Ransomware Filtering and Cleanup Services Plano

Ransomware : Your Feared IT Nightmare
Ransomware has become an escalating cyberplague that represents an existential danger for businesses unprepared for an assault. Multiple generations of ransomware such as CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for many years and still cause damage. Newer variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as daily unnamed newcomers, not only encrypt online files but also infiltrate many configured system backups. Files synched to cloud environments can also be ransomed. In a poorly architected data protection solution, it can render any restoration impossible and effectively sets the entire system back to square one.

Recovering services and information following a ransomware event becomes a sprint against the clock as the targeted business tries its best to contain, clear the crypto-ransomware, and resume mission-critical operations. Due to the fact that ransomware takes time to replicate throughout a network, assaults are often sprung during weekends and nights, when successful penetrations may take longer to recognize. This multiplies the difficulty of promptly mobilizing and coordinating an experienced response team.

Progent provides a variety of help services for protecting Plano organizations from ransomware events. Among these are staff training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based threat defense to discover and quarantine zero-day malware attacks. Progent also can provide the assistance of seasoned ransomware recovery consultants with the track record and perseverance to rebuild a breached environment as quickly as possible.

Progent's Crypto-Ransomware Restoration Help
Soon after a ransomware invasion, even paying the ransom demands in cryptocurrency does not ensure that criminal gangs will return the needed codes to unencrypt any of your files. Kaspersky Labs estimated that seventeen percent of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to piece back together the mission-critical components of your Information Technology environment. Absent access to essential system backups, this requires a wide complement of skill sets, well-coordinated project management, and the capability to work 24x7 until the recovery project is complete.

For twenty years, Progent has made available expert Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned advanced certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of expertise affords Progent the capability to quickly identify important systems and re-organize the surviving components of your network system after a ransomware penetration and rebuild them into an operational system.

Progent's recovery group uses top notch project management tools to orchestrate the complex recovery process. Progent understands the urgency of working swiftly and together with a customer's management and Information Technology team members to assign priority to tasks and to get the most important applications back on-line as soon as humanly possible.

Customer Story: A Successful Ransomware Penetration Recovery
A business sought out Progent after their network system was attacked by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean government sponsored cybercriminals, suspected of using algorithms leaked from the U.S. NSA organization. Ryuk seeks specific companies with little room for operational disruption and is one of the most profitable incarnations of ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer based in Chicago with around 500 employees. The Ryuk attack had frozen all essential operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the start of the attack and were eventually encrypted. The client was evaluating paying the ransom demand (exceeding $200K) and wishfully thinking for good luck, but ultimately made the decision to use Progent.

Progent worked together with the customer to quickly get our arms around and assign priority to the most important elements that needed to be restored to make it possible to restart company functions:

• Active Directory (AD)
• Email
• Financials/MRP

Within two days, Progent was able to recover Active Directory services to its pre-penetration state. Progent then helped perform rebuilding and storage recovery on essential systems. All Exchange ties and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to collect intact OST data files (Outlook Off-Line Data Files) on user desktop computers in order to recover email data. A not too old off-line backup of the businesses accounting/ERP systems made it possible to restore these required applications back on-line. Although significant work still had to be done to recover completely from the Ryuk event, the most important systems were recovered quickly:

During the following month important milestones in the recovery project were accomplished through tight collaboration between Progent engineers and the client:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Server containing more than 4 million archived messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory modules were fully restored.
• A new Palo Alto Networks 850 security appliance was brought online.
• Ninety percent of the user workstations were being used by staff.

Conclusion
A potential business-killing catastrophe was avoided through the efforts of dedicated professionals, a broad range of knowledge, and close collaboration. Although in retrospect the ransomware penetration detailed here should have been disabled with modern cyber security solutions and ISO/IEC 27001 best practices, staff education, and well designed incident response procedures for information protection and proper patching controls, the fact is that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware incursion, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, remediation, and information systems recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Plano
For ransomware recovery consulting services in the Plano metro area, call Progent at 800-462-8800 or visit Contact Progent.