Ransomware Protection and Removal Expertise Sioux Falls

Ransomware : Your Worst IT Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level danger for businesses unprepared for an attack. Versions of ransomware like the Dharma, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for many years and still inflict damage. More recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus additional unnamed malware, not only perform encryption of online information but also infiltrate most available system restores and backups. Files synched to the cloud can also be rendered useless. In a poorly architected environment, this can render any restore operations hopeless and basically sets the entire system back to zero.

Restoring applications and data following a ransomware event becomes a sprint against time as the targeted business struggles to stop the spread, eradicate the virus, and restore mission-critical activity. Since crypto-ransomware requires time to replicate across a targeted network, attacks are usually launched on weekends, when successful penetrations tend to take longer to detect. This compounds the difficulty of rapidly assembling and orchestrating a qualified mitigation team.

Progent offers a range of solutions for securing Sioux Falls organizations from ransomware events. These include team training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat defense to identify and quarantine zero-day modern malware attacks. Progent also can provide the assistance of seasoned crypto-ransomware recovery professionals with the track record and perseverance to re-deploy a compromised environment as quickly as possible.

Progent's Ransomware Restoration Support Services
Following a ransomware event, paying the ransom demands in cryptocurrency does not ensure that criminal gangs will respond with the needed keys to unencrypt any of your data. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to re-install the key components of your Information Technology environment. Without the availability of complete information backups, this requires a wide range of IT skills, professional team management, and the ability to work non-stop until the task is completed.

For decades, Progent has made available expert Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial management and ERP software solutions. This breadth of expertise provides Progent the skills to knowledgably identify critical systems and integrate the remaining parts of your Information Technology environment after a crypto-ransomware penetration and rebuild them into a functioning system.

Progent's security team deploys state-of-the-art project management tools to coordinate the sophisticated restoration process. Progent understands the importance of working rapidly and in concert with a customer's management and Information Technology team members to assign priority to tasks and to get key systems back on-line as soon as humanly possible.

Case Study: A Successful Ransomware Intrusion Restoration
A customer escalated to Progent after their network was penetrated by Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean government sponsored cybercriminals, suspected of using techniques leaked from America's National Security Agency. Ryuk attacks specific businesses with limited ability to sustain operational disruption and is among the most profitable examples of ransomware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturer based in the Chicago metro area with around 500 workers. The Ryuk event had paralyzed all essential operations and manufacturing capabilities. Most of the client's information backups had been directly accessible at the time of the attack and were destroyed. The client was taking steps for paying the ransom (more than $200K) and wishfully thinking for good luck, but in the end utilized Progent.

Progent worked hand in hand the client to rapidly get our arms around and assign priority to the essential applications that had to be restored to make it possible to restart departmental functions:

• Windows Active Directory
• Electronic Messaging
• Financials/MRP

Within 48 hours, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then helped perform setup and storage recovery of essential applications. All Microsoft Exchange Server ties and attributes were intact, which facilitated the rebuild of Exchange. Progent was able to locate intact OST files (Outlook Offline Folder Files) on team workstations in order to recover mail messages. A recent off-line backup of the customer's financials/ERP systems made it possible to restore these required applications back online for users. Although significant work still had to be done to recover totally from the Ryuk event, core services were returned to operations quickly:

Throughout the next month critical milestones in the restoration process were achieved through tight cooperation between Progent consultants and the customer:

• Internal web sites were returned to operation without losing any information.
• The MailStore Exchange Server containing more than four million archived messages was brought on-line and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/AR/Inventory Control modules were 100 percent operational.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• 90% of the desktops and laptops were functioning as before the incident.

Conclusion
A possible business-ending catastrophe was averted with top-tier professionals, a wide array of knowledge, and close teamwork. Although upon completion of forensics the crypto-ransomware incident detailed here should have been identified and stopped with current cyber security technology solutions and recognized best practices, staff training, and well thought out security procedures for information protection and keeping systems up to date with security patches, the reality remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware penetration, feel confident that Progent's roster of experts has extensive experience in ransomware virus blocking, removal, and information systems disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Sioux Falls
For ransomware system restoration expertise in the Sioux Falls area, call Progent at 800-462-8800 or visit Contact Progent.