Ransomware Filtering and Recovery Consulting Niterói
Ransomware Removal: An Example
Ransomware : Your Worst IT Nightmare
Ransomware has become an escalating cyber pandemic that presents an extinction-level danger for organizations poorly prepared for an assault. Multiple generations of ransomware like the Dharma, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been circulating for years and continue to cause damage. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as frequent as yet unnamed viruses, not only encrypt online data but also infect any available system backup. Files synched to cloud environments can also be rendered useless. In a poorly architected environment, it can make any recovery useless and effectively sets the entire system back to zero.
Retrieving applications and data following a ransomware attack becomes a sprint against time as the targeted business struggles to stop lateral movement, clear the ransomware, and resume mission-critical operations. Because crypto-ransomware needs time to replicate throughout a targeted network, penetrations are frequently sprung at night, when successful attacks may take more time to discover. This compounds the difficulty of quickly assembling and orchestrating a qualified mitigation team.
Progent provides a variety of services for protecting Niterói businesses from ransomware penetrations. Among these are team member training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat defense to detect and disable day-zero modern malware attacks. Progent in addition can provide the assistance of expert ransomware recovery professionals with the talent and commitment to restore a breached network as soon as possible.
Progent's Crypto-Ransomware Restoration Services
Following a crypto-ransomware invasion, paying the ransom in cryptocurrency does not guarantee that criminal gangs will provide the codes to decrypt any or all of your information. Kaspersky Labs estimated that seventeen percent of ransomware victims never restored their data even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The alternative is to re-install the mission-critical components of your Information Technology environment. Without the availability of complete data backups, this requires a broad range of IT skills, well-coordinated team management, and the willingness to work non-stop until the recovery project is completed.
For decades, Progent has made available certified expert Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned advanced industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with accounting and ERP applications. This breadth of experience provides Progent the capability to quickly understand necessary systems and re-organize the surviving components of your Information Technology system following a ransomware penetration and configure them into an operational system.
Progent's ransomware group utilizes best of breed project management tools to coordinate the sophisticated recovery process. Progent understands the importance of acting rapidly and in concert with a client's management and Information Technology staff to prioritize tasks and to put the most important services back on-line as fast as possible.
Customer Story: A Successful Crypto-Ransomware Penetration Recovery
A client hired Progent after their network system was taken over by the Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean state sponsored hackers, suspected of using strategies leaked from the U.S. NSA organization. Ryuk goes after specific organizations with limited tolerance for operational disruption and is among the most lucrative incarnations of ransomware malware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in Chicago with about 500 staff members. The Ryuk penetration had disabled all company operations and manufacturing processes. Most of the client's information backups had been on-line at the start of the intrusion and were damaged. The client was evaluating paying the ransom demand (exceeding $200K) and hoping for good luck, but ultimately brought in Progent.
Progent worked with the customer to rapidly get our arms around and assign priority to the mission critical areas that needed to be recovered in order to restart company operations:
- Windows Active Directory
- Accounting/MRP
In less than 2 days, Progent was able to recover Active Directory to its pre-attack state. Progent then accomplished rebuilding and storage recovery on needed systems. All Microsoft Exchange Server ties and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to assemble intact OST files (Outlook Offline Folder Files) on staff desktop computers and laptops to recover mail data. A recent offline backup of the customer's accounting/ERP software made them able to recover these vital services back on-line. Although significant work remained to recover fully from the Ryuk event, core systems were returned to operations rapidly:
During the next few weeks key milestones in the recovery project were made in close collaboration between Progent engineers and the customer:
- In-house web sites were brought back up without losing any data.
- The MailStore Microsoft Exchange Server with over four million historical emails was brought online and available for users.
- CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were 100 percent restored.
- A new Palo Alto 850 security appliance was deployed.
- Nearly all of the user workstations were functioning as before the incident.
Conclusion
A probable business catastrophe was evaded by dedicated professionals, a wide range of knowledge, and tight teamwork. Although upon completion of forensics the crypto-ransomware attack described here would have been identified and stopped with up-to-date security systems and best practices, staff education, and properly executed security procedures for backup and applying software patches, the fact is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware attack, remember that Progent's roster of professionals has extensive experience in crypto-ransomware virus defense, removal, and data recovery.
Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware System Recovery Services in Niterói
For ransomware system recovery expertise in the Niterói area, call Progent at
Select Topic: