Ransomware Filtering and Cleanup Services Providence

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that poses an extinction-level threat for businesses of all sizes vulnerable to an assault. Different versions of crypto-ransomware like the CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for a long time and continue to cause harm. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, along with daily unnamed malware, not only encrypt online data files but also infiltrate many accessible system restores and backups. Information replicated to cloud environments can also be ransomed. In a poorly architected data protection solution, this can make automatic restore operations hopeless and effectively knocks the entire system back to zero.

Getting back online programs and data following a ransomware intrusion becomes a race against time as the targeted organization tries its best to stop the spread, clear the ransomware, and restore mission-critical activity. Because crypto-ransomware requires time to spread across a targeted network, attacks are frequently sprung on weekends and holidays, when penetrations tend to take more time to notice. This multiplies the difficulty of rapidly marshalling and organizing a capable response team.

Progent offers an assortment of support services for protecting Providence businesses from ransomware events. Among these are user training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat defense to detect and quarantine day-zero malware attacks. Progent in addition can provide the services of seasoned ransomware recovery professionals with the track record and perseverance to restore a breached environment as urgently as possible.

Progent's Ransomware Recovery Services
After a ransomware invasion, paying the ransom demands in cryptocurrency does not guarantee that merciless criminals will return the codes to unencrypt any or all of your files. Kaspersky Labs determined that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to piece back together the vital elements of your Information Technology environment. Absent access to full information backups, this requires a broad complement of skill sets, well-coordinated team management, and the ability to work continuously until the recovery project is over.

For twenty years, Progent has offered certified expert IT services for businesses throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have been awarded high-level certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in accounting and ERP software solutions. This breadth of expertise affords Progent the ability to rapidly ascertain necessary systems and integrate the remaining pieces of your network system after a ransomware event and configure them into an operational network.

Progent's ransomware group deploys best of breed project management applications to coordinate the sophisticated restoration process. Progent knows the importance of working swiftly and together with a client's management and Information Technology team members to assign priority to tasks and to get key applications back online as fast as possible.

Case Study: A Successful Ransomware Intrusion Restoration
A business sought out Progent after their network was attacked by the Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean state sponsored hackers, possibly using strategies leaked from America's National Security Agency. Ryuk seeks specific businesses with little or no tolerance for operational disruption and is one of the most profitable iterations of ransomware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer located in Chicago and has around 500 staff members. The Ryuk penetration had brought down all business operations and manufacturing processes. The majority of the client's information backups had been on-line at the beginning of the intrusion and were encrypted. The client was taking steps for paying the ransom demand (in excess of $200,000) and hoping for good luck, but in the end utilized Progent.

Progent worked with the customer to rapidly identify and prioritize the critical systems that needed to be restored to make it possible to continue business functions:

• Active Directory (AD)
• Electronic Mail
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then performed setup and storage recovery on essential applications. All Exchange Server data and configuration information were usable, which greatly helped the restore of Exchange. Progent was also able to locate non-encrypted OST files (Microsoft Outlook Offline Data Files) on team PCs to recover email messages. A not too old offline backup of the businesses accounting/MRP software made them able to return these essential applications back available to users. Although a large amount of work remained to recover fully from the Ryuk damage, critical systems were restored rapidly:

Over the next month key milestones in the restoration process were accomplished through tight collaboration between Progent team members and the customer:

• Internal web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was brought online and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control modules were fully functional.
• A new Palo Alto 850 firewall was deployed.
• Most of the user workstations were being used by staff.

Conclusion
A likely business-ending catastrophe was dodged by results-oriented professionals, a broad spectrum of technical expertise, and close collaboration. Although in post mortem the ransomware penetration described here could have been prevented with up-to-date cyber security systems and best practices, team education, and well thought out security procedures for backup and keeping systems up to date with security patches, the reality is that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware attack, feel confident that Progent's roster of professionals has extensive experience in ransomware virus blocking, removal, and file recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Providence
For ransomware system restoration expertise in the Providence area, call Progent at 800-462-8800 or see Contact Progent.