Ransomware Protection and Recovery Solutions Brasília

Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level threat for businesses unprepared for an assault. Versions of ransomware like the Dharma, WannaCry, Locky, Syskey and MongoLock cryptoworms have been out in the wild for a long time and still inflict destruction. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus more as yet unnamed viruses, not only perform encryption of on-line information but also infect most accessible system backups. Data synchronized to cloud environments can also be corrupted. In a vulnerable system, this can make any restore operations hopeless and basically sets the entire system back to zero.

Getting back services and information following a ransomware attack becomes a sprint against time as the targeted business fights to contain the damage, eradicate the ransomware, and restore enterprise-critical operations. Since crypto-ransomware requires time to spread throughout a targeted network, penetrations are frequently sprung during nights and weekends, when attacks in many cases take more time to recognize. This compounds the difficulty of promptly marshalling and organizing a qualified mitigation team.

Progent makes available a variety of help services for securing Brasília enterprises from ransomware events. Among these are team member education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to discover and quarantine day-zero modern malware assaults. Progent also can provide the assistance of experienced ransomware recovery engineers with the track record and commitment to restore a breached network as quickly as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware event, paying the ransom in cryptocurrency does not guarantee that cyber criminals will respond with the needed codes to unencrypt all your files. Kaspersky Labs determined that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The fallback is to setup from scratch the key components of your Information Technology environment. Absent access to essential data backups, this calls for a broad range of skill sets, well-coordinated team management, and the ability to work non-stop until the task is finished.

For decades, Progent has provided certified expert IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained high-level certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have earned internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP application software. This breadth of expertise affords Progent the skills to knowledgably understand important systems and re-organize the remaining parts of your network system following a ransomware event and rebuild them into an operational network.

Progent's ransomware team of experts deploys state-of-the-art project management systems to coordinate the complicated restoration process. Progent appreciates the urgency of acting swiftly and together with a client's management and IT staff to prioritize tasks and to put critical applications back on line as fast as humanly possible.

Customer Story: A Successful Crypto-Ransomware Intrusion Restoration
A customer escalated to Progent after their organization was taken over by the Ryuk ransomware virus. Ryuk is believed to have been created by North Korean state sponsored hackers, possibly using techniques exposed from the U.S. NSA organization. Ryuk seeks specific organizations with little ability to sustain disruption and is one of the most profitable versions of ransomware viruses. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing business headquartered in Chicago with about 500 staff members. The Ryuk attack had brought down all company operations and manufacturing capabilities. Most of the client's system backups had been online at the start of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom (exceeding $200K) and praying for the best, but in the end utilized Progent.

Progent worked together with the client to rapidly get our arms around and assign priority to the most important systems that had to be recovered to make it possible to resume departmental functions:

• Windows Active Directory
• Electronic Mail
• MRP System

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-penetration state. Progent then assisted with reinstallations and hard drive recovery on the most important applications. All Exchange ties and configuration information were intact, which accelerated the restore of Exchange. Progent was able to assemble non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on user desktop computers in order to recover mail messages. A not too old offline backup of the customer's financials/MRP systems made them able to return these essential programs back online for users. Although a lot of work was left to recover completely from the Ryuk attack, core services were returned to operations rapidly:

Over the next couple of weeks critical milestones in the restoration project were accomplished through tight collaboration between Progent consultants and the client:

• In-house web sites were restored with no loss of data.
• The MailStore Server containing more than four million historical messages was restored to operations and available for users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were completely restored.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• 90% of the user desktops were functioning as before the incident.

Conclusion
A possible business-killing disaster was averted through the efforts of hard-working experts, a broad spectrum of knowledge, and tight collaboration. Although in analyzing the event afterwards the crypto-ransomware virus incident detailed here could have been identified and disabled with modern security systems and best practices, staff training, and appropriate security procedures for backup and proper patching controls, the reality remains that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incident, remember that Progent's roster of professionals has a proven track record in ransomware virus blocking, cleanup, and information systems disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Brasília
For ransomware system restoration expertise in the Brasília area, phone Progent at 800-462-8800 or see Contact Progent.