Ransomware Prevention and Cleanup Solutions Lawrence

Crypto-Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become a modern cyber pandemic that represents an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Versions of crypto-ransomware such as CryptoLocker, Fusob, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and continue to inflict harm. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with additional as yet unnamed malware, not only encrypt on-line files but also infect any available system protection mechanisms. Data replicated to the cloud can also be rendered useless. In a poorly architected environment, this can render any recovery hopeless and basically knocks the datacenter back to zero.

Getting back on-line applications and data following a ransomware event becomes a sprint against the clock as the targeted organization fights to stop the spread, clear the crypto-ransomware, and restore mission-critical operations. Because crypto-ransomware takes time to move laterally throughout a targeted network, assaults are frequently launched at night, when successful penetrations tend to take more time to identify. This multiplies the difficulty of quickly marshalling and orchestrating a qualified response team.

Progent has a range of services for protecting Lawrence businesses from ransomware events. Among these are team member training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat protection to identify and disable day-zero modern malware assaults. Progent also provides the services of experienced ransomware recovery consultants with the track record and perseverance to reconstruct a breached system as urgently as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a ransomware event, paying the ransom in cryptocurrency does not provide any assurance that distant criminals will return the needed codes to unencrypt all your information. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their files after having paid the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to setup from scratch the essential elements of your Information Technology environment. Without the availability of essential system backups, this requires a wide range of skill sets, well-coordinated team management, and the ability to work 24x7 until the recovery project is finished.

For twenty years, Progent has provided certified expert Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have garnered internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP software solutions. This breadth of expertise affords Progent the skills to knowledgably identify necessary systems and consolidate the remaining parts of your network environment following a crypto-ransomware penetration and rebuild them into a functioning system.

Progent's ransomware team of experts has top notch project management applications to coordinate the complicated restoration process. Progent knows the urgency of acting swiftly and in unison with a client's management and Information Technology team members to prioritize tasks and to put critical services back online as fast as humanly possible.

Client Case Study: A Successful Ransomware Attack Response
A business engaged Progent after their company was crashed by the Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean government sponsored hackers, suspected of using strategies exposed from the United States National Security Agency. Ryuk targets specific businesses with little or no ability to sustain disruption and is among the most lucrative iterations of ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer based in the Chicago metro area and has around 500 workers. The Ryuk event had shut down all company operations and manufacturing processes. Most of the client's backups had been online at the time of the intrusion and were encrypted. The client was taking steps for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately brought in Progent.

Progent worked with the client to rapidly assess and assign priority to the essential services that needed to be addressed to make it possible to continue company functions:

• Active Directory (AD)
• Microsoft Exchange Server
• MRP System

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-virus state. Progent then completed reinstallations and storage recovery on mission critical servers. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was able to assemble intact OST files (Outlook Email Offline Folder Files) on team PCs to recover mail information. A not too old offline backup of the businesses accounting/ERP software made them able to restore these vital programs back online for users. Although a large amount of work needed to be completed to recover completely from the Ryuk attack, core systems were recovered rapidly:

Over the next few weeks key milestones in the recovery project were made through close cooperation between Progent engineers and the customer:

• Self-hosted web applications were restored with no loss of information.
• The MailStore Server with over four million archived emails was restored to operations and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were completely functional.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Nearly all of the user desktops and notebooks were being used by staff.

Conclusion
A possible business extinction disaster was dodged by hard-working professionals, a wide spectrum of knowledge, and close teamwork. Although in analyzing the event afterwards the ransomware attack detailed here should have been stopped with modern cyber security systems and security best practices, staff education, and well thought out incident response procedures for backup and applying software patches, the fact is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's team of experts has extensive experience in ransomware virus blocking, removal, and file disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Lawrence
For ransomware system restoration expertise in the Lawrence area, call Progent at 800-462-8800 or go to Contact Progent.