Ransomware Filtering and Cleanup Solutions Joinville

Crypto-Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an existential danger for businesses unprepared for an attack. Versions of crypto-ransomware such as Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been running rampant for many years and continue to cause destruction. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, along with additional as yet unnamed malware, not only encrypt on-line critical data but also infect many available system restores and backups. Files synchronized to cloud environments can also be encrypted. In a poorly architected environment, this can make automatic restore operations impossible and basically knocks the datacenter back to zero.

Restoring programs and data after a ransomware event becomes a race against time as the victim tries its best to stop lateral movement, eradicate the crypto-ransomware, and resume mission-critical activity. Due to the fact that crypto-ransomware needs time to move laterally throughout a targeted network, penetrations are usually launched at night, when successful penetrations may take longer to notice. This multiplies the difficulty of promptly marshalling and orchestrating a knowledgeable response team.

Progent has a range of support services for protecting Joinville enterprises from ransomware events. Among these are team education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to discover and extinguish day-zero modern malware attacks. Progent in addition can provide the services of veteran ransomware recovery professionals with the skills and commitment to restore a compromised environment as soon as possible.

Progent's Ransomware Recovery Support Services
After a crypto-ransomware attack, paying the ransom in cryptocurrency does not guarantee that criminal gangs will respond with the keys to unencrypt any of your files. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The other path is to re-install the mission-critical components of your Information Technology environment. Without the availability of complete data backups, this requires a broad complement of skill sets, professional team management, and the capability to work non-stop until the recovery project is completed.

For two decades, Progent has offered professional Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP software solutions. This breadth of experience gives Progent the ability to rapidly identify necessary systems and organize the surviving parts of your network environment following a ransomware event and rebuild them into an operational network.

Progent's recovery team utilizes best of breed project management tools to orchestrate the complex recovery process. Progent understands the urgency of working quickly and in unison with a client's management and IT resources to assign priority to tasks and to put key systems back online as fast as humanly possible.

Business Case Study: A Successful Ransomware Penetration Restoration
A client escalated to Progent after their network system was brought down by Ryuk crypto-ransomware. Ryuk is believed to have been created by North Korean state criminal gangs, suspected of using algorithms exposed from the U.S. NSA organization. Ryuk goes after specific businesses with limited tolerance for operational disruption and is among the most lucrative instances of ransomware viruses. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in Chicago and has around 500 workers. The Ryuk event had disabled all business operations and manufacturing processes. The majority of the client's data backups had been online at the start of the intrusion and were damaged. The client was evaluating paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for good luck, but ultimately made the decision to use Progent.

Progent worked with the client to quickly assess and assign priority to the mission critical services that needed to be recovered to make it possible to resume company operations:

• Active Directory
• Microsoft Exchange Server
• Accounting/MRP

In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then initiated setup and storage recovery on essential applications. All Exchange data and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to find local OST files (Outlook Offline Data Files) on team PCs and laptops in order to recover email messages. A not too old off-line backup of the businesses accounting/ERP systems made it possible to recover these vital applications back servicing users. Although major work was left to recover fully from the Ryuk attack, core services were recovered quickly:

Throughout the next few weeks important milestones in the recovery project were made in tight cooperation between Progent team members and the client:

• Internal web applications were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server exceeding four million historical messages was brought online and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory modules were fully recovered.
• A new Palo Alto Networks 850 firewall was deployed.
• 90% of the user desktops and notebooks were functioning as before the incident.

Conclusion
A potential enterprise-killing catastrophe was dodged due to results-oriented professionals, a wide array of IT skills, and tight teamwork. Although in analyzing the event afterwards the ransomware virus incident described here could have been prevented with advanced cyber security technology and NIST Cybersecurity Framework best practices, user education, and properly executed security procedures for information protection and applying software patches, the reality remains that government-sponsored cybercriminals from Russia, China and elsewhere are relentless and will continue. If you do get hit by a ransomware attack, feel confident that Progent's roster of professionals has substantial experience in ransomware virus blocking, remediation, and data disaster recovery.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Joinville
For ransomware system recovery consulting in the Joinville metro area, call Progent at 800-462-8800 or see Contact Progent.