Ransomware Prevention and Recovery Consulting Brighton

Crypto-Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become a too-frequent cyberplague that represents an extinction-level threat for businesses of all sizes unprepared for an assault. Different iterations of ransomware such as Reveton, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for many years and still inflict harm. Modern strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as more unnamed viruses, not only encrypt online critical data but also infiltrate all available system protection. Information synchronized to cloud environments can also be rendered useless. In a poorly designed data protection solution, it can render automatic restore operations hopeless and basically knocks the network back to square one.

Getting back applications and information following a ransomware event becomes a sprint against the clock as the targeted organization fights to stop lateral movement, eradicate the ransomware, and restore business-critical operations. Because ransomware needs time to move laterally across a targeted network, penetrations are often sprung on weekends, when penetrations in many cases take more time to identify. This multiplies the difficulty of quickly assembling and coordinating a knowledgeable response team.

Progent provides a range of services for protecting Brighton enterprises from ransomware penetrations. Among these are staff training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based threat protection to detect and extinguish day-zero modern malware assaults. Progent also provides the assistance of seasoned ransomware recovery professionals with the skills and perseverance to reconstruct a breached environment as quickly as possible.

Progent's Ransomware Restoration Help
After a ransomware attack, sending the ransom demands in cryptocurrency does not guarantee that criminal gangs will respond with the codes to decrypt all your information. Kaspersky determined that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to re-install the vital elements of your IT environment. Without access to full information backups, this requires a wide range of IT skills, professional project management, and the capability to work continuously until the job is done.

For decades, Progent has offered certified expert Information Technology services for businesses throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have earned top certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP software solutions. This breadth of expertise gives Progent the capability to knowledgably understand necessary systems and organize the surviving pieces of your network system after a ransomware penetration and rebuild them into a functioning network.

Progent's security group has best of breed project management applications to coordinate the sophisticated restoration process. Progent appreciates the urgency of working swiftly and in unison with a client's management and IT resources to assign priority to tasks and to put the most important services back on-line as fast as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Attack Response
A business engaged Progent after their network system was attacked by Ryuk crypto-ransomware. Ryuk is believed to have been developed by North Korean state sponsored criminal gangs, possibly using algorithms leaked from America's National Security Agency. Ryuk attacks specific organizations with limited room for disruption and is one of the most profitable incarnations of ransomware viruses. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business headquartered in Chicago with about 500 employees. The Ryuk attack had frozen all company operations and manufacturing capabilities. The majority of the client's system backups had been online at the beginning of the intrusion and were destroyed. The client was taking steps for paying the ransom (more than two hundred thousand dollars) and wishfully thinking for good luck, but in the end utilized Progent.

Progent worked hand in hand the client to quickly get our arms around and prioritize the key areas that needed to be addressed in order to continue company functions:

• Active Directory (AD)
• E-Mail
• Accounting and Manufacturing Software

In less than two days, Progent was able to restore Windows Active Directory to its pre-attack state. Progent then accomplished rebuilding and storage recovery on needed servers. All Microsoft Exchange Server schema and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Outlook Email Offline Data Files) on staff desktop computers and laptops in order to recover mail information. A not too old off-line backup of the businesses financials/ERP software made them able to recover these essential services back servicing users. Although a lot of work still had to be done to recover totally from the Ryuk virus, core services were recovered quickly:

Over the next month critical milestones in the restoration process were accomplished in tight collaboration between Progent consultants and the client:

• Self-hosted web sites were returned to operation without losing any data.
• The MailStore Exchange Server with over four million historical messages was spun up and available for users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory modules were 100 percent operational.
• A new Palo Alto 850 security appliance was set up.
• Ninety percent of the desktop computers were operational.

Conclusion
A likely business-killing catastrophe was evaded with results-oriented professionals, a broad range of IT skills, and tight collaboration. Although upon completion of forensics the crypto-ransomware virus attack described here would have been stopped with modern cyber security solutions and security best practices, user and IT administrator education, and properly executed security procedures for backup and proper patching controls, the fact remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware incursion, remember that Progent's roster of professionals has a proven track record in ransomware virus blocking, mitigation, and information systems disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Brighton
For ransomware system recovery services in the Brighton area, phone Progent at 800-462-8800 or see Contact Progent.