Ransomware Filtering and Restoration Expertise Phoenix

Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level danger for businesses vulnerable to an attack. Versions of crypto-ransomware like the Dharma, Fusob, Locky, SamSam and MongoLock cryptoworms have been running rampant for years and continue to cause damage. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, as well as more unnamed malware, not only encrypt on-line data files but also infect most accessible system protection. Files replicated to cloud environments can also be rendered useless. In a poorly architected system, this can make any restoration useless and effectively sets the network back to zero.

Retrieving applications and data following a ransomware attack becomes a race against time as the targeted organization fights to contain, cleanup the ransomware, and restore enterprise-critical activity. Due to the fact that ransomware takes time to move laterally throughout a targeted network, assaults are frequently sprung on weekends and holidays, when successful attacks typically take longer to identify. This multiplies the difficulty of rapidly marshalling and coordinating a capable mitigation team.

Progent provides an assortment of support services for protecting Phoenix enterprises from ransomware penetrations. These include user training to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based cyberthreat defense to detect and disable day-zero modern malware assaults. Progent also offers the assistance of veteran ransomware recovery professionals with the track record and commitment to restore a breached network as urgently as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a ransomware invasion, even paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will provide the codes to decipher any or all of your files. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their data after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The alternative is to re-install the essential elements of your IT environment. Absent access to essential information backups, this requires a wide range of skills, top notch project management, and the capability to work continuously until the job is completed.

For decades, Progent has provided professional Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned advanced industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in financial systems and ERP software solutions. This breadth of experience affords Progent the skills to efficiently understand necessary systems and re-organize the surviving parts of your IT environment following a ransomware penetration and assemble them into an operational system.

Progent's ransomware team of experts has powerful project management applications to coordinate the complicated restoration process. Progent knows the importance of working quickly and in unison with a client's management and Information Technology staff to assign priority to tasks and to put critical systems back on-line as fast as humanly possible.

Client Case Study: A Successful Ransomware Penetration Restoration
A business escalated to Progent after their network was attacked by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state hackers, possibly adopting algorithms exposed from the U.S. NSA organization. Ryuk targets specific companies with little room for operational disruption and is among the most profitable examples of crypto-ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in the Chicago metro area and has about 500 workers. The Ryuk attack had disabled all company operations and manufacturing capabilities. Most of the client's data protection had been on-line at the beginning of the intrusion and were damaged. The client was actively seeking loans for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for the best, but in the end brought in Progent.

Progent worked hand in hand the client to rapidly identify and assign priority to the most important services that needed to be recovered in order to resume company functions:

• Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to re-build Active Directory to its pre-virus state. Progent then helped perform rebuilding and hard drive recovery on essential applications. All Exchange schema and attributes were intact, which facilitated the restore of Exchange. Progent was also able to find intact OST files (Microsoft Outlook Off-Line Data Files) on staff workstations and laptops to recover mail messages. A recent off-line backup of the client's financials/MRP software made them able to return these required services back available to users. Although major work needed to be completed to recover completely from the Ryuk damage, the most important systems were returned to operations quickly:

During the next few weeks critical milestones in the restoration project were achieved in tight collaboration between Progent consultants and the customer:

• In-house web applications were brought back up with no loss of data.
• The MailStore Exchange Server exceeding 4 million archived messages was spun up and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/AR/Inventory capabilities were 100% restored.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Ninety percent of the user desktops were fully operational.

Conclusion
A possible business-ending catastrophe was evaded by results-oriented professionals, a broad spectrum of IT skills, and tight teamwork. Although in analyzing the event afterwards the ransomware virus incident detailed here would have been blocked with up-to-date cyber security systems and recognized best practices, user education, and well thought out incident response procedures for data protection and applying software patches, the fact remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware penetration, remember that Progent's team of professionals has extensive experience in ransomware virus defense, removal, and file disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Phoenix
For ransomware system restoration services in the Phoenix metro area, phone Progent at 800-462-8800 or see Contact Progent.