Ransomware Defense and Remediation Services Memphis

Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that presents an extinction-level threat for businesses of all sizes poorly prepared for an attack. Multiple generations of crypto-ransomware such as Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been circulating for a long time and still cause havoc. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, as well as additional as yet unnamed newcomers, not only perform encryption of online data files but also infiltrate any available system backup. Files replicated to cloud environments can also be rendered useless. In a poorly architected system, it can make automated restoration hopeless and basically knocks the network back to zero.

Getting back online programs and information after a ransomware intrusion becomes a sprint against time as the victim fights to stop the spread, remove the crypto-ransomware, and restore enterprise-critical activity. Since crypto-ransomware requires time to spread throughout a network, penetrations are frequently sprung at night, when successful attacks tend to take longer to detect. This compounds the difficulty of rapidly marshalling and organizing a capable response team.

Progent has an assortment of help services for protecting Memphis organizations from ransomware penetrations. Among these are user training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat defense to discover and disable day-zero malware attacks. Progent also can provide the services of expert crypto-ransomware recovery professionals with the talent and perseverance to reconstruct a compromised network as urgently as possible.

Progent's Ransomware Restoration Services
Soon after a ransomware event, sending the ransom in cryptocurrency does not guarantee that cyber criminals will return the keys to decrypt any of your files. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to setup from scratch the mission-critical parts of your IT environment. Without the availability of essential system backups, this calls for a broad complement of skill sets, top notch team management, and the willingness to work continuously until the task is finished.

For twenty years, Progent has offered professional IT services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded top certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial systems and ERP application software. This breadth of experience affords Progent the ability to quickly ascertain critical systems and consolidate the surviving pieces of your network environment following a crypto-ransomware attack and rebuild them into an operational network.

Progent's security group deploys state-of-the-art project management systems to coordinate the sophisticated recovery process. Progent appreciates the importance of acting swiftly and together with a customer's management and Information Technology team members to prioritize tasks and to put critical applications back on-line as soon as humanly possible.

Client Case Study: A Successful Ransomware Attack Restoration
A client hired Progent after their organization was attacked by Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored hackers, suspected of using techniques leaked from America's NSA organization. Ryuk seeks specific businesses with little or no room for disruption and is among the most lucrative instances of ransomware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business located in the Chicago metro area and has around 500 staff members. The Ryuk penetration had frozen all company operations and manufacturing capabilities. Most of the client's data backups had been online at the beginning of the attack and were eventually encrypted. The client considered paying the ransom demand (exceeding $200,000) and hoping for the best, but ultimately utilized Progent.

Progent worked hand in hand the client to rapidly identify and assign priority to the key services that had to be recovered to make it possible to restart business functions:

• Active Directory (AD)
• Email
• Financials/MRP

Within 48 hours, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then helped perform setup and storage recovery on critical applications. All Exchange data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to locate non-encrypted OST data files (Microsoft Outlook Offline Folder Files) on various workstations to recover email data. A recent off-line backup of the customer's accounting/ERP systems made them able to restore these essential programs back servicing users. Although a large amount of work needed to be completed to recover totally from the Ryuk event, critical systems were restored quickly:

During the next few weeks key milestones in the recovery process were made through tight cooperation between Progent team members and the client:

• Self-hosted web applications were brought back up with no loss of data.
• The MailStore Exchange Server exceeding 4 million archived messages was spun up and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 firewall was deployed.
• Ninety percent of the desktop computers were being used by staff.

Conclusion
A potential business-killing catastrophe was averted with hard-working experts, a wide range of knowledge, and tight teamwork. Although in hindsight the ransomware virus attack described here should have been identified and prevented with up-to-date security systems and ISO/IEC 27001 best practices, staff training, and well designed security procedures for information protection and proper patching controls, the reality remains that state-sponsored hackers from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware penetration, remember that Progent's roster of professionals has extensive experience in ransomware virus blocking, cleanup, and file disaster recovery.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Memphis
For ransomware system recovery services in the Memphis metro area, phone Progent at 800-462-8800 or go to Contact Progent.