Ransomware Filtering and Restoration Solutions Ottawa

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a modern cyberplague that poses an extinction-level threat for businesses unprepared for an attack. Versions of crypto-ransomware like the Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been around for years and still cause harm. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, plus daily unnamed malware, not only perform encryption of on-line data files but also infect all accessible system backups. Data replicated to off-premises disaster recovery sites can also be rendered useless. In a poorly architected data protection solution, this can render automatic recovery impossible and effectively sets the datacenter back to square one.

Recovering services and information following a crypto-ransomware event becomes a race against time as the targeted business fights to stop lateral movement, remove the ransomware, and resume enterprise-critical activity. Due to the fact that ransomware takes time to move laterally across a network, assaults are usually sprung during nights and weekends, when successful attacks tend to take more time to detect. This compounds the difficulty of promptly assembling and coordinating a knowledgeable response team.

Progent makes available a variety of services for protecting Ottawa organizations from ransomware events. Among these are staff training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat defense to discover and quarantine zero-day modern malware attacks. Progent also provides the services of experienced ransomware recovery consultants with the talent and perseverance to reconstruct a breached environment as quickly as possible.

Progent's Ransomware Restoration Support Services
After a crypto-ransomware invasion, even paying the ransom in cryptocurrency does not ensure that distant criminals will provide the codes to decipher any or all of your information. Kaspersky determined that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to piece back together the mission-critical elements of your IT environment. Without access to full system backups, this requires a broad complement of IT skills, top notch team management, and the willingness to work continuously until the task is completed.

For two decades, Progent has made available certified expert IT services for businesses across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have been awarded top industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial management and ERP application software. This breadth of experience provides Progent the ability to quickly identify necessary systems and re-organize the remaining components of your IT system after a crypto-ransomware event and rebuild them into an operational system.

Progent's ransomware team utilizes state-of-the-art project management tools to coordinate the sophisticated recovery process. Progent understands the importance of acting swiftly and in concert with a customer's management and Information Technology resources to prioritize tasks and to get critical services back online as fast as possible.

Customer Case Study: A Successful Crypto-Ransomware Attack Response
A customer escalated to Progent after their organization was crashed by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state cybercriminals, suspected of adopting approaches leaked from America's NSA organization. Ryuk seeks specific companies with little tolerance for operational disruption and is one of the most lucrative incarnations of crypto-ransomware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in the Chicago metro area and has about 500 workers. The Ryuk intrusion had shut down all essential operations and manufacturing capabilities. Most of the client's data protection had been on-line at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and praying for good luck, but in the end brought in Progent.

Progent worked with the client to rapidly determine and prioritize the critical systems that needed to be addressed to make it possible to resume company functions:

• Active Directory (AD)
• Electronic Mail
• Accounting and Manufacturing Software

In less than two days, Progent was able to restore Active Directory services to its pre-penetration state. Progent then completed rebuilding and storage recovery of the most important applications. All Exchange Server ties and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to assemble non-encrypted OST data files (Microsoft Outlook Off-Line Folder Files) on various desktop computers and laptops to recover email data. A not too old off-line backup of the client's financials/ERP software made it possible to return these essential applications back online for users. Although major work still had to be done to recover totally from the Ryuk virus, core services were recovered quickly:

During the next couple of weeks critical milestones in the recovery project were accomplished through close cooperation between Progent engineers and the customer:

• Self-hosted web sites were restored without losing any data.
• The MailStore Server containing more than four million archived emails was restored to operations and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/AR/Inventory modules were fully recovered.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Nearly all of the user workstations were being used by staff.

Conclusion
A possible business extinction catastrophe was evaded with dedicated professionals, a broad spectrum of knowledge, and tight collaboration. Although in post mortem the ransomware attack detailed here should have been stopped with current cyber security technology and security best practices, staff education, and properly executed incident response procedures for data protection and keeping systems up to date with security patches, the fact remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware penetration, remember that Progent's roster of professionals has a proven track record in crypto-ransomware virus blocking, remediation, and information systems disaster recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Ottawa
For ransomware system restoration services in the Ottawa metro area, call Progent at 800-462-8800 or visit Contact Progent.