Ransomware Protection and Removal Solutions Louisville

Crypto-Ransomware : Your Worst IT Nightmare
Ransomware has become an escalating cyber pandemic that represents an enterprise-level threat for businesses unprepared for an assault. Versions of ransomware like the Dharma, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for a long time and continue to cause destruction. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, along with daily as yet unnamed malware, not only encrypt on-line data files but also infect many accessible system backups. Data replicated to off-premises disaster recovery sites can also be corrupted. In a poorly architected environment, it can render any restoration impossible and basically knocks the datacenter back to zero.

Getting back on-line programs and information following a crypto-ransomware outage becomes a sprint against the clock as the targeted business tries its best to stop the spread, remove the ransomware, and resume enterprise-critical activity. Due to the fact that ransomware requires time to replicate throughout a network, attacks are usually launched on weekends and holidays, when attacks are likely to take longer to recognize. This multiplies the difficulty of rapidly assembling and coordinating a knowledgeable response team.

Progent makes available a range of solutions for protecting Louisville organizations from ransomware attacks. Among these are user education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based threat protection to discover and quarantine day-zero malware attacks. Progent in addition provides the services of experienced ransomware recovery engineers with the track record and commitment to re-deploy a breached environment as rapidly as possible.

Progent's Ransomware Restoration Services
After a ransomware penetration, sending the ransom in cryptocurrency does not guarantee that distant criminals will respond with the needed codes to decrypt any of your files. Kaspersky estimated that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to re-install the mission-critical components of your Information Technology environment. Absent access to complete information backups, this calls for a wide complement of skill sets, well-coordinated team management, and the willingness to work continuously until the job is finished.

For decades, Progent has offered professional IT services for companies throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have been awarded advanced certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial systems and ERP software solutions. This breadth of expertise affords Progent the skills to rapidly understand necessary systems and organize the surviving components of your IT system after a ransomware event and configure them into an operational network.

Progent's recovery team uses state-of-the-art project management systems to coordinate the sophisticated recovery process. Progent understands the urgency of acting rapidly and in unison with a client's management and Information Technology staff to assign priority to tasks and to get critical applications back online as fast as possible.

Customer Story: A Successful Crypto-Ransomware Penetration Restoration
A client engaged Progent after their organization was taken over by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean state hackers, suspected of adopting techniques exposed from the United States NSA organization. Ryuk attacks specific businesses with little or no tolerance for disruption and is among the most lucrative instances of ransomware malware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturer located in the Chicago metro area with around 500 staff members. The Ryuk attack had frozen all business operations and manufacturing capabilities. The majority of the client's backups had been on-line at the start of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (exceeding $200K) and hoping for the best, but ultimately engaged Progent.

Progent worked together with the customer to quickly get our arms around and assign priority to the mission critical applications that had to be recovered in order to restart business functions:

• Active Directory (AD)
• Email
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then accomplished setup and storage recovery of the most important systems. All Exchange data and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to locate local OST data files (Outlook Email Off-Line Folder Files) on staff PCs in order to recover email data. A recent off-line backup of the businesses financials/ERP software made them able to recover these essential applications back online for users. Although major work still had to be done to recover completely from the Ryuk attack, critical systems were restored rapidly:

Over the next couple of weeks important milestones in the restoration process were made in tight cooperation between Progent engineers and the client:

• Internal web applications were restored with no loss of information.
• The MailStore Server containing more than four million historical emails was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/AP/Accounts Receivables/Inventory capabilities were 100 percent operational.
• A new Palo Alto Networks 850 firewall was installed.
• 90% of the user workstations were back into operation.

Conclusion
A potential business-killing disaster was averted due to dedicated professionals, a wide array of knowledge, and close teamwork. Although in post mortem the crypto-ransomware virus incident detailed here should have been disabled with modern cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and well thought out security procedures for information backup and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's team of professionals has extensive experience in crypto-ransomware virus defense, removal, and data restoration.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Louisville
For ransomware cleanup services in the Louisville area, call Progent at 800-462-8800 or visit Contact Progent.