Ransomware Protection and Restoration Expertise Nashville

Ransomware : Your Crippling IT Catastrophe
Ransomware has become a modern cyber pandemic that presents an enterprise-level danger for businesses of all sizes poorly prepared for an assault. Versions of ransomware such as Reveton, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and still inflict havoc. Modern variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as more as yet unnamed viruses, not only perform encryption of online information but also infiltrate most available system restores and backups. Data replicated to off-premises disaster recovery sites can also be corrupted. In a vulnerable environment, it can render automated recovery impossible and basically knocks the entire system back to square one.

Getting back services and data after a crypto-ransomware attack becomes a race against time as the targeted organization struggles to contain the damage, eradicate the crypto-ransomware, and resume mission-critical operations. Since ransomware requires time to move laterally across a network, assaults are frequently sprung during nights and weekends, when penetrations may take longer to uncover. This multiplies the difficulty of promptly marshalling and orchestrating a capable response team.

Progent provides an assortment of services for protecting Nashville businesses from ransomware attacks. These include user training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat defense to discover and quarantine day-zero malware attacks. Progent also provides the services of experienced crypto-ransomware recovery professionals with the skills and commitment to re-deploy a breached environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a ransomware penetration, even paying the ransom in cryptocurrency does not guarantee that distant criminals will return the keys to decrypt any of your data. Kaspersky estimated that 17% of ransomware victims never recovered their data after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to setup from scratch the essential parts of your IT environment. Without access to essential data backups, this requires a broad range of skills, professional team management, and the capability to work non-stop until the task is completed.

For decades, Progent has made available professional Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned high-level industry certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP application software. This breadth of experience provides Progent the ability to rapidly determine critical systems and integrate the remaining components of your computer network environment following a ransomware penetration and rebuild them into a functioning network.

Progent's security team of experts uses top notch project management applications to orchestrate the sophisticated restoration process. Progent understands the importance of acting quickly and in unison with a customer's management and Information Technology team members to assign priority to tasks and to get key services back on-line as fast as possible.

Customer Case Study: A Successful Ransomware Penetration Restoration
A business engaged Progent after their network was penetrated by the Ryuk ransomware virus. Ryuk is generally considered to have been created by North Korean state sponsored criminal gangs, possibly using technology leaked from the U.S. NSA organization. Ryuk targets specific businesses with limited tolerance for disruption and is one of the most profitable versions of ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in the Chicago metro area with around 500 staff members. The Ryuk event had shut down all company operations and manufacturing processes. Most of the client's backups had been online at the beginning of the attack and were destroyed. The client was actively seeking loans for paying the ransom demand (exceeding $200K) and hoping for good luck, but ultimately utilized Progent.

Progent worked hand in hand the client to rapidly get our arms around and assign priority to the essential areas that had to be restored to make it possible to resume business operations:

• Active Directory (AD)
• Electronic Mail
• MRP System

Within two days, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then charged ahead with setup and storage recovery on critical systems. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was able to locate non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on user workstations and laptops in order to recover email information. A not too old off-line backup of the client's financials/ERP systems made it possible to recover these vital programs back on-line. Although a lot of work remained to recover completely from the Ryuk event, critical systems were restored rapidly:

Over the next month important milestones in the restoration process were made in close cooperation between Progent engineers and the client:

• Internal web sites were restored with no loss of data.
• The MailStore Server containing more than four million historical emails was spun up and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory modules were fully operational.
• A new Palo Alto 850 firewall was set up and programmed.
• Ninety percent of the desktop computers were functioning as before the incident.

Conclusion
A possible business disaster was averted due to hard-working professionals, a broad spectrum of subject matter expertise, and tight collaboration. Although upon completion of forensics the ransomware virus penetration detailed here would have been identified and disabled with up-to-date cyber security solutions and NIST Cybersecurity Framework best practices, user education, and appropriate security procedures for data backup and keeping systems up to date with security patches, the fact remains that government-sponsored hackers from China, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware attack, feel confident that Progent's team of professionals has proven experience in crypto-ransomware virus blocking, removal, and file disaster recovery.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Nashville
For ransomware cleanup services in the Nashville metro area, call Progent at 800-462-8800 or see Contact Progent.