Ransomware Filtering and Recovery Expertise Manchester

Crypto-Ransomware : Your Worst IT Nightmare
Crypto-Ransomware has become a too-frequent cyber pandemic that represents an extinction-level danger for businesses of all sizes poorly prepared for an attack. Versions of ransomware like the CryptoLocker, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for many years and continue to inflict harm. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with frequent as yet unnamed malware, not only perform encryption of on-line information but also infiltrate all available system protection mechanisms. Data replicated to the cloud can also be corrupted. In a vulnerable data protection solution, it can render automatic recovery hopeless and effectively knocks the datacenter back to zero.

Getting back on-line programs and data after a ransomware event becomes a sprint against the clock as the victim struggles to stop lateral movement, remove the ransomware, and restore enterprise-critical operations. Since crypto-ransomware needs time to replicate across a network, penetrations are frequently launched during weekends and nights, when attacks in many cases take longer to recognize. This compounds the difficulty of quickly mobilizing and coordinating a qualified response team.

Progent provides an assortment of solutions for protecting Manchester organizations from ransomware attacks. Among these are team member training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to detect and quarantine zero-day modern malware attacks. Progent also provides the assistance of seasoned ransomware recovery professionals with the talent and perseverance to re-deploy a breached network as soon as possible.

Progent's Crypto-Ransomware Recovery Help
Following a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not ensure that cyber hackers will provide the codes to decrypt all your data. Kaspersky determined that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to setup from scratch the mission-critical elements of your IT environment. Without access to full information backups, this requires a broad range of IT skills, top notch team management, and the capability to work continuously until the task is finished.

For two decades, Progent has provided certified expert IT services for companies throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned high-level certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial systems and ERP application software. This breadth of experience affords Progent the skills to quickly understand necessary systems and integrate the surviving pieces of your Information Technology environment following a ransomware penetration and rebuild them into an operational network.

Progent's recovery team of experts utilizes top notch project management applications to coordinate the sophisticated recovery process. Progent appreciates the importance of working quickly and in concert with a customer's management and IT resources to prioritize tasks and to get key services back on line as fast as humanly possible.

Client Case Study: A Successful Ransomware Incident Restoration
A customer engaged Progent after their organization was taken over by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored cybercriminals, suspected of using strategies exposed from the U.S. NSA organization. Ryuk attacks specific companies with little room for operational disruption and is among the most profitable iterations of ransomware viruses. Major targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in the Chicago metro area and has around 500 workers. The Ryuk event had paralyzed all company operations and manufacturing processes. Most of the client's system backups had been on-line at the start of the attack and were damaged. The client was taking steps for paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but in the end engaged Progent.

Progent worked together with the client to rapidly understand and prioritize the critical systems that needed to be addressed in order to resume company functions:

• Active Directory
• Microsoft Exchange Email
• MRP System

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-attack state. Progent then accomplished rebuilding and hard drive recovery of key systems. All Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to assemble local OST data files (Outlook Email Offline Folder Files) on team PCs to recover email data. A recent offline backup of the client's accounting/ERP systems made them able to recover these essential applications back online. Although significant work was left to recover completely from the Ryuk damage, the most important systems were restored quickly:

Throughout the following few weeks key milestones in the recovery process were made through tight cooperation between Progent engineers and the client:

• Self-hosted web sites were brought back up without losing any information.
• The MailStore Exchange Server with over 4 million archived emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control capabilities were 100 percent recovered.
• A new Palo Alto Networks 850 security appliance was brought online.
• Nearly all of the user PCs were functioning as before the incident.

Conclusion
A possible business-ending disaster was avoided by hard-working experts, a broad array of subject matter expertise, and tight teamwork. Although in retrospect the ransomware incident detailed here should have been shut down with modern cyber security technology and security best practices, team training, and well thought out incident response procedures for data protection and proper patching controls, the reality is that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware virus, remember that Progent's roster of experts has extensive experience in ransomware virus blocking, mitigation, and information systems disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Manchester
For ransomware system recovery consulting in the Manchester metro area, call Progent at 800-462-8800 or see Contact Progent.