Ransomware Prevention and Restoration Services Chicago

Ransomware : Your Crippling Information Technology Disaster
Crypto-Ransomware has become a too-frequent cyberplague that poses an existential danger for businesses of all sizes vulnerable to an attack. Different iterations of ransomware such as CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for years and continue to cause destruction. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with more as yet unnamed newcomers, not only encrypt on-line information but also infiltrate any available system backups. Information synched to off-premises disaster recovery sites can also be encrypted. In a vulnerable environment, it can make automated recovery useless and effectively knocks the datacenter back to square one.

Recovering programs and information following a ransomware intrusion becomes a sprint against the clock as the victim struggles to stop lateral movement, clear the crypto-ransomware, and restore enterprise-critical operations. Because ransomware needs time to replicate throughout a targeted network, attacks are often launched during nights and weekends, when penetrations may take more time to notice. This compounds the difficulty of quickly mobilizing and orchestrating a capable mitigation team.

Progent makes available a variety of solutions for protecting Chicago organizations from ransomware penetrations. These include team member training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to discover and disable day-zero malware assaults. Progent also can provide the services of experienced ransomware recovery consultants with the talent and commitment to re-deploy a breached environment as soon as possible.

Progent's Crypto-Ransomware Recovery Support Services
After a crypto-ransomware invasion, even paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will provide the needed codes to decipher all your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their data after having paid the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to piece back together the vital parts of your Information Technology environment. Absent access to essential information backups, this calls for a wide complement of skills, top notch team management, and the capability to work continuously until the job is completed.

For twenty years, Progent has provided certified expert IT services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have been awarded top industry certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP software solutions. This breadth of experience gives Progent the skills to knowledgably ascertain necessary systems and re-organize the remaining parts of your Information Technology environment after a ransomware attack and configure them into a functioning network.

Progent's recovery team of experts uses top notch project management systems to coordinate the sophisticated recovery process. Progent appreciates the urgency of acting rapidly and in concert with a client's management and Information Technology staff to prioritize tasks and to put critical systems back on line as fast as possible.

Case Study: A Successful Ransomware Incident Restoration
A business hired Progent after their organization was taken over by the Ryuk ransomware. Ryuk is generally considered to have been created by North Korean government sponsored hackers, suspected of using approaches leaked from the United States NSA organization. Ryuk seeks specific companies with little room for disruption and is one of the most lucrative incarnations of crypto-ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturer based in the Chicago metro area with around 500 staff members. The Ryuk penetration had disabled all business operations and manufacturing capabilities. Most of the client's data backups had been online at the beginning of the intrusion and were destroyed. The client considered paying the ransom demand (more than $200,000) and hoping for the best, but in the end utilized Progent.

Progent worked with the customer to quickly understand and assign priority to the critical systems that needed to be recovered in order to resume departmental functions:

• Active Directory (AD)
• Microsoft Exchange Email
• Financials/MRP

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then accomplished reinstallations and storage recovery on the most important servers. All Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to locate local OST files (Microsoft Outlook Off-Line Folder Files) on staff desktop computers in order to recover email messages. A recent offline backup of the client's financials/MRP systems made it possible to recover these essential services back online. Although a lot of work needed to be completed to recover completely from the Ryuk event, core systems were recovered quickly:

During the following couple of weeks important milestones in the recovery process were completed in close collaboration between Progent team members and the customer:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Server exceeding 4 million historical messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory functions were completely functional.
• A new Palo Alto 850 firewall was installed and configured.
• 90% of the user PCs were fully operational.

Conclusion
A probable business extinction disaster was evaded through the efforts of dedicated professionals, a wide array of technical expertise, and tight teamwork. Although in analyzing the event afterwards the crypto-ransomware attack detailed here would have been prevented with modern security systems and ISO/IEC 27001 best practices, user and IT administrator training, and well designed incident response procedures for information backup and applying software patches, the reality remains that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware incident, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus defense, cleanup, and file disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Chicago
For ransomware system recovery expertise in the Chicago metro area, call Progent at 800-462-8800 or see Contact Progent.