Ransomware Filtering and Removal Solutions Akron

Ransomware : Your Feared IT Catastrophe
Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for businesses vulnerable to an assault. Different versions of crypto-ransomware such as Dharma, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for many years and continue to inflict destruction. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, as well as more unnamed viruses, not only perform encryption of on-line critical data but also infiltrate most available system protection mechanisms. Information replicated to cloud environments can also be ransomed. In a poorly designed system, this can render automatic restore operations impossible and basically knocks the datacenter back to square one.

Getting back services and data after a crypto-ransomware intrusion becomes a race against the clock as the targeted organization fights to stop the spread, clear the ransomware, and resume enterprise-critical operations. Due to the fact that ransomware takes time to spread across a targeted network, penetrations are frequently sprung during weekends and nights, when penetrations typically take longer to recognize. This multiplies the difficulty of rapidly mobilizing and coordinating an experienced mitigation team.

Progent provides a range of help services for securing Akron enterprises from ransomware events. Among these are team education to help identify and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to detect and quarantine day-zero modern malware attacks. Progent in addition offers the services of expert crypto-ransomware recovery professionals with the track record and perseverance to reconstruct a compromised system as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a ransomware attack, even paying the ransom demands in cryptocurrency does not guarantee that merciless criminals will provide the needed keys to unencrypt any of your information. Kaspersky ascertained that seventeen percent of ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The alternative is to setup from scratch the mission-critical components of your IT environment. Absent access to essential information backups, this requires a wide complement of skills, professional team management, and the capability to work 24x7 until the task is over.

For decades, Progent has made available certified expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have been awarded top industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial systems and ERP applications. This breadth of expertise affords Progent the capability to knowledgably determine critical systems and consolidate the surviving components of your network environment after a ransomware event and rebuild them into an operational system.

Progent's ransomware group utilizes powerful project management tools to orchestrate the complicated recovery process. Progent appreciates the urgency of acting quickly and in unison with a client's management and Information Technology resources to assign priority to tasks and to put key applications back on line as soon as possible.

Client Case Study: A Successful Ransomware Penetration Recovery
A small business hired Progent after their company was brought down by the Ryuk crypto-ransomware. Ryuk is generally considered to have been launched by North Korean government sponsored criminal gangs, suspected of using algorithms exposed from the United States NSA organization. Ryuk targets specific companies with little or no ability to sustain disruption and is among the most profitable versions of ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in the Chicago metro area and has around 500 workers. The Ryuk attack had disabled all company operations and manufacturing capabilities. The majority of the client's system backups had been online at the beginning of the attack and were damaged. The client considered paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but ultimately called Progent.

Progent worked together with the customer to rapidly get our arms around and prioritize the critical elements that had to be addressed in order to restart departmental operations:

• Active Directory (AD)
• Email
• Accounting/MRP

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-virus state. Progent then helped perform setup and storage recovery on needed systems. All Exchange schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to collect local OST data files (Outlook Offline Data Files) on user PCs to recover email messages. A recent offline backup of the customer's accounting software made it possible to restore these required services back online. Although significant work was left to recover totally from the Ryuk attack, core services were recovered rapidly:

During the next month important milestones in the restoration project were made in tight cooperation between Progent consultants and the client:

• Self-hosted web applications were restored with no loss of information.
• The MailStore Exchange Server containing more than 4 million archived messages was spun up and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/AR/Inventory Control functions were 100% functional.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Nearly all of the user PCs were back into operation.

Conclusion
A potential business catastrophe was averted by results-oriented experts, a wide range of technical expertise, and tight teamwork. Although upon completion of forensics the ransomware incident detailed here could have been disabled with current cyber security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and properly executed security procedures for data protection and keeping systems up to date with security patches, the reality is that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's roster of professionals has substantial experience in crypto-ransomware virus blocking, mitigation, and file disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Akron
For ransomware system restoration consulting services in the Akron metro area, call Progent at 800-462-8800 or go to Contact Progent.