Ransomware Prevention and Remediation Solutions Panama City
Ransomware File-Recovery: An Example
Ransomware : Your Worst Information Technology Nightmare
Ransomware has become an escalating cyberplague that presents an extinction-level danger for businesses unprepared for an assault. Different versions of ransomware like the CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for many years and still cause destruction. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as daily as yet unnamed malware, not only perform encryption of on-line information but also infiltrate most available system backup. Information synched to cloud environments can also be rendered useless. In a poorly designed environment, this can make automatic recovery hopeless and effectively knocks the datacenter back to zero.
Recovering services and data after a crypto-ransomware intrusion becomes a sprint against time as the targeted business struggles to contain the damage, eradicate the ransomware, and resume mission-critical activity. Because ransomware takes time to move laterally across a network, penetrations are frequently launched on weekends, when successful attacks are likely to take longer to identify. This multiplies the difficulty of promptly marshalling and coordinating a capable mitigation team.
Progent makes available a variety of help services for securing Panama City businesses from ransomware penetrations. These include team education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat protection to identify and disable day-zero modern malware assaults. Progent in addition provides the assistance of expert ransomware recovery consultants with the talent and perseverance to reconstruct a compromised system as rapidly as possible.
Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware attack, paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will return the needed codes to unencrypt any of your information. Kaspersky estimated that 17% of crypto-ransomware victims never restored their files after having paid the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to re-install the essential elements of your Information Technology environment. Without access to full information backups, this calls for a broad complement of skills, top notch project management, and the willingness to work non-stop until the job is done.
For decades, Progent has made available professional Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained advanced industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of expertise gives Progent the skills to knowledgably identify important systems and organize the surviving parts of your Information Technology system after a ransomware penetration and configure them into a functioning network.
Progent's security group utilizes top notch project management tools to orchestrate the complex recovery process. Progent knows the importance of working swiftly and in concert with a client's management and IT staff to assign priority to tasks and to get critical applications back online as soon as humanly possible.
Case Study: A Successful Ransomware Incident Recovery
A small business engaged Progent after their network system was taken over by the Ryuk ransomware virus. Ryuk is thought to have been created by North Korean state cybercriminals, possibly adopting strategies leaked from the U.S. NSA organization. Ryuk seeks specific organizations with little room for operational disruption and is one of the most lucrative instances of ransomware viruses. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturer based in Chicago with around 500 workers. The Ryuk penetration had frozen all business operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the beginning of the attack and were damaged. The client was evaluating paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but ultimately engaged Progent.
Progent worked with the client to rapidly assess and assign priority to the key areas that needed to be recovered to make it possible to continue company operations:
- Active Directory
- Microsoft Exchange
- Accounting and Manufacturing Software
In less than 48 hours, Progent was able to re-build Active Directory services to its pre-attack state. Progent then performed reinstallations and storage recovery of mission critical systems. All Microsoft Exchange Server data and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to find non-encrypted OST files (Microsoft Outlook Off-Line Data Files) on team workstations and laptops to recover email information. A not too old off-line backup of the customer's financials/ERP systems made them able to recover these essential services back online for users. Although a lot of work was left to recover totally from the Ryuk virus, core services were returned to operations quickly:
Throughout the following few weeks critical milestones in the recovery project were completed through close cooperation between Progent team members and the client:
- In-house web sites were returned to operation without losing any information.
- The MailStore Server with over four million archived emails was brought on-line and accessible to users.
- CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory modules were completely operational.
- A new Palo Alto Networks 850 firewall was deployed.
- 90% of the user desktops and notebooks were operational.
Conclusion
A probable business disaster was avoided through the efforts of results-oriented experts, a broad array of subject matter expertise, and tight collaboration. Although in hindsight the ransomware penetration described here would have been identified and blocked with current security technology and NIST Cybersecurity Framework best practices, user training, and appropriate security procedures for information protection and applying software patches, the fact remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's roster of professionals has proven experience in ransomware virus blocking, removal, and file recovery.
Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Cleanup Services in Panama City
For ransomware cleanup services in the Panama City area, phone Progent at
Select Topic: