Ransomware Prevention and Remediation Services Pittsburgh

Ransomware : Your Feared IT Nightmare
Crypto-Ransomware has become a modern cyber pandemic that represents an enterprise-level danger for organizations unprepared for an attack. Different versions of crypto-ransomware such as CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and continue to inflict harm. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, as well as additional unnamed malware, not only perform encryption of on-line critical data but also infect all available system protection mechanisms. Files replicated to off-premises disaster recovery sites can also be rendered useless. In a poorly architected environment, this can make any recovery hopeless and effectively knocks the entire system back to square one.

Getting back programs and data following a crypto-ransomware attack becomes a sprint against the clock as the victim struggles to contain the damage, eradicate the virus, and resume enterprise-critical operations. Because crypto-ransomware takes time to move laterally across a network, assaults are usually launched on weekends, when successful penetrations may take longer to discover. This multiplies the difficulty of promptly mobilizing and organizing an experienced response team.

Progent offers a range of services for protecting Pittsburgh organizations from ransomware penetrations. Among these are team training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat defense to identify and disable zero-day modern malware assaults. Progent in addition can provide the services of veteran ransomware recovery consultants with the skills and perseverance to re-deploy a breached environment as rapidly as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware invasion, sending the ransom in cryptocurrency does not ensure that cyber hackers will return the codes to decipher all your files. Kaspersky estimated that 17% of ransomware victims never recovered their information after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The fallback is to re-install the essential parts of your Information Technology environment. Absent the availability of complete system backups, this requires a broad complement of IT skills, top notch project management, and the ability to work continuously until the task is over.

For twenty years, Progent has provided certified expert Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of experience affords Progent the capability to knowledgably ascertain necessary systems and organize the remaining parts of your network environment following a ransomware penetration and assemble them into an operational system.

Progent's recovery group deploys state-of-the-art project management applications to orchestrate the complex recovery process. Progent knows the urgency of working swiftly and in unison with a customer's management and Information Technology team members to prioritize tasks and to put critical applications back on line as fast as possible.

Client Story: A Successful Ransomware Attack Response
A customer contacted Progent after their organization was penetrated by the Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean government sponsored criminal gangs, suspected of adopting strategies leaked from the United States NSA organization. Ryuk attacks specific organizations with little ability to sustain disruption and is one of the most profitable examples of ransomware viruses. Headline victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in the Chicago metro area with about 500 employees. The Ryuk intrusion had disabled all business operations and manufacturing capabilities. Most of the client's information backups had been online at the time of the attack and were destroyed. The client was taking steps for paying the ransom (exceeding $200K) and hoping for the best, but in the end utilized Progent.

Progent worked with the client to quickly assess and prioritize the key areas that had to be restored in order to continue departmental functions:

• Active Directory
• Microsoft Exchange Server
• MRP System

In less than 2 days, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then charged ahead with rebuilding and hard drive recovery on needed servers. All Exchange Server schema and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to locate intact OST files (Outlook Email Off-Line Data Files) on user workstations and laptops to recover email data. A not too old offline backup of the customer's accounting/MRP software made it possible to recover these essential services back online. Although major work remained to recover totally from the Ryuk damage, core services were returned to operations rapidly:

Throughout the next couple of weeks critical milestones in the recovery process were completed through close cooperation between Progent consultants and the customer:

• In-house web sites were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server containing more than 4 million archived messages was restored to operations and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control modules were 100 percent restored.
• A new Palo Alto 850 firewall was brought online.
• Ninety percent of the user workstations were back into operation.

Conclusion
A possible company-ending disaster was dodged due to results-oriented experts, a wide range of technical expertise, and close collaboration. Although upon completion of forensics the ransomware virus attack detailed here should have been disabled with current security technology solutions and security best practices, user education, and appropriate security procedures for data protection and keeping systems up to date with security patches, the fact is that state-sponsored hackers from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's roster of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and file restoration.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Pittsburgh
For ransomware system restoration consulting services in the Pittsburgh metro area, call Progent at 800-462-8800 or visit Contact Progent.