Ransomware Prevention and Removal Solutions Lynnwood

Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyber pandemic that presents an extinction-level danger for businesses unprepared for an assault. Versions of crypto-ransomware such as Dharma, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for a long time and still cause havoc. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with frequent as yet unnamed newcomers, not only perform encryption of online information but also infect most available system protection mechanisms. Data synchronized to off-premises disaster recovery sites can also be corrupted. In a vulnerable environment, it can render any recovery useless and basically sets the network back to zero.

Getting back on-line programs and information after a ransomware attack becomes a race against the clock as the victim fights to stop lateral movement, eradicate the ransomware, and resume enterprise-critical operations. Due to the fact that ransomware requires time to move laterally throughout a network, assaults are usually launched on weekends, when penetrations may take more time to identify. This multiplies the difficulty of quickly assembling and coordinating a capable response team.

Progent has a range of solutions for protecting Lynnwood businesses from ransomware penetrations. These include team member training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based threat protection to detect and extinguish zero-day modern malware attacks. Progent also can provide the services of seasoned ransomware recovery engineers with the track record and commitment to reconstruct a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Restoration Support Services
After a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will respond with the needed codes to decipher all your data. Kaspersky ascertained that 17% of ransomware victims never recovered their files after having paid the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The alternative is to re-install the mission-critical components of your Information Technology environment. Without the availability of complete data backups, this requires a wide range of skills, top notch team management, and the willingness to work continuously until the job is complete.

For decades, Progent has offered expert Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of expertise affords Progent the skills to rapidly determine critical systems and integrate the remaining pieces of your Information Technology environment after a crypto-ransomware event and assemble them into a functioning network.

Progent's security team uses top notch project management systems to orchestrate the complicated recovery process. Progent understands the urgency of working rapidly and in concert with a client's management and IT staff to prioritize tasks and to put key services back on-line as fast as possible.

Client Story: A Successful Ransomware Penetration Recovery
A client hired Progent after their network system was brought down by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state sponsored criminal gangs, suspected of adopting algorithms leaked from America's National Security Agency. Ryuk targets specific businesses with little tolerance for disruption and is among the most profitable versions of ransomware viruses. Major targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in the Chicago metro area with about 500 staff members. The Ryuk event had paralyzed all business operations and manufacturing processes. Most of the client's information backups had been directly accessible at the beginning of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (more than $200,000) and wishfully thinking for the best, but in the end made the decision to use Progent.

Progent worked hand in hand the customer to rapidly assess and assign priority to the critical applications that had to be addressed in order to continue departmental functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Financials/MRP

Within 2 days, Progent was able to recover Active Directory services to its pre-virus state. Progent then completed setup and hard drive recovery of mission critical systems. All Exchange ties and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to collect intact OST data files (Outlook Email Off-Line Folder Files) on team workstations and laptops in order to recover email information. A recent offline backup of the customer's manufacturing software made them able to recover these required applications back online for users. Although a lot of work was left to recover completely from the Ryuk event, critical services were returned to operations quickly:

During the next few weeks critical milestones in the restoration process were accomplished through close cooperation between Progent engineers and the client:

• Internal web applications were restored without losing any data.
• The MailStore Microsoft Exchange Server exceeding 4 million historical emails was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control modules were fully operational.
• A new Palo Alto Networks 850 security appliance was installed.
• 90% of the desktop computers were fully operational.

Conclusion
A potential company-ending catastrophe was evaded through the efforts of results-oriented professionals, a wide spectrum of technical expertise, and tight teamwork. Although in hindsight the ransomware penetration detailed here would have been identified and disabled with modern security technology solutions and NIST Cybersecurity Framework best practices, user training, and well designed incident response procedures for information protection and proper patching controls, the fact remains that government-sponsored cyber criminals from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware attack, feel confident that Progent's roster of experts has a proven track record in ransomware virus blocking, remediation, and data recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Lynnwood
For ransomware cleanup services in the Lynnwood metro area, phone Progent at 800-462-8800 or see Contact Progent.