Ransomware Defense and Cleanup Consulting Napa

Ransomware : Your Feared IT Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an extinction-level danger for businesses unprepared for an assault. Multiple generations of crypto-ransomware such as CryptoLocker, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been around for years and continue to cause havoc. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, along with additional as yet unnamed viruses, not only perform encryption of on-line files but also infect many accessible system restores and backups. Files synched to off-premises disaster recovery sites can also be ransomed. In a poorly architected environment, this can make automated recovery impossible and basically sets the entire system back to zero.

Recovering services and data following a crypto-ransomware intrusion becomes a sprint against the clock as the targeted organization fights to contain, clear the ransomware, and resume business-critical operations. Because crypto-ransomware requires time to move laterally across a targeted network, attacks are frequently launched during weekends and nights, when attacks typically take longer to notice. This multiplies the difficulty of promptly mobilizing and organizing a qualified mitigation team.

Progent makes available a variety of support services for protecting Napa businesses from ransomware events. These include user training to help identify and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat protection to identify and extinguish zero-day malware attacks. Progent in addition provides the assistance of veteran ransomware recovery professionals with the track record and perseverance to reconstruct a compromised network as quickly as possible.

Progent's Crypto-Ransomware Restoration Help
After a ransomware attack, paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will respond with the needed codes to unencrypt all your files. Kaspersky Labs estimated that seventeen percent of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to re-install the critical elements of your Information Technology environment. Absent the availability of full data backups, this calls for a broad range of skills, professional team management, and the capability to work non-stop until the task is complete.

For twenty years, Progent has offered expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of expertise provides Progent the capability to rapidly ascertain critical systems and organize the surviving components of your IT system after a ransomware event and configure them into an operational system.

Progent's recovery team has powerful project management tools to coordinate the complex restoration process. Progent knows the importance of acting swiftly and in unison with a client's management and Information Technology staff to prioritize tasks and to put the most important systems back on line as soon as humanly possible.

Customer Story: A Successful Ransomware Attack Response
A client contacted Progent after their organization was brought down by Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean state cybercriminals, suspected of adopting strategies exposed from America's National Security Agency. Ryuk goes after specific companies with limited room for disruption and is among the most profitable iterations of crypto-ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in Chicago with about 500 employees. The Ryuk penetration had paralyzed all essential operations and manufacturing processes. Most of the client's data backups had been on-line at the start of the intrusion and were eventually encrypted. The client was evaluating paying the ransom (more than $200,000) and praying for the best, but in the end brought in Progent.

Progent worked with the customer to rapidly understand and prioritize the mission critical systems that needed to be addressed in order to continue company operations:

• Active Directory (AD)
• Microsoft Exchange
• MRP System

In less than 2 days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then charged ahead with reinstallations and storage recovery on key systems. All Exchange Server schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was able to find non-encrypted OST files (Outlook Email Off-Line Folder Files) on user desktop computers and laptops to recover email information. A recent offline backup of the client's accounting/MRP software made it possible to return these vital services back on-line. Although a large amount of work remained to recover completely from the Ryuk virus, core systems were recovered rapidly:

Throughout the following month critical milestones in the restoration process were completed in close cooperation between Progent consultants and the customer:

• In-house web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million archived emails was brought online and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control modules were 100% restored.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• Most of the user PCs were back into operation.

Conclusion
A potential business-ending catastrophe was averted due to results-oriented professionals, a wide range of knowledge, and tight teamwork. Although in analyzing the event afterwards the ransomware virus attack detailed here would have been stopped with modern security technology solutions and best practices, team training, and well designed incident response procedures for data protection and proper patching controls, the fact is that state-sponsored hackers from China, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware penetration, remember that Progent's team of professionals has a proven track record in ransomware virus defense, mitigation, and file recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Napa
For ransomware cleanup consulting in the Napa metro area, call Progent at 800-462-8800 or see Contact Progent.