Ransomware Prevention and Restoration Consulting Minnetonka

Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that represents an existential threat for businesses poorly prepared for an attack. Different iterations of crypto-ransomware like the CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for a long time and still cause destruction. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with daily as yet unnamed viruses, not only encrypt on-line critical data but also infect most available system protection mechanisms. Information replicated to cloud environments can also be ransomed. In a poorly designed data protection solution, this can render any restoration hopeless and basically knocks the datacenter back to square one.

Getting back services and information following a ransomware attack becomes a race against the clock as the targeted organization tries its best to contain, clear the ransomware, and resume enterprise-critical operations. Due to the fact that ransomware needs time to move laterally throughout a targeted network, attacks are frequently launched during weekends and nights, when successful attacks tend to take longer to uncover. This compounds the difficulty of promptly assembling and organizing an experienced mitigation team.

Progent makes available a variety of help services for securing Minnetonka enterprises from crypto-ransomware attacks. Among these are team member education to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat defense to discover and quarantine zero-day modern malware assaults. Progent in addition provides the services of expert ransomware recovery professionals with the skills and commitment to restore a breached system as quickly as possible.

Progent's Ransomware Recovery Support Services
After a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not ensure that cyber hackers will return the needed codes to decrypt any of your information. Kaspersky determined that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to re-install the critical parts of your Information Technology environment. Absent the availability of full data backups, this calls for a broad range of skill sets, top notch project management, and the capability to work continuously until the recovery project is done.

For decades, Progent has provided professional Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have been awarded advanced industry certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of experience affords Progent the skills to rapidly determine necessary systems and consolidate the remaining components of your IT environment following a ransomware attack and assemble them into an operational system.

Progent's ransomware group uses state-of-the-art project management applications to coordinate the complex recovery process. Progent knows the importance of acting swiftly and in unison with a client's management and IT resources to prioritize tasks and to get the most important systems back online as fast as possible.

Customer Case Study: A Successful Ransomware Penetration Response
A business contacted Progent after their company was penetrated by the Ryuk ransomware virus. Ryuk is thought to have been launched by North Korean state hackers, suspected of using strategies exposed from America's NSA organization. Ryuk targets specific organizations with limited room for operational disruption and is among the most lucrative incarnations of ransomware. Major victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in Chicago with around 500 workers. The Ryuk event had disabled all company operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the beginning of the attack and were destroyed. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and praying for the best, but ultimately utilized Progent.

Progent worked together with the client to rapidly identify and prioritize the key systems that needed to be restored in order to continue company functions:

• Active Directory
• Email
• Accounting and Manufacturing Software

Within 2 days, Progent was able to recover Active Directory to its pre-virus state. Progent then initiated setup and storage recovery on the most important servers. All Microsoft Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to find local OST data files (Outlook Email Offline Folder Files) on user desktop computers to recover email data. A not too old offline backup of the customer's accounting software made them able to restore these vital programs back online for users. Although significant work was left to recover completely from the Ryuk virus, core systems were recovered rapidly:

Throughout the following month important milestones in the recovery project were completed in tight collaboration between Progent team members and the customer:

• Internal web applications were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server exceeding four million historical emails was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control capabilities were fully recovered.
• A new Palo Alto 850 firewall was deployed.
• Nearly all of the desktop computers were back into operation.

Conclusion
A probable business-killing catastrophe was averted due to top-tier experts, a broad array of knowledge, and close teamwork. Although upon completion of forensics the ransomware incident detailed here should have been identified and stopped with advanced security technology solutions and recognized best practices, staff education, and well thought out incident response procedures for information protection and proper patching controls, the reality remains that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, remember that Progent's team of experts has extensive experience in crypto-ransomware virus defense, mitigation, and data restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Minnetonka
For ransomware recovery expertise in the Minnetonka area, phone Progent at 800-462-8800 or go to Contact Progent.