Ransomware Protection and Recovery Solutions Mexico City

Crypto-Ransomware : Your Feared IT Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that poses an extinction-level threat for businesses of all sizes vulnerable to an assault. Versions of ransomware such as Reveton, Fusob, Locky, SamSam and MongoLock cryptoworms have been around for years and continue to inflict havoc. More recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, along with daily unnamed newcomers, not only perform encryption of online files but also infect any available system protection mechanisms. Data replicated to off-premises disaster recovery sites can also be encrypted. In a poorly designed environment, it can render any restoration hopeless and effectively sets the network back to square one.

Retrieving applications and information following a crypto-ransomware attack becomes a sprint against time as the targeted organization fights to stop the spread, clear the virus, and restore business-critical activity. Because ransomware needs time to move laterally throughout a network, assaults are often launched on weekends, when successful attacks tend to take more time to discover. This compounds the difficulty of rapidly assembling and coordinating a capable response team.

Progent provides an assortment of support services for securing Mexico City organizations from crypto-ransomware attacks. Among these are team education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to detect and suppress zero-day malware assaults. Progent also provides the assistance of experienced crypto-ransomware recovery professionals with the track record and perseverance to reconstruct a breached network as urgently as possible.

Progent's Crypto-Ransomware Restoration Support Services
Subsequent to a crypto-ransomware event, paying the ransom demands in cryptocurrency does not ensure that merciless criminals will respond with the codes to decipher any of your files. Kaspersky estimated that 17% of ransomware victims never recovered their data after having paid the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to re-install the critical elements of your Information Technology environment. Without the availability of complete information backups, this calls for a wide complement of skills, well-coordinated team management, and the capability to work non-stop until the recovery project is over.

For twenty years, Progent has provided professional IT services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained top industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial management and ERP software solutions. This breadth of expertise affords Progent the capability to knowledgably determine necessary systems and re-organize the remaining pieces of your network system following a ransomware attack and assemble them into an operational network.

Progent's security team utilizes best of breed project management systems to coordinate the complicated recovery process. Progent understands the urgency of working swiftly and together with a client's management and Information Technology resources to prioritize tasks and to put essential services back online as soon as humanly possible.

Client Story: A Successful Ransomware Incident Response
A customer escalated to Progent after their network system was taken over by Ryuk ransomware virus. Ryuk is believed to have been developed by North Korean government sponsored criminal gangs, suspected of using algorithms exposed from the U.S. National Security Agency. Ryuk attacks specific businesses with limited tolerance for operational disruption and is among the most profitable incarnations of ransomware malware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in Chicago and has about 500 workers. The Ryuk intrusion had disabled all business operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the start of the intrusion and were eventually encrypted. The client considered paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked together with the customer to quickly identify and assign priority to the critical services that had to be recovered to make it possible to continue departmental functions:

• Active Directory
• E-Mail
• Accounting and Manufacturing Software

Within two days, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then assisted with setup and hard drive recovery on key systems. All Exchange Server schema and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to assemble local OST files (Outlook Email Off-Line Folder Files) on user PCs to recover mail data. A not too old offline backup of the businesses accounting/MRP systems made them able to restore these essential programs back servicing users. Although a large amount of work still had to be done to recover totally from the Ryuk damage, core systems were recovered rapidly:

Throughout the next few weeks important milestones in the restoration process were achieved in tight cooperation between Progent consultants and the customer:

• Self-hosted web sites were brought back up without losing any information.
• The MailStore Server with over four million archived emails was restored to operations and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/AR/Inventory Control capabilities were 100% operational.
• A new Palo Alto 850 firewall was set up and programmed.
• Ninety percent of the desktops and laptops were fully operational.

Conclusion
A potential business-killing catastrophe was dodged by hard-working experts, a wide array of technical expertise, and close collaboration. Although in hindsight the crypto-ransomware penetration detailed here should have been stopped with modern security systems and security best practices, staff training, and properly executed security procedures for information backup and applying software patches, the reality remains that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of professionals has substantial experience in crypto-ransomware virus blocking, mitigation, and file disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Mexico City
For ransomware cleanup services in the Mexico City area, phone Progent at 800-462-8800 or go to Contact Progent.