Ransomware Filtering and Removal Solutions Anchorage

Ransomware : Your Worst Information Technology Disaster
Ransomware has become an escalating cyber pandemic that presents an enterprise-level threat for businesses of all sizes vulnerable to an assault. Multiple generations of crypto-ransomware such as Reveton, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for years and still inflict destruction. Newer variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with additional as yet unnamed viruses, not only encrypt online information but also infect many configured system protection. Data synched to cloud environments can also be ransomed. In a vulnerable environment, this can make automatic recovery impossible and effectively knocks the datacenter back to square one.

Getting back online services and data after a ransomware intrusion becomes a race against time as the victim tries its best to stop lateral movement, clear the crypto-ransomware, and resume business-critical activity. Since crypto-ransomware requires time to move laterally across a network, attacks are frequently sprung at night, when attacks typically take longer to uncover. This multiplies the difficulty of quickly marshalling and orchestrating a qualified mitigation team.

Progent provides an assortment of help services for protecting Anchorage organizations from ransomware attacks. Among these are user education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to identify and suppress zero-day modern malware assaults. Progent in addition offers the assistance of seasoned ransomware recovery consultants with the talent and commitment to rebuild a compromised environment as rapidly as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a ransomware penetration, sending the ransom demands in cryptocurrency does not provide any assurance that distant criminals will respond with the needed codes to decrypt any of your information. Kaspersky determined that 17% of ransomware victims never restored their files after having paid the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to piece back together the critical components of your IT environment. Without access to full information backups, this calls for a wide complement of IT skills, top notch team management, and the ability to work continuously until the recovery project is over.

For two decades, Progent has provided professional IT services for businesses across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have earned top certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP applications. This breadth of experience provides Progent the skills to rapidly identify critical systems and consolidate the surviving parts of your computer network system following a crypto-ransomware event and configure them into a functioning network.

Progent's ransomware team deploys powerful project management applications to orchestrate the sophisticated restoration process. Progent appreciates the importance of acting swiftly and together with a client's management and IT resources to prioritize tasks and to put critical applications back on-line as fast as humanly possible.

Customer Case Study: A Successful Ransomware Incident Response
A customer contacted Progent after their company was attacked by the Ryuk ransomware virus. Ryuk is generally considered to have been launched by North Korean state sponsored hackers, possibly using algorithms exposed from the U.S. NSA organization. Ryuk targets specific organizations with limited ability to sustain disruption and is among the most lucrative instances of crypto-ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing business located in Chicago and has about 500 staff members. The Ryuk attack had brought down all company operations and manufacturing processes. Most of the client's information backups had been on-line at the beginning of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but in the end called Progent.

Progent worked hand in hand the client to rapidly determine and prioritize the essential systems that needed to be addressed in order to continue company functions:

• Microsoft Active Directory
• Microsoft Exchange Email
• MRP System

In less than two days, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then helped perform rebuilding and storage recovery of critical servers. All Microsoft Exchange Server data and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to collect local OST files (Outlook Offline Data Files) on user workstations to recover mail messages. A not too old off-line backup of the businesses accounting/ERP systems made it possible to return these essential programs back available to users. Although significant work was left to recover fully from the Ryuk event, core systems were recovered quickly:

Throughout the next couple of weeks important milestones in the restoration project were made in close collaboration between Progent engineers and the client:

• Self-hosted web applications were returned to operation without losing any information.
• The MailStore Exchange Server with over four million historical emails was spun up and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory modules were 100 percent recovered.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Ninety percent of the user workstations were functioning as before the incident.

Conclusion
A possible business-killing catastrophe was averted by dedicated experts, a wide spectrum of IT skills, and close teamwork. Although in analyzing the event afterwards the ransomware virus incident detailed here could have been identified and stopped with modern cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and well thought out incident response procedures for data backup and keeping systems up to date with security patches, the fact remains that government-sponsored cybercriminals from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware attack, feel confident that Progent's roster of professionals has a proven track record in crypto-ransomware virus defense, mitigation, and information systems restoration.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Anchorage
For ransomware system restoration consulting in the Anchorage metro area, call Progent at 800-462-8800 or go to Contact Progent.