Ransomware Protection and Remediation Services Edmonton

Crypto-Ransomware : Your Feared IT Nightmare
Ransomware has become a modern cyberplague that presents an extinction-level danger for organizations vulnerable to an attack. Versions of crypto-ransomware such as Dharma, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and continue to inflict harm. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, along with daily as yet unnamed viruses, not only perform encryption of online data files but also infect most accessible system restores and backups. Information replicated to off-premises disaster recovery sites can also be rendered useless. In a poorly designed system, it can make any restore operations hopeless and basically sets the datacenter back to square one.

Getting back services and data following a ransomware event becomes a sprint against the clock as the targeted organization struggles to contain the damage, cleanup the virus, and resume enterprise-critical activity. Due to the fact that crypto-ransomware takes time to spread throughout a network, penetrations are frequently launched during weekends and nights, when penetrations may take more time to recognize. This multiplies the difficulty of quickly mobilizing and organizing a qualified response team.

Progent makes available a range of solutions for securing Edmonton organizations from ransomware attacks. Among these are user education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to identify and suppress day-zero malware attacks. Progent also provides the assistance of seasoned crypto-ransomware recovery consultants with the talent and commitment to re-deploy a compromised system as quickly as possible.

Progent's Ransomware Restoration Services
After a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will provide the needed keys to unencrypt all your information. Kaspersky Labs estimated that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The fallback is to re-install the key components of your IT environment. Without access to complete data backups, this calls for a wide complement of IT skills, top notch team management, and the ability to work continuously until the recovery project is completed.

For two decades, Progent has made available expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded top certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP application software. This breadth of expertise provides Progent the ability to efficiently ascertain critical systems and organize the surviving components of your Information Technology environment following a ransomware penetration and configure them into a functioning network.

Progent's ransomware group uses powerful project management applications to coordinate the complex restoration process. Progent appreciates the urgency of acting quickly and together with a customer's management and Information Technology resources to assign priority to tasks and to put critical systems back on line as fast as possible.

Business Case Study: A Successful Crypto-Ransomware Penetration Response
A customer engaged Progent after their organization was crashed by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean government sponsored hackers, suspected of adopting technology exposed from America's National Security Agency. Ryuk goes after specific businesses with little room for operational disruption and is among the most profitable incarnations of ransomware. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business based in Chicago and has about 500 employees. The Ryuk penetration had shut down all business operations and manufacturing capabilities. The majority of the client's backups had been online at the beginning of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and praying for good luck, but in the end called Progent.

Progent worked with the client to quickly get our arms around and prioritize the mission critical applications that had to be restored to make it possible to continue departmental operations:

• Active Directory
• Microsoft Exchange
• Financials/MRP

Within 48 hours, Progent was able to restore Active Directory services to its pre-attack state. Progent then completed setup and hard drive recovery of essential servers. All Exchange Server schema and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to collect local OST data files (Outlook Email Offline Folder Files) on team PCs in order to recover mail messages. A recent off-line backup of the client's financials/ERP software made it possible to recover these essential programs back online. Although major work needed to be completed to recover totally from the Ryuk attack, critical services were recovered rapidly:

Over the following month key milestones in the recovery process were made through tight cooperation between Progent engineers and the customer:

• Internal web applications were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables/Inventory functions were 100% recovered.
• A new Palo Alto 850 security appliance was set up.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A possible business-ending disaster was evaded due to hard-working professionals, a broad array of subject matter expertise, and tight teamwork. Although in retrospect the ransomware attack described here should have been stopped with modern security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and properly executed incident response procedures for data backup and proper patching controls, the fact is that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's team of experts has extensive experience in crypto-ransomware virus blocking, mitigation, and file restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Edmonton
For ransomware recovery consulting services in the Edmonton metro area, call Progent at 800-462-8800 or go to Contact Progent.