Ransomware Protection and Recovery Services Petaluma
Ransomware Repair: A Case Study
Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a modern cyberplague that presents an existential danger for organizations unprepared for an attack. Versions of ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for years and still inflict harm. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, plus frequent unnamed newcomers, not only perform encryption of online data but also infect all configured system restores and backups. Information synched to off-premises disaster recovery sites can also be rendered useless. In a poorly architected data protection solution, this can make automated restore operations impossible and basically knocks the network back to zero.
Recovering services and data after a crypto-ransomware outage becomes a race against time as the targeted organization tries its best to contain, remove the virus, and resume business-critical operations. Since crypto-ransomware takes time to replicate throughout a network, penetrations are often launched on weekends, when successful penetrations may take longer to discover. This multiplies the difficulty of quickly marshalling and organizing a qualified response team.
Progent provides a range of support services for protecting Petaluma organizations from ransomware penetrations. These include team training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to detect and suppress zero-day malware assaults. Progent in addition provides the services of expert ransomware recovery engineers with the track record and commitment to re-deploy a breached environment as quickly as possible.
Progent's Ransomware Recovery Help
Soon after a ransomware attack, even paying the ransom in cryptocurrency does not ensure that cyber criminals will respond with the codes to decrypt any or all of your files. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to re-install the vital elements of your Information Technology environment. Absent access to full data backups, this calls for a wide complement of skill sets, professional team management, and the willingness to work 24x7 until the recovery project is completed.
For two decades, Progent has made available certified expert Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have earned high-level certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP application software. This breadth of experience gives Progent the skills to knowledgably understand important systems and integrate the surviving components of your Information Technology system after a crypto-ransomware attack and assemble them into a functioning network.
Progent's security group deploys top notch project management applications to coordinate the complicated recovery process. Progent appreciates the urgency of acting swiftly and in concert with a customer's management and IT resources to prioritize tasks and to get key applications back on line as fast as possible.
Customer Case Study: A Successful Ransomware Incident Restoration
A customer contacted Progent after their organization was penetrated by the Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean state cybercriminals, possibly adopting algorithms leaked from the U.S. NSA organization. Ryuk goes after specific businesses with little tolerance for disruption and is among the most lucrative incarnations of ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in the Chicago metro area with around 500 staff members. The Ryuk intrusion had shut down all company operations and manufacturing processes. Most of the client's system backups had been online at the time of the intrusion and were damaged. The client was pursuing financing for paying the ransom (in excess of $200,000) and praying for good luck, but ultimately reached out to Progent.
Progent worked with the customer to rapidly identify and prioritize the essential services that needed to be addressed to make it possible to resume company operations:
- Active Directory (AD)
- Electronic Messaging
- Financials/MRP
In less than 48 hours, Progent was able to recover Active Directory services to its pre-penetration state. Progent then initiated rebuilding and hard drive recovery of essential servers. All Microsoft Exchange Server data and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to collect intact OST data files (Microsoft Outlook Offline Folder Files) on user desktop computers in order to recover email information. A recent off-line backup of the customer's accounting/MRP systems made them able to return these essential applications back online. Although major work was left to recover completely from the Ryuk event, core systems were returned to operations rapidly:
Throughout the following couple of weeks critical milestones in the restoration project were accomplished through close collaboration between Progent engineers and the client:
- In-house web applications were brought back up with no loss of information.
- The MailStore Microsoft Exchange Server exceeding four million historical messages was restored to operations and available for users.
- CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control capabilities were fully operational.
- A new Palo Alto Networks 850 firewall was deployed.
- 90% of the desktop computers were being used by staff.
Conclusion
A probable business-ending catastrophe was averted by results-oriented professionals, a wide spectrum of knowledge, and tight teamwork. Although in hindsight the crypto-ransomware penetration described here could have been shut down with modern cyber security solutions and ISO/IEC 27001 best practices, user and IT administrator training, and well designed security procedures for data backup and proper patching controls, the reality remains that state-sponsored cybercriminals from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's team of experts has extensive experience in crypto-ransomware virus defense, cleanup, and file recovery.
Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware System Recovery Consulting in Petaluma
For ransomware cleanup services in the Petaluma area, call Progent at
Select Topic: