Ransomware Prevention and Cleanup Expertise Jacksonville

Crypto-Ransomware : Your Crippling IT Disaster
Ransomware has become a too-frequent cyberplague that represents an enterprise-level threat for businesses vulnerable to an attack. Versions of ransomware like the Reveton, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for a long time and continue to inflict damage. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, as well as more as yet unnamed viruses, not only encrypt online data files but also infiltrate any configured system protection mechanisms. Information synchronized to the cloud can also be corrupted. In a poorly architected environment, this can render any restore operations useless and basically knocks the entire system back to zero.

Getting back applications and data following a ransomware intrusion becomes a race against time as the targeted business fights to contain the damage, clear the ransomware, and restore business-critical operations. Since crypto-ransomware requires time to replicate across a targeted network, assaults are frequently launched on weekends, when successful attacks in many cases take longer to notice. This compounds the difficulty of quickly marshalling and coordinating a qualified mitigation team.

Progent has a variety of help services for protecting Jacksonville organizations from ransomware events. Among these are staff education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat defense to identify and quarantine day-zero modern malware attacks. Progent also can provide the assistance of seasoned crypto-ransomware recovery professionals with the talent and perseverance to re-deploy a breached environment as quickly as possible.

Progent's Crypto-Ransomware Restoration Services
After a ransomware invasion, even paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will respond with the needed keys to decipher any or all of your information. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their files even after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to re-install the key parts of your IT environment. Absent access to essential information backups, this calls for a wide complement of skill sets, professional project management, and the capability to work non-stop until the job is complete.

For twenty years, Progent has made available expert Information Technology services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained advanced certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP software solutions. This breadth of experience affords Progent the capability to rapidly understand important systems and integrate the surviving pieces of your network environment after a ransomware event and assemble them into an operational system.

Progent's security team has best of breed project management systems to coordinate the sophisticated restoration process. Progent understands the importance of acting quickly and together with a client's management and IT staff to prioritize tasks and to put key systems back online as fast as possible.

Case Study: A Successful Ransomware Penetration Restoration
A small business hired Progent after their organization was brought down by the Ryuk ransomware virus. Ryuk is generally considered to have been launched by North Korean state cybercriminals, possibly using techniques leaked from the U.S. National Security Agency. Ryuk targets specific companies with little ability to sustain operational disruption and is one of the most lucrative versions of ransomware. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in the Chicago metro area and has around 500 employees. The Ryuk penetration had frozen all company operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the time of the attack and were encrypted. The client was actively seeking loans for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for good luck, but in the end made the decision to use Progent.

Progent worked with the client to quickly identify and prioritize the mission critical elements that had to be restored to make it possible to resume departmental operations:

• Active Directory
• E-Mail
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then accomplished reinstallations and storage recovery of mission critical applications. All Exchange ties and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to assemble intact OST data files (Outlook Off-Line Folder Files) on staff desktop computers in order to recover mail messages. A not too old offline backup of the client's manufacturing systems made it possible to restore these vital programs back on-line. Although major work remained to recover completely from the Ryuk virus, the most important systems were returned to operations rapidly:

Over the following few weeks key milestones in the recovery process were completed in tight cooperation between Progent consultants and the client:

• Self-hosted web applications were restored without losing any data.
• The MailStore Exchange Server with over four million archived messages was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/AP/AR/Inventory Control capabilities were fully functional.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Nearly all of the desktops and laptops were back into operation.

Conclusion
A probable business-killing disaster was avoided through the efforts of dedicated experts, a wide spectrum of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware incident described here could have been prevented with up-to-date cyber security solutions and NIST Cybersecurity Framework best practices, user education, and appropriate incident response procedures for data backup and applying software patches, the reality remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware incident, remember that Progent's roster of experts has extensive experience in crypto-ransomware virus defense, cleanup, and file restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Jacksonville
For ransomware cleanup expertise in the Jacksonville area, call Progent at 800-462-8800 or visit Contact Progent.