Ransomware Filtering and Cleanup Consulting Manchester

Ransomware : Your Crippling Information Technology Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that poses an existential threat for businesses poorly prepared for an assault. Different versions of crypto-ransomware such as CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and still inflict destruction. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, plus daily as yet unnamed viruses, not only encrypt on-line information but also infiltrate most configured system backups. Files synchronized to off-premises disaster recovery sites can also be rendered useless. In a poorly designed data protection solution, this can render automated recovery useless and basically sets the network back to zero.

Retrieving programs and data following a ransomware event becomes a sprint against time as the targeted business tries its best to contain, clear the virus, and resume business-critical operations. Due to the fact that ransomware needs time to replicate across a network, attacks are usually sprung on weekends and holidays, when attacks in many cases take more time to identify. This multiplies the difficulty of quickly assembling and coordinating a capable mitigation team.

Progent has a range of support services for securing Manchester businesses from ransomware events. These include user training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat protection to discover and disable zero-day modern malware assaults. Progent in addition can provide the assistance of experienced ransomware recovery engineers with the skills and perseverance to reconstruct a breached network as soon as possible.

Progent's Ransomware Restoration Help
Following a crypto-ransomware attack, sending the ransom in cryptocurrency does not provide any assurance that cyber criminals will provide the needed codes to decrypt any or all of your data. Kaspersky estimated that seventeen percent of crypto-ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The fallback is to re-install the essential elements of your Information Technology environment. Absent the availability of full information backups, this calls for a broad range of skill sets, professional project management, and the capability to work continuously until the task is over.

For twenty years, Progent has offered certified expert Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned top certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in accounting and ERP application software. This breadth of expertise affords Progent the skills to quickly ascertain critical systems and organize the surviving parts of your IT system after a ransomware attack and rebuild them into a functioning network.

Progent's security group deploys best of breed project management systems to coordinate the sophisticated restoration process. Progent knows the urgency of acting quickly and in unison with a customer's management and Information Technology resources to prioritize tasks and to put essential services back on line as soon as possible.

Customer Case Study: A Successful Ransomware Intrusion Response
A customer contacted Progent after their organization was crashed by Ryuk crypto-ransomware. Ryuk is believed to have been launched by North Korean state sponsored cybercriminals, possibly adopting strategies exposed from the United States National Security Agency. Ryuk attacks specific organizations with limited tolerance for disruption and is one of the most profitable instances of ransomware malware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturer based in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing processes. The majority of the client's system backups had been online at the beginning of the attack and were eventually encrypted. The client was evaluating paying the ransom demand (exceeding $200K) and hoping for the best, but in the end reached out to Progent.

Progent worked together with the customer to quickly understand and prioritize the critical systems that needed to be recovered to make it possible to resume company operations:

• Active Directory (AD)
• Electronic Messaging
• Accounting and Manufacturing Software

Within two days, Progent was able to recover Active Directory to its pre-intrusion state. Progent then initiated rebuilding and storage recovery of mission critical servers. All Microsoft Exchange Server schema and configuration information were intact, which facilitated the restore of Exchange. Progent was able to find non-encrypted OST files (Microsoft Outlook Offline Data Files) on staff PCs and laptops to recover email data. A not too old off-line backup of the businesses accounting/MRP systems made them able to restore these required applications back online for users. Although a lot of work remained to recover totally from the Ryuk attack, essential systems were returned to operations rapidly:

Over the next month key milestones in the recovery project were completed through tight cooperation between Progent team members and the customer:

• Self-hosted web applications were restored without losing any data.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were 100 percent recovered.
• A new Palo Alto Networks 850 security appliance was deployed.
• 90% of the user PCs were operational.

Conclusion
A likely enterprise-killing disaster was evaded by results-oriented experts, a wide spectrum of IT skills, and close teamwork. Although upon completion of forensics the ransomware attack described here could have been identified and prevented with up-to-date security technology and security best practices, user education, and well thought out security procedures for backup and keeping systems up to date with security patches, the fact is that state-sponsored hackers from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware penetration, feel confident that Progent's roster of experts has proven experience in ransomware virus defense, remediation, and data disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Manchester
For ransomware system restoration services in the Manchester area, phone Progent at 800-462-8800 or go to Contact Progent.