Ransomware Defense and Recovery Services Campinas

Crypto-Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyberplague that represents an enterprise-level danger for businesses of all sizes vulnerable to an assault. Different iterations of ransomware such as Dharma, Fusob, Locky, SamSam and MongoLock cryptoworms have been replicating for years and still inflict harm. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as daily as yet unnamed newcomers, not only perform encryption of online critical data but also infect many available system protection mechanisms. Data replicated to off-premises disaster recovery sites can also be corrupted. In a vulnerable system, it can render any restore operations hopeless and effectively sets the entire system back to zero.

Restoring services and information after a ransomware intrusion becomes a race against the clock as the victim tries its best to stop the spread, remove the ransomware, and restore business-critical operations. Because ransomware requires time to move laterally across a network, attacks are usually sprung at night, when successful attacks tend to take longer to identify. This multiplies the difficulty of promptly assembling and organizing a capable response team.

Progent offers an assortment of solutions for protecting Campinas organizations from ransomware attacks. Among these are team training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to identify and disable day-zero malware attacks. Progent also provides the assistance of experienced ransomware recovery consultants with the track record and commitment to rebuild a breached network as quickly as possible.

Progent's Ransomware Restoration Support Services
After a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not guarantee that criminal gangs will provide the needed keys to unencrypt any of your data. Kaspersky Labs determined that 17% of crypto-ransomware victims never restored their files after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to piece back together the mission-critical parts of your Information Technology environment. Absent the availability of essential information backups, this requires a broad range of skills, professional project management, and the ability to work non-stop until the job is complete.

For two decades, Progent has made available certified expert IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have garnered internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial systems and ERP applications. This breadth of experience provides Progent the ability to knowledgably determine critical systems and re-organize the remaining pieces of your Information Technology system following a ransomware attack and rebuild them into a functioning system.

Progent's ransomware team utilizes state-of-the-art project management systems to orchestrate the sophisticated restoration process. Progent understands the importance of acting rapidly and in unison with a client's management and IT staff to assign priority to tasks and to put essential systems back on-line as soon as possible.

Customer Story: A Successful Ransomware Attack Restoration
A client contacted Progent after their organization was taken over by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state cybercriminals, suspected of using algorithms leaked from America's NSA organization. Ryuk targets specific companies with limited room for disruption and is one of the most lucrative incarnations of crypto-ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in Chicago and has about 500 workers. The Ryuk penetration had disabled all business operations and manufacturing processes. The majority of the client's information backups had been online at the time of the attack and were damaged. The client was pursuing financing for paying the ransom (in excess of $200K) and hoping for the best, but in the end engaged Progent.

Progent worked together with the customer to rapidly determine and assign priority to the key elements that had to be restored in order to continue business operations:

• Microsoft Active Directory
• Microsoft Exchange
• Financials/MRP

In less than 2 days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then accomplished rebuilding and hard drive recovery on essential servers. All Microsoft Exchange Server ties and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to collect non-encrypted OST files (Microsoft Outlook Off-Line Folder Files) on team PCs in order to recover mail information. A not too old off-line backup of the customer's accounting/MRP software made it possible to return these required applications back online. Although a large amount of work still had to be done to recover fully from the Ryuk attack, core services were restored quickly:

Over the following few weeks important milestones in the recovery project were completed in close cooperation between Progent consultants and the client:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Exchange Server exceeding 4 million historical emails was spun up and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/AR/Inventory Control functions were completely restored.
• A new Palo Alto Networks 850 firewall was brought on-line.
• 90% of the user desktops and notebooks were fully operational.

Conclusion
A possible business catastrophe was dodged with results-oriented professionals, a wide range of technical expertise, and tight teamwork. Although in retrospect the ransomware virus attack detailed here could have been identified and prevented with current security technology and ISO/IEC 27001 best practices, staff training, and appropriate incident response procedures for data backup and proper patching controls, the reality remains that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, feel confident that Progent's roster of experts has extensive experience in ransomware virus blocking, removal, and data disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Campinas
For ransomware cleanup consulting in the Campinas area, call Progent at 800-462-8800 or visit Contact Progent.