Ransomware Defense and Recovery Solutions Miami

Crypto-Ransomware : Your Worst IT Disaster
Crypto-Ransomware has become a modern cyberplague that poses an extinction-level threat for businesses of all sizes unprepared for an assault. Multiple generations of ransomware such as CryptoLocker, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for years and continue to cause destruction. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, as well as additional unnamed newcomers, not only perform encryption of online information but also infect most available system backup. Files synched to the cloud can also be ransomed. In a poorly architected environment, this can make automatic restore operations useless and basically sets the entire system back to zero.

Recovering applications and information after a ransomware intrusion becomes a sprint against the clock as the targeted business struggles to stop the spread, remove the virus, and resume mission-critical operations. Since ransomware needs time to move laterally throughout a network, assaults are frequently launched on weekends, when attacks may take longer to identify. This compounds the difficulty of rapidly marshalling and organizing an experienced mitigation team.

Progent provides a range of support services for securing Miami businesses from ransomware penetrations. These include team training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to detect and quarantine day-zero modern malware assaults. Progent also can provide the assistance of veteran crypto-ransomware recovery consultants with the track record and perseverance to re-deploy a breached network as soon as possible.

Progent's Ransomware Recovery Services
Following a ransomware event, even paying the ransom demands in cryptocurrency does not ensure that cyber hackers will provide the keys to decrypt any of your information. Kaspersky Labs estimated that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to re-install the mission-critical elements of your IT environment. Absent access to essential system backups, this calls for a broad range of skills, professional team management, and the ability to work non-stop until the task is done.

For decades, Progent has made available expert IT services for companies throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded high-level certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial systems and ERP applications. This breadth of experience affords Progent the ability to quickly understand critical systems and integrate the surviving components of your computer network environment following a ransomware event and assemble them into an operational network.

Progent's security team uses powerful project management systems to orchestrate the complicated restoration process. Progent knows the importance of acting swiftly and in concert with a client's management and IT staff to prioritize tasks and to get key systems back online as fast as humanly possible.

Business Case Study: A Successful Ransomware Virus Recovery
A client hired Progent after their network system was taken over by the Ryuk crypto-ransomware. Ryuk is believed to have been deployed by North Korean state hackers, possibly using approaches exposed from America's NSA organization. Ryuk targets specific organizations with little tolerance for operational disruption and is among the most profitable versions of ransomware viruses. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in the Chicago metro area and has around 500 employees. The Ryuk intrusion had brought down all business operations and manufacturing processes. The majority of the client's backups had been directly accessible at the time of the intrusion and were encrypted. The client considered paying the ransom (exceeding two hundred thousand dollars) and praying for the best, but in the end brought in Progent.

Progent worked hand in hand the client to quickly determine and assign priority to the key services that had to be restored to make it possible to continue departmental functions:

• Active Directory
• Microsoft Exchange Server
• MRP System

In less than two days, Progent was able to re-build Windows Active Directory to its pre-intrusion state. Progent then completed rebuilding and hard drive recovery of needed servers. All Exchange data and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble intact OST files (Microsoft Outlook Off-Line Data Files) on staff desktop computers and laptops in order to recover email data. A recent off-line backup of the customer's financials/MRP systems made it possible to recover these required programs back online for users. Although significant work still had to be done to recover completely from the Ryuk attack, essential services were restored quickly:

Throughout the next month important milestones in the recovery project were made through close cooperation between Progent engineers and the customer:

• Internal web sites were restored with no loss of data.
• The MailStore Exchange Server exceeding four million historical messages was brought online and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables/Inventory Control modules were completely recovered.
• A new Palo Alto 850 firewall was brought on-line.
• Most of the desktops and laptops were being used by staff.

Conclusion
A possible business-ending catastrophe was dodged due to results-oriented experts, a broad spectrum of subject matter expertise, and close teamwork. Although in post mortem the ransomware virus incident described here would have been identified and stopped with modern security systems and best practices, user education, and well thought out security procedures for data protection and proper patching controls, the reality remains that state-sponsored cybercriminals from China, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware incursion, feel confident that Progent's roster of experts has extensive experience in ransomware virus defense, remediation, and information systems recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Miami
For ransomware system recovery services in the Miami metro area, call Progent at 800-462-8800 or go to Contact Progent.