Ransomware Protection and Restoration Services Lexington-Fayette

Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for businesses poorly prepared for an assault. Versions of crypto-ransomware such as CryptoLocker, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been around for a long time and still cause damage. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as frequent unnamed viruses, not only encrypt online files but also infect all available system backups. Files replicated to off-premises disaster recovery sites can also be rendered useless. In a vulnerable environment, this can make automated recovery hopeless and effectively knocks the entire system back to square one.

Getting back on-line programs and information following a ransomware outage becomes a sprint against time as the victim fights to stop lateral movement, eradicate the virus, and resume enterprise-critical operations. Because ransomware takes time to replicate throughout a network, assaults are frequently launched on weekends, when successful attacks tend to take longer to notice. This multiplies the difficulty of promptly marshalling and coordinating a knowledgeable response team.

Progent makes available an assortment of support services for protecting Lexington-Fayette organizations from crypto-ransomware attacks. These include team training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to discover and suppress zero-day modern malware attacks. Progent in addition can provide the services of veteran crypto-ransomware recovery engineers with the track record and perseverance to restore a breached network as quickly as possible.

Progent's Ransomware Recovery Help
After a ransomware event, paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will return the keys to unencrypt any of your files. Kaspersky Labs determined that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to re-install the mission-critical parts of your Information Technology environment. Absent the availability of complete information backups, this calls for a broad complement of skills, top notch team management, and the capability to work non-stop until the task is done.

For twenty years, Progent has provided professional Information Technology services for companies throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained advanced industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of experience affords Progent the capability to efficiently identify necessary systems and consolidate the surviving parts of your Information Technology system after a crypto-ransomware penetration and assemble them into an operational network.

Progent's security team of experts utilizes best of breed project management systems to coordinate the sophisticated recovery process. Progent appreciates the urgency of acting swiftly and in unison with a customer's management and IT staff to assign priority to tasks and to get critical applications back on line as soon as possible.

Business Case Study: A Successful Ransomware Penetration Response
A small business escalated to Progent after their network was penetrated by the Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state cybercriminals, possibly using technology leaked from the United States NSA organization. Ryuk attacks specific businesses with little tolerance for operational disruption and is one of the most lucrative versions of ransomware malware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business headquartered in the Chicago metro area with around 500 staff members. The Ryuk attack had shut down all company operations and manufacturing processes. Most of the client's information backups had been online at the beginning of the intrusion and were destroyed. The client was pursuing financing for paying the ransom (exceeding $200K) and praying for good luck, but ultimately brought in Progent.

Progent worked with the customer to quickly identify and prioritize the key systems that needed to be restored in order to restart business operations:

• Windows Active Directory
• Microsoft Exchange Server
• Accounting/MRP

In less than two days, Progent was able to recover Active Directory services to its pre-penetration state. Progent then helped perform setup and storage recovery of key servers. All Exchange ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to locate intact OST data files (Microsoft Outlook Offline Data Files) on various workstations to recover email data. A not too old off-line backup of the client's financials/ERP software made them able to return these essential applications back available to users. Although major work needed to be completed to recover totally from the Ryuk attack, the most important services were returned to operations quickly:

Over the next few weeks key milestones in the restoration project were achieved in close cooperation between Progent team members and the customer:

• In-house web sites were brought back up without losing any data.
• The MailStore Exchange Server with over 4 million archived messages was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 security appliance was brought on-line.
• Most of the user workstations were fully operational.

Conclusion
A potential company-ending disaster was evaded through the efforts of hard-working professionals, a broad spectrum of IT skills, and tight teamwork. Although in hindsight the ransomware incident described here could have been identified and disabled with advanced cyber security technology and security best practices, staff education, and appropriate incident response procedures for information backup and proper patching controls, the fact is that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, feel confident that Progent's team of experts has substantial experience in ransomware virus blocking, remediation, and information systems recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Lexington-Fayette
For ransomware system recovery services in the Lexington-Fayette area, call Progent at 800-462-8800 or go to Contact Progent.