Ransomware Protection and Cleanup Expertise Monterrey

Ransomware : Your Worst IT Catastrophe
Ransomware has become a too-frequent cyberplague that poses an extinction-level danger for organizations vulnerable to an attack. Multiple generations of ransomware like the Dharma, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for a long time and continue to inflict harm. More recent strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with more as yet unnamed newcomers, not only encrypt online critical data but also infiltrate many available system protection. Files synched to cloud environments can also be encrypted. In a poorly designed data protection solution, this can render any recovery impossible and basically knocks the datacenter back to zero.

Restoring programs and information after a ransomware attack becomes a race against time as the victim struggles to stop lateral movement, clear the crypto-ransomware, and restore enterprise-critical activity. Because ransomware takes time to spread throughout a network, penetrations are usually sprung on weekends and holidays, when successful penetrations are likely to take more time to identify. This multiplies the difficulty of rapidly mobilizing and orchestrating a qualified mitigation team.

Progent has a variety of solutions for securing Monterrey organizations from ransomware attacks. Among these are staff education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to discover and quarantine day-zero malware attacks. Progent in addition provides the services of seasoned crypto-ransomware recovery consultants with the talent and commitment to reconstruct a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not ensure that cyber criminals will respond with the needed codes to decipher any or all of your information. Kaspersky estimated that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to setup from scratch the essential parts of your Information Technology environment. Absent the availability of essential information backups, this calls for a broad range of skills, top notch team management, and the willingness to work continuously until the job is done.

For two decades, Progent has offered expert IT services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained advanced certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP applications. This breadth of expertise affords Progent the skills to knowledgably understand important systems and re-organize the remaining components of your IT environment following a ransomware event and configure them into a functioning network.

Progent's recovery group has state-of-the-art project management systems to coordinate the complex restoration process. Progent understands the importance of acting quickly and in concert with a client's management and Information Technology resources to prioritize tasks and to get key systems back on line as soon as humanly possible.

Business Case Study: A Successful Ransomware Incident Response
A client contacted Progent after their network was crashed by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean government sponsored cybercriminals, suspected of using techniques leaked from the U.S. National Security Agency. Ryuk targets specific companies with little room for operational disruption and is among the most profitable versions of ransomware malware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business based in Chicago and has about 500 employees. The Ryuk intrusion had paralyzed all business operations and manufacturing capabilities. Most of the client's system backups had been online at the beginning of the attack and were destroyed. The client considered paying the ransom (in excess of two hundred thousand dollars) and praying for the best, but ultimately utilized Progent.

Progent worked together with the customer to quickly identify and prioritize the most important elements that needed to be recovered to make it possible to restart business functions:

• Microsoft Active Directory
• E-Mail
• Financials/MRP

In less than 48 hours, Progent was able to restore Active Directory to its pre-intrusion state. Progent then accomplished reinstallations and storage recovery on mission critical servers. All Exchange schema and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble intact OST data files (Outlook Email Off-Line Data Files) on user desktop computers in order to recover mail messages. A not too old off-line backup of the client's accounting/MRP systems made them able to restore these required programs back available to users. Although significant work still had to be done to recover fully from the Ryuk damage, core systems were returned to operations quickly:

Over the next couple of weeks critical milestones in the restoration process were made through tight cooperation between Progent engineers and the client:

• In-house web applications were restored without losing any information.
• The MailStore Server containing more than four million archived messages was spun up and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were 100% operational.
• A new Palo Alto 850 security appliance was brought on-line.
• 90% of the desktops and laptops were being used by staff.

Conclusion
A likely business-ending catastrophe was dodged due to results-oriented experts, a broad array of IT skills, and tight collaboration. Although in retrospect the ransomware virus incident detailed here could have been disabled with up-to-date security technology solutions and security best practices, user education, and well designed incident response procedures for data backup and applying software patches, the fact remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's team of experts has a proven track record in ransomware virus blocking, remediation, and file recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Monterrey
For ransomware system recovery expertise in the Monterrey area, call Progent at 800-462-8800 or visit Contact Progent.