Ransomware Prevention and Restoration Consulting Philadelphia

Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyberplague that presents an extinction-level danger for businesses of all sizes unprepared for an attack. Versions of ransomware like the CrySIS, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for a long time and still inflict destruction. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, as well as additional as yet unnamed malware, not only perform encryption of online files but also infect many available system backup. Information synchronized to off-premises disaster recovery sites can also be rendered useless. In a poorly architected system, this can make automatic recovery hopeless and effectively sets the network back to square one.

Restoring programs and information after a crypto-ransomware intrusion becomes a race against the clock as the targeted organization fights to stop lateral movement, cleanup the ransomware, and resume enterprise-critical activity. Since ransomware takes time to move laterally across a network, attacks are often launched at night, when successful attacks are likely to take more time to notice. This compounds the difficulty of quickly mobilizing and organizing a capable response team.

Progent has an assortment of solutions for securing Philadelphia enterprises from ransomware events. Among these are staff training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to identify and quarantine day-zero malware assaults. Progent in addition offers the services of seasoned ransomware recovery engineers with the track record and perseverance to reconstruct a compromised environment as soon as possible.

Progent's Ransomware Recovery Support Services
Following a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that distant criminals will provide the keys to decrypt any or all of your files. Kaspersky determined that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The fallback is to setup from scratch the critical components of your Information Technology environment. Absent access to complete system backups, this calls for a broad complement of IT skills, professional team management, and the ability to work 24x7 until the job is done.

For twenty years, Progent has provided professional Information Technology services for businesses across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned advanced industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of experience gives Progent the ability to quickly determine important systems and re-organize the surviving pieces of your IT system after a ransomware penetration and rebuild them into a functioning system.

Progent's recovery team deploys top notch project management systems to coordinate the sophisticated recovery process. Progent appreciates the urgency of acting rapidly and together with a client's management and IT team members to prioritize tasks and to get the most important services back online as soon as possible.

Customer Story: A Successful Ransomware Intrusion Recovery
A customer contacted Progent after their organization was penetrated by the Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean state sponsored hackers, suspected of using algorithms leaked from America's NSA organization. Ryuk attacks specific organizations with little tolerance for disruption and is one of the most lucrative iterations of ransomware. Headline targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing business located in the Chicago metro area and has about 500 employees. The Ryuk intrusion had frozen all essential operations and manufacturing processes. Most of the client's backups had been on-line at the start of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and praying for the best, but ultimately brought in Progent.

Progent worked with the client to quickly determine and prioritize the mission critical services that needed to be restored to make it possible to resume business functions:

• Windows Active Directory
• Microsoft Exchange
• MRP System

Within two days, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then assisted with setup and storage recovery on critical applications. All Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to collect intact OST data files (Outlook Email Offline Data Files) on staff desktop computers and laptops to recover mail data. A recent offline backup of the client's manufacturing software made them able to recover these required applications back servicing users. Although major work needed to be completed to recover totally from the Ryuk event, core services were returned to operations quickly:

During the following month critical milestones in the recovery process were accomplished through tight cooperation between Progent team members and the client:

• Internal web sites were restored without losing any information.
• The MailStore Exchange Server with over four million archived emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables/Inventory Control functions were 100 percent recovered.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Most of the user workstations were fully operational.

Conclusion
A possible business-ending catastrophe was averted by results-oriented experts, a wide spectrum of technical expertise, and tight teamwork. Although in hindsight the ransomware penetration detailed here should have been prevented with up-to-date security technology and best practices, team education, and well designed incident response procedures for information backup and applying software patches, the reality is that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has substantial experience in crypto-ransomware virus blocking, mitigation, and file recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Philadelphia
For ransomware system restoration expertise in the Philadelphia area, phone Progent at 800-462-8800 or go to Contact Progent.