Ransomware Protection and Restoration Solutions Oxford

Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware has become an escalating cyberplague that presents an existential threat for businesses poorly prepared for an attack. Versions of crypto-ransomware such as Dharma, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and still inflict destruction. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, as well as more unnamed malware, not only encrypt on-line data files but also infiltrate most available system backup. Information synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly architected system, it can render automated recovery hopeless and basically knocks the datacenter back to square one.

Getting back online programs and information after a crypto-ransomware intrusion becomes a sprint against the clock as the targeted business struggles to stop the spread, clear the ransomware, and resume mission-critical operations. Due to the fact that ransomware takes time to replicate throughout a network, attacks are usually sprung on weekends, when successful attacks may take longer to uncover. This multiplies the difficulty of quickly mobilizing and organizing a capable response team.

Progent makes available a variety of solutions for securing Oxford organizations from ransomware attacks. These include staff training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based threat defense to discover and disable zero-day malware attacks. Progent also can provide the assistance of seasoned crypto-ransomware recovery professionals with the track record and perseverance to rebuild a breached environment as quickly as possible.

Progent's Ransomware Restoration Help
After a ransomware event, even paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will respond with the needed keys to decipher any or all of your information. Kaspersky Labs estimated that seventeen percent of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The fallback is to re-install the critical elements of your Information Technology environment. Without access to full data backups, this calls for a broad complement of skill sets, professional team management, and the willingness to work 24x7 until the recovery project is completed.

For two decades, Progent has made available certified expert IT services for companies across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained top industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial systems and ERP software solutions. This breadth of expertise gives Progent the ability to knowledgably understand critical systems and consolidate the remaining parts of your Information Technology system after a ransomware event and configure them into a functioning system.

Progent's security group utilizes powerful project management tools to orchestrate the complex recovery process. Progent knows the importance of acting quickly and in unison with a customer's management and Information Technology resources to prioritize tasks and to get critical services back on line as soon as humanly possible.

Case Study: A Successful Ransomware Attack Recovery
A small business escalated to Progent after their network system was crashed by the Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean state hackers, suspected of using techniques exposed from the U.S. NSA organization. Ryuk goes after specific companies with little or no ability to sustain operational disruption and is among the most profitable examples of ransomware viruses. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer located in Chicago with around 500 workers. The Ryuk intrusion had brought down all company operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the time of the intrusion and were damaged. The client was evaluating paying the ransom demand (exceeding $200,000) and praying for the best, but in the end called Progent.

Progent worked together with the customer to quickly understand and prioritize the most important elements that had to be addressed to make it possible to continue departmental functions:

• Windows Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

Within 2 days, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then assisted with reinstallations and storage recovery of essential systems. All Microsoft Exchange Server ties and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble intact OST files (Outlook Off-Line Folder Files) on user PCs in order to recover mail data. A not too old off-line backup of the client's financials/ERP systems made it possible to return these essential services back online. Although major work still had to be done to recover totally from the Ryuk event, essential systems were recovered quickly:

Over the following month critical milestones in the recovery project were achieved in tight collaboration between Progent team members and the customer:

• Self-hosted web applications were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server containing more than 4 million historical emails was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were fully functional.
• A new Palo Alto 850 security appliance was deployed.
• 90% of the user desktops were back into operation.

Conclusion
A likely company-ending catastrophe was avoided due to dedicated professionals, a broad range of IT skills, and close collaboration. Although upon completion of forensics the ransomware incident described here would have been stopped with modern cyber security solutions and NIST Cybersecurity Framework best practices, user education, and properly executed incident response procedures for information backup and applying software patches, the reality is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's team of experts has extensive experience in ransomware virus defense, removal, and file disaster recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Oxford
For ransomware system recovery expertise in the Oxford area, call Progent at 800-462-8800 or see Contact Progent.