Ransomware Filtering and Restoration Solutions Fargo

Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that presents an enterprise-level threat for businesses of all sizes unprepared for an assault. Versions of ransomware such as Reveton, Fusob, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for years and still inflict damage. Newer versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, along with daily unnamed viruses, not only encrypt on-line critical data but also infiltrate all configured system protection mechanisms. Data replicated to the cloud can also be corrupted. In a poorly designed environment, it can make automated recovery hopeless and effectively sets the datacenter back to zero.

Getting back on-line applications and information following a crypto-ransomware attack becomes a race against the clock as the targeted organization struggles to stop the spread, eradicate the ransomware, and restore enterprise-critical activity. Because crypto-ransomware requires time to spread throughout a targeted network, attacks are frequently launched on weekends, when penetrations in many cases take more time to detect. This compounds the difficulty of promptly assembling and orchestrating a qualified response team.

Progent provides a variety of services for protecting Fargo enterprises from ransomware events. These include user training to help identify and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to identify and suppress zero-day malware attacks. Progent also can provide the assistance of seasoned ransomware recovery professionals with the track record and commitment to rebuild a breached system as rapidly as possible.

Progent's Crypto-Ransomware Recovery Support Services
After a ransomware invasion, paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will respond with the keys to unencrypt all your files. Kaspersky Labs estimated that seventeen percent of ransomware victims never restored their files after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to piece back together the essential components of your Information Technology environment. Absent access to full system backups, this calls for a wide range of skills, professional team management, and the willingness to work non-stop until the recovery project is done.

For twenty years, Progent has provided certified expert Information Technology services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have been awarded high-level industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial management and ERP software solutions. This breadth of expertise affords Progent the capability to rapidly ascertain important systems and re-organize the remaining components of your Information Technology environment after a ransomware event and configure them into a functioning system.

Progent's ransomware team uses top notch project management tools to coordinate the sophisticated restoration process. Progent understands the importance of working rapidly and together with a client's management and Information Technology resources to assign priority to tasks and to put the most important systems back on-line as soon as humanly possible.

Business Case Study: A Successful Ransomware Intrusion Restoration
A customer sought out Progent after their network was attacked by Ryuk crypto-ransomware. Ryuk is believed to have been created by North Korean state hackers, possibly adopting strategies leaked from the United States National Security Agency. Ryuk seeks specific organizations with little or no ability to sustain operational disruption and is among the most profitable versions of crypto-ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business based in the Chicago metro area with about 500 staff members. The Ryuk attack had disabled all company operations and manufacturing capabilities. Most of the client's system backups had been on-line at the beginning of the attack and were eventually encrypted. The client considered paying the ransom demand (in excess of $200K) and praying for the best, but in the end called Progent.

Progent worked hand in hand the customer to rapidly assess and assign priority to the most important services that had to be restored to make it possible to restart company operations:

• Active Directory
• Exchange Server
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then assisted with rebuilding and hard drive recovery of needed systems. All Microsoft Exchange Server data and attributes were intact, which accelerated the restore of Exchange. Progent was able to find intact OST data files (Outlook Off-Line Data Files) on user PCs and laptops in order to recover email messages. A not too old off-line backup of the client's financials/ERP systems made them able to restore these required programs back available to users. Although a large amount of work needed to be completed to recover fully from the Ryuk damage, core systems were restored rapidly:

Throughout the next month key milestones in the restoration process were accomplished in close collaboration between Progent engineers and the client:

• Self-hosted web sites were restored with no loss of data.
• The MailStore Exchange Server exceeding 4 million archived emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory capabilities were fully restored.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• 90% of the user desktops and notebooks were fully operational.

Conclusion
A possible enterprise-killing catastrophe was averted due to hard-working professionals, a broad range of knowledge, and tight collaboration. Although upon completion of forensics the ransomware virus incident detailed here should have been identified and stopped with up-to-date cyber security technology and NIST Cybersecurity Framework best practices, staff education, and appropriate security procedures for information protection and proper patching controls, the reality remains that government-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's team of professionals has extensive experience in ransomware virus defense, remediation, and information systems recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Fargo
For ransomware cleanup services in the Fargo metro area, call Progent at 800-462-8800 or go to Contact Progent.