ransomware attacks. These include user training to help recognize and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to identify and extinguish day-zero modern malware assaults. Progent also offers the services of experienced ransomware recovery professionals with the skills and commitment to rebuild a breached environment as rapidly as possible.

Progent's Ransomware Recovery Help
Subsequent to a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will return the needed codes to decrypt all your files. Kaspersky Labs ascertained that seventeen percent of crypto-ransomware victims never restored their data even after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to piece back together the essential elements of your Information Technology environment. Without the availability of complete system backups, this requires a broad complement of skills, professional team management, and the willingness to work non-stop until the recovery project is finished.

For decades, Progent has provided certified expert Information Technology services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded advanced certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial management and ERP applications. This breadth of experience provides Progent the skills to rapidly ascertain critical systems and re-organize the surviving parts of your IT system following a crypto-ransomware penetration and configure them into an operational system.

Progent's ransomware group deploys state-of-the-art project management systems to coordinate the complicated recovery process. Progent understands the urgency of working rapidly and in concert with a client's management and IT staff to prioritize tasks and to put critical services back on-line as soon as possible.

Client Story: A Successful Ransomware Incident Restoration
A business hired Progent after their organization was crashed by Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state cybercriminals, suspected of using techniques leaked from the U.S. NSA organization. Ryuk attacks specific businesses with limited room for disruption and is among the most profitable examples of ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in Chicago and has around 500 employees. The Ryuk event had frozen all essential operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the time of the intrusion and were damaged. The client was pursuing financing for paying the ransom (in excess of two hundred thousand dollars) and praying for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the customer to quickly identify and prioritize the critical systems that needed to be addressed in order to continue departmental operations:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then helped perform rebuilding and storage recovery of the most important servers. All Exchange Server schema and attributes were usable, which facilitated the restore of Exchange. Progent was able to locate intact OST files (Outlook Off-Line Data Files) on various desktop computers in order to recover mail messages. A not too old off-line backup of the businesses accounting systems made it possible to recover these vital programs back available to users. Although a large amount of work remained to recover fully from the Ryuk attack, critical systems were returned to operations quickly:

During the next few weeks critical milestones in the restoration process were achieved in close cooperation between Progent consultants and the client:

• In-house web sites were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server exceeding four million historical emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory Control modules were fully functional.
• A new Palo Alto Networks 850 firewall was deployed.
• Nearly all of the desktops and laptops were operational.

Conclusion
A possible business-killing disaster was evaded with top-tier professionals, a wide spectrum of knowledge, and tight collaboration. Although in post mortem the crypto-ransomware penetration described here should have been identified and blocked with advanced security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and well designed incident response procedures for data protection and proper patching controls, the fact is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware virus, remember that Progent's roster of professionals has substantial experience in crypto-ransomware virus blocking, cleanup, and data recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Lincoln
For ransomware system recovery expertise in the Lincoln area, call Progent at 800-462-8800 or see Contact Progent.