Ransomware Protection and Cleanup Services Lubbock

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become an escalating cyberplague that poses an extinction-level threat for organizations vulnerable to an assault. Versions of crypto-ransomware like the CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for years and still inflict destruction. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, as well as more unnamed malware, not only perform encryption of online information but also infiltrate any accessible system restores and backups. Data synchronized to cloud environments can also be corrupted. In a vulnerable environment, this can render any restoration hopeless and effectively sets the datacenter back to zero.

Getting back on-line programs and data after a crypto-ransomware attack becomes a race against the clock as the targeted organization tries its best to stop the spread, clear the virus, and resume mission-critical activity. Due to the fact that ransomware takes time to spread throughout a network, attacks are often sprung on weekends, when attacks may take more time to recognize. This multiplies the difficulty of quickly assembling and orchestrating an experienced response team.

Progent offers a range of help services for protecting Lubbock businesses from crypto-ransomware attacks. Among these are user education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to discover and quarantine zero-day modern malware attacks. Progent also provides the services of veteran ransomware recovery engineers with the skills and perseverance to rebuild a breached system as quickly as possible.

Progent's Ransomware Recovery Help
Soon after a ransomware invasion, paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the codes to decipher any or all of your files. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The fallback is to setup from scratch the key elements of your IT environment. Absent access to full system backups, this requires a broad complement of skills, professional team management, and the willingness to work 24x7 until the recovery project is over.

For twenty years, Progent has provided certified expert IT services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained advanced certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial systems and ERP application software. This breadth of expertise provides Progent the capability to knowledgably determine important systems and re-organize the surviving pieces of your network environment after a ransomware event and rebuild them into an operational system.

Progent's ransomware group has powerful project management tools to coordinate the complicated recovery process. Progent understands the urgency of acting quickly and in unison with a customer's management and IT team members to assign priority to tasks and to put critical applications back online as soon as humanly possible.

Client Story: A Successful Ransomware Intrusion Restoration
A business sought out Progent after their network was penetrated by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state criminal gangs, suspected of using approaches leaked from the United States NSA organization. Ryuk goes after specific companies with little or no ability to sustain operational disruption and is among the most profitable examples of crypto-ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company based in the Chicago metro area and has about 500 staff members. The Ryuk attack had disabled all company operations and manufacturing processes. The majority of the client's information backups had been online at the start of the intrusion and were damaged. The client was actively seeking loans for paying the ransom demand (more than $200K) and hoping for good luck, but ultimately engaged Progent.

Progent worked together with the client to rapidly identify and assign priority to the key areas that had to be recovered in order to resume departmental operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• MRP System

Within two days, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then completed rebuilding and hard drive recovery on key systems. All Exchange Server data and attributes were intact, which greatly helped the restore of Exchange. Progent was also able to collect non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on user workstations in order to recover mail messages. A recent offline backup of the client's manufacturing systems made them able to return these vital programs back online. Although major work still had to be done to recover totally from the Ryuk attack, essential services were restored rapidly:

During the next couple of weeks important milestones in the restoration process were made through close cooperation between Progent consultants and the client:

• In-house web applications were brought back up with no loss of information.
• The MailStore Server containing more than four million archived messages was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/AP/AR/Inventory capabilities were 100% restored.
• A new Palo Alto Networks 850 security appliance was installed.
• 90% of the desktop computers were operational.

Conclusion
A potential enterprise-killing catastrophe was avoided with dedicated experts, a wide range of subject matter expertise, and close collaboration. Although in retrospect the crypto-ransomware penetration detailed here should have been shut down with advanced cyber security systems and security best practices, staff training, and properly executed incident response procedures for information protection and applying software patches, the reality remains that state-sponsored hackers from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware virus, feel confident that Progent's team of experts has substantial experience in crypto-ransomware virus defense, mitigation, and file recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Lubbock
For ransomware system recovery services in the Lubbock area, call Progent at 800-462-8800 or go to Contact Progent.