Ransomware Prevention and Cleanup Expertise Harrisburg
Ransomware Mitigation: An Example
Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a modern cyber pandemic that presents an existential threat for organizations vulnerable to an attack. Different versions of crypto-ransomware like the Reveton, Fusob, Locky, SamSam and MongoLock cryptoworms have been out in the wild for a long time and continue to cause harm. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as daily as yet unnamed malware, not only perform encryption of on-line data files but also infiltrate all accessible system protection mechanisms. Data replicated to the cloud can also be corrupted. In a vulnerable system, this can make automatic recovery impossible and effectively knocks the entire system back to square one.
Getting back on-line applications and information following a crypto-ransomware outage becomes a sprint against the clock as the targeted business fights to contain, remove the crypto-ransomware, and restore mission-critical operations. Due to the fact that ransomware requires time to replicate throughout a network, attacks are frequently launched on weekends and holidays, when successful penetrations in many cases take longer to recognize. This compounds the difficulty of promptly assembling and coordinating an experienced mitigation team.
Progent makes available a range of help services for protecting Harrisburg enterprises from ransomware penetrations. Among these are staff education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to detect and extinguish zero-day malware attacks. Progent in addition can provide the assistance of experienced ransomware recovery consultants with the talent and commitment to reconstruct a compromised network as urgently as possible.
Progent's Ransomware Restoration Support Services
Subsequent to a ransomware attack, sending the ransom demands in cryptocurrency does not ensure that criminal gangs will provide the needed keys to unencrypt any or all of your data. Kaspersky estimated that seventeen percent of ransomware victims never recovered their data after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to re-install the critical parts of your IT environment. Absent the availability of complete data backups, this calls for a wide range of skills, professional project management, and the ability to work non-stop until the job is complete.
For two decades, Progent has made available certified expert IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained high-level certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of experience affords Progent the capability to efficiently ascertain necessary systems and organize the surviving pieces of your Information Technology environment following a crypto-ransomware event and assemble them into an operational system.
Progent's recovery team of experts uses top notch project management systems to orchestrate the sophisticated restoration process. Progent knows the urgency of working swiftly and in concert with a client's management and IT resources to prioritize tasks and to get critical applications back on line as fast as possible.
Case Study: A Successful Crypto-Ransomware Intrusion Recovery
A customer engaged Progent after their company was attacked by the Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored criminal gangs, suspected of adopting algorithms leaked from the United States NSA organization. Ryuk targets specific companies with little or no room for operational disruption and is one of the most lucrative instances of ransomware malware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing business based in Chicago with around 500 employees. The Ryuk intrusion had frozen all company operations and manufacturing processes. Most of the client's information backups had been directly accessible at the start of the intrusion and were eventually encrypted. The client considered paying the ransom (in excess of $200,000) and wishfully thinking for the best, but in the end called Progent.
Progent worked hand in hand the customer to rapidly determine and assign priority to the essential services that had to be addressed in order to resume company functions:
- Microsoft Active Directory
- Financials/MRP
In less than 48 hours, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then charged ahead with rebuilding and storage recovery of key applications. All Microsoft Exchange Server data and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to locate local OST files (Outlook Off-Line Folder Files) on various PCs and laptops to recover mail information. A not too old off-line backup of the client's accounting/ERP software made them able to return these vital services back online for users. Although a lot of work was left to recover fully from the Ryuk attack, critical services were recovered rapidly:
Throughout the next few weeks important milestones in the recovery process were achieved in close cooperation between Progent team members and the client:
- In-house web sites were returned to operation without losing any information.
- The MailStore Server containing more than four million archived emails was brought online and accessible to users.
- CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control capabilities were completely recovered.
- A new Palo Alto Networks 850 security appliance was set up and programmed.
- Most of the user workstations were being used by staff.
Conclusion
A probable enterprise-killing disaster was evaded by hard-working experts, a wide array of IT skills, and tight teamwork. Although in post mortem the crypto-ransomware virus penetration described here would have been blocked with up-to-date cyber security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator education, and well thought out security procedures for data protection and applying software patches, the fact is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a crypto-ransomware incursion, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus blocking, remediation, and information systems disaster recovery.
Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Cleanup Expertise in Harrisburg
For ransomware system restoration consulting in the Harrisburg metro area, phone Progent at
Select Topic: