Ransomware Defense and Recovery Expertise Baltimore

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become a too-frequent cyberplague that poses an existential danger for businesses of all sizes poorly prepared for an assault. Multiple generations of ransomware such as Reveton, Fusob, Locky, NotPetya and MongoLock cryptoworms have been around for many years and continue to cause harm. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, along with more as yet unnamed viruses, not only encrypt on-line data but also infect all accessible system restores and backups. Data synched to the cloud can also be rendered useless. In a poorly designed system, it can make automated restore operations useless and effectively sets the entire system back to zero.

Recovering applications and data following a ransomware intrusion becomes a sprint against the clock as the victim fights to stop lateral movement, cleanup the ransomware, and restore business-critical operations. Due to the fact that ransomware takes time to move laterally across a network, assaults are frequently sprung on weekends, when attacks typically take longer to identify. This multiplies the difficulty of promptly assembling and organizing a capable response team.

Progent has a range of support services for protecting Baltimore enterprises from ransomware attacks. Among these are staff training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to detect and suppress zero-day modern malware attacks. Progent in addition can provide the services of expert crypto-ransomware recovery engineers with the talent and commitment to rebuild a breached system as rapidly as possible.

Progent's Ransomware Restoration Services
Following a ransomware invasion, even paying the ransom in cryptocurrency does not ensure that distant criminals will respond with the codes to decipher all your files. Kaspersky ascertained that 17% of ransomware victims never recovered their data after having paid the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The other path is to re-install the key parts of your IT environment. Absent the availability of full system backups, this requires a wide complement of IT skills, well-coordinated project management, and the ability to work 24x7 until the recovery project is over.

For two decades, Progent has provided professional IT services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP software solutions. This breadth of expertise provides Progent the capability to knowledgably identify important systems and re-organize the surviving parts of your IT environment after a ransomware attack and configure them into a functioning system.

Progent's security team has state-of-the-art project management applications to coordinate the complicated recovery process. Progent appreciates the importance of working rapidly and in unison with a client's management and Information Technology staff to assign priority to tasks and to get the most important systems back on line as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Intrusion Response
A client hired Progent after their organization was taken over by Ryuk crypto-ransomware. Ryuk is believed to have been developed by North Korean state cybercriminals, suspected of using technology exposed from the United States National Security Agency. Ryuk seeks specific organizations with limited ability to sustain disruption and is among the most profitable incarnations of ransomware. Major victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in Chicago with around 500 employees. The Ryuk intrusion had brought down all company operations and manufacturing processes. Most of the client's backups had been online at the start of the intrusion and were destroyed. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but in the end reached out to Progent.

Progent worked hand in hand the customer to quickly determine and prioritize the critical systems that needed to be restored in order to continue departmental functions:

• Active Directory
• Microsoft Exchange Email
• Accounting/MRP

Within two days, Progent was able to re-build Active Directory to its pre-penetration state. Progent then assisted with setup and hard drive recovery of needed systems. All Exchange Server ties and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to find intact OST files (Outlook Email Off-Line Folder Files) on various desktop computers and laptops to recover email information. A not too old offline backup of the customer's accounting systems made them able to return these required services back online for users. Although a large amount of work needed to be completed to recover totally from the Ryuk virus, critical services were recovered rapidly:

Over the following month critical milestones in the recovery project were made in tight collaboration between Progent consultants and the client:

• Internal web applications were returned to operation with no loss of data.
• The MailStore Exchange Server exceeding four million archived messages was restored to operations and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control capabilities were 100 percent functional.
• A new Palo Alto 850 firewall was deployed.
• Nearly all of the user PCs were operational.

Conclusion
A potential business-ending catastrophe was avoided through the efforts of hard-working professionals, a broad array of IT skills, and close teamwork. Although in analyzing the event afterwards the ransomware virus incident described here would have been disabled with modern security technology solutions and NIST Cybersecurity Framework best practices, user and IT administrator education, and properly executed security procedures for data protection and proper patching controls, the fact remains that state-sponsored cybercriminals from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's roster of experts has extensive experience in ransomware virus defense, cleanup, and data recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Baltimore
For ransomware system recovery expertise in the Baltimore area, phone Progent at 800-462-8800 or visit Contact Progent.