Ransomware Prevention and Restoration Expertise Newark

Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become a too-frequent cyberplague that presents an enterprise-level threat for organizations poorly prepared for an assault. Different iterations of ransomware such as CryptoLocker, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been running rampant for years and continue to inflict harm. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, plus daily unnamed malware, not only perform encryption of online information but also infiltrate all accessible system protection. Files synchronized to the cloud can also be rendered useless. In a poorly architected data protection solution, this can make automatic restoration hopeless and effectively sets the entire system back to square one.

Retrieving services and information after a crypto-ransomware attack becomes a sprint against the clock as the targeted organization struggles to stop lateral movement, clear the ransomware, and resume enterprise-critical activity. Due to the fact that ransomware takes time to spread across a targeted network, penetrations are often sprung during weekends and nights, when penetrations may take longer to notice. This compounds the difficulty of rapidly assembling and coordinating an experienced response team.

Progent offers a variety of solutions for securing Newark enterprises from ransomware events. These include staff education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to detect and disable zero-day malware assaults. Progent in addition can provide the services of seasoned ransomware recovery consultants with the track record and commitment to restore a compromised system as quickly as possible.

Progent's Ransomware Recovery Services
Following a crypto-ransomware attack, paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will return the needed keys to unencrypt any of your information. Kaspersky Labs ascertained that 17% of ransomware victims never restored their information after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to re-install the key parts of your Information Technology environment. Without the availability of complete system backups, this requires a wide range of skill sets, professional team management, and the willingness to work continuously until the job is complete.

For two decades, Progent has offered professional Information Technology services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have attained top certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-renowned certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial management and ERP software solutions. This breadth of expertise affords Progent the capability to quickly understand necessary systems and re-organize the remaining components of your network environment following a crypto-ransomware penetration and assemble them into a functioning system.

Progent's security group uses state-of-the-art project management tools to coordinate the sophisticated recovery process. Progent knows the importance of acting swiftly and in concert with a customer's management and IT team members to prioritize tasks and to get critical services back online as fast as possible.

Customer Case Study: A Successful Ransomware Attack Restoration
A customer engaged Progent after their company was crashed by the Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean government sponsored hackers, suspected of adopting techniques leaked from America's NSA organization. Ryuk attacks specific organizations with little room for disruption and is one of the most profitable incarnations of crypto-ransomware. Headline victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in Chicago with about 500 workers. The Ryuk event had frozen all company operations and manufacturing processes. Most of the client's data protection had been online at the beginning of the intrusion and were eventually encrypted. The client was evaluating paying the ransom (more than $200K) and wishfully thinking for good luck, but in the end made the decision to use Progent.

Progent worked with the client to quickly get our arms around and assign priority to the critical systems that needed to be recovered to make it possible to restart departmental functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Financials/MRP

Within 2 days, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then charged ahead with rebuilding and storage recovery on mission critical servers. All Exchange Server ties and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to find intact OST files (Microsoft Outlook Offline Data Files) on team workstations and laptops to recover mail information. A not too old offline backup of the customer's accounting/ERP systems made them able to restore these essential applications back available to users. Although significant work was left to recover totally from the Ryuk damage, the most important services were restored rapidly:

Over the following few weeks important milestones in the recovery process were accomplished through close collaboration between Progent team members and the customer:

• Internal web sites were returned to operation without losing any information.
• The MailStore Server with over 4 million historical messages was restored to operations and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory functions were completely restored.
• A new Palo Alto Networks 850 firewall was brought online.
• Ninety percent of the user desktops and notebooks were functioning as before the incident.

Conclusion
A likely company-ending disaster was evaded with results-oriented experts, a wide range of technical expertise, and tight teamwork. Although in retrospect the crypto-ransomware virus attack detailed here could have been shut down with up-to-date security technology and recognized best practices, staff training, and properly executed incident response procedures for data backup and keeping systems up to date with security patches, the reality is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a crypto-ransomware penetration, remember that Progent's roster of experts has proven experience in ransomware virus defense, cleanup, and data disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Newark
For ransomware recovery services in the Newark metro area, call Progent at 800-462-8800 or see Contact Progent.