Ransomware Protection and Remediation Consulting Melbourne

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become an escalating cyberplague that represents an existential danger for businesses vulnerable to an attack. Different iterations of ransomware such as CrySIS, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been around for a long time and still cause havoc. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as additional unnamed viruses, not only perform encryption of on-line information but also infect many accessible system protection. Files synched to cloud environments can also be rendered useless. In a poorly designed data protection solution, this can render any restoration useless and basically knocks the network back to zero.

Getting back on-line programs and data following a ransomware attack becomes a race against time as the targeted organization tries its best to stop lateral movement, eradicate the ransomware, and restore business-critical operations. Because ransomware needs time to move laterally throughout a targeted network, attacks are usually sprung during weekends and nights, when penetrations typically take longer to notice. This multiplies the difficulty of promptly marshalling and coordinating a qualified response team.

Progent makes available a range of services for securing Melbourne enterprises from ransomware events. These include user training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to detect and quarantine zero-day malware assaults. Progent in addition offers the services of veteran crypto-ransomware recovery engineers with the skills and commitment to restore a breached environment as quickly as possible.

Progent's Crypto-Ransomware Recovery Help
Following a ransomware attack, sending the ransom demands in cryptocurrency does not ensure that cyber criminals will respond with the needed keys to decrypt all your information. Kaspersky ascertained that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to re-install the essential components of your IT environment. Absent access to full system backups, this calls for a wide complement of skill sets, professional project management, and the capability to work continuously until the job is complete.

For twenty years, Progent has provided certified expert IT services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial systems and ERP software solutions. This breadth of expertise provides Progent the skills to knowledgably understand necessary systems and re-organize the remaining parts of your network system after a ransomware event and configure them into an operational system.

Progent's security team of experts has state-of-the-art project management tools to orchestrate the complex restoration process. Progent appreciates the importance of working rapidly and in unison with a client's management and Information Technology staff to prioritize tasks and to put key services back on-line as fast as humanly possible.

Customer Story: A Successful Ransomware Attack Recovery
A customer hired Progent after their company was crashed by the Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean state sponsored cybercriminals, suspected of using approaches exposed from the U.S. NSA organization. Ryuk goes after specific businesses with little or no room for operational disruption and is among the most lucrative incarnations of ransomware viruses. Major organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company located in the Chicago metro area with about 500 workers. The Ryuk penetration had brought down all essential operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the start of the intrusion and were damaged. The client was actively seeking loans for paying the ransom demand (exceeding $200K) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked hand in hand the client to rapidly assess and assign priority to the essential systems that had to be addressed to make it possible to continue business operations:

• Active Directory (AD)
• E-Mail
• Accounting and Manufacturing Software

Within two days, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then helped perform reinstallations and hard drive recovery of the most important servers. All Exchange Server data and attributes were usable, which accelerated the restore of Exchange. Progent was also able to collect non-encrypted OST data files (Outlook Off-Line Data Files) on user workstations to recover mail data. A recent offline backup of the client's financials/ERP systems made them able to return these vital applications back available to users. Although major work needed to be completed to recover fully from the Ryuk attack, the most important systems were restored rapidly:

Over the next month key milestones in the restoration project were made through tight cooperation between Progent engineers and the customer:

• Internal web applications were restored without losing any information.
• The MailStore Exchange Server exceeding four million archived emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were fully restored.
• A new Palo Alto 850 firewall was installed.
• Nearly all of the desktop computers were fully operational.

Conclusion
A likely enterprise-killing disaster was dodged by hard-working experts, a wide array of technical expertise, and tight collaboration. Although in hindsight the ransomware virus penetration detailed here could have been identified and prevented with advanced cyber security systems and security best practices, staff education, and well thought out incident response procedures for information protection and keeping systems up to date with security patches, the fact is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's team of professionals has a proven track record in ransomware virus defense, cleanup, and information systems disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Melbourne
For ransomware recovery expertise in the Melbourne area, phone Progent at 800-462-8800 or see Contact Progent.