Ransomware Prevention and Restoration Expertise Mission Viejo
Ransomware Recovery: An Example
Crypto-Ransomware : Your Worst Information Technology Catastrophe
Crypto-Ransomware has become a modern cyberplague that represents an existential threat for businesses of all sizes poorly prepared for an assault. Multiple generations of crypto-ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for years and continue to inflict damage. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with frequent as yet unnamed malware, not only encrypt online critical data but also infiltrate many configured system protection mechanisms. Files replicated to the cloud can also be corrupted. In a poorly architected data protection solution, this can render any restoration useless and basically knocks the entire system back to zero.
Getting back on-line programs and information following a ransomware event becomes a sprint against time as the victim tries its best to contain the damage, eradicate the virus, and resume business-critical operations. Because crypto-ransomware requires time to replicate throughout a network, assaults are usually launched at night, when penetrations tend to take more time to notice. This multiplies the difficulty of promptly marshalling and organizing a capable mitigation team.
Progent provides a range of support services for protecting Mission Viejo enterprises from crypto-ransomware attacks. Among these are user training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat protection to detect and quarantine day-zero malware assaults. Progent in addition offers the services of expert ransomware recovery professionals with the track record and perseverance to re-deploy a breached system as soon as possible.
Progent's Ransomware Restoration Services
Subsequent to a crypto-ransomware attack, even paying the ransom in cryptocurrency does not guarantee that distant criminals will return the needed keys to decipher any or all of your information. Kaspersky ascertained that seventeen percent of ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to setup from scratch the key components of your IT environment. Absent the availability of complete data backups, this calls for a broad range of IT skills, top notch project management, and the willingness to work 24x7 until the recovery project is over.
For two decades, Progent has provided certified expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned high-level certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of experience gives Progent the capability to rapidly determine necessary systems and integrate the surviving parts of your IT system after a crypto-ransomware event and rebuild them into an operational network.
Progent's ransomware group uses powerful project management tools to coordinate the complicated restoration process. Progent appreciates the importance of acting rapidly and in concert with a client's management and IT resources to prioritize tasks and to put essential services back on line as soon as possible.
Business Case Study: A Successful Crypto-Ransomware Incident Response
A business hired Progent after their organization was attacked by the Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean government sponsored criminal gangs, suspected of using strategies leaked from America's NSA organization. Ryuk attacks specific businesses with limited room for operational disruption and is one of the most lucrative instances of crypto-ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in the Chicago metro area with around 500 employees. The Ryuk attack had shut down all essential operations and manufacturing capabilities. The majority of the client's data backups had been directly accessible at the start of the intrusion and were damaged. The client considered paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but ultimately brought in Progent.
Progent worked hand in hand the client to rapidly assess and assign priority to the key elements that needed to be recovered to make it possible to restart business functions:
- Microsoft Active Directory
- Electronic Messaging
- Financials/MRP
Within 48 hours, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then assisted with setup and hard drive recovery on key applications. All Exchange data and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to assemble intact OST data files (Outlook Offline Folder Files) on staff PCs in order to recover email information. A not too old off-line backup of the client's manufacturing systems made it possible to recover these essential programs back online for users. Although major work remained to recover completely from the Ryuk virus, the most important services were restored rapidly:
Over the next couple of weeks important milestones in the recovery process were achieved through tight cooperation between Progent engineers and the client:
- In-house web sites were brought back up without losing any data.
- The MailStore Server containing more than four million archived emails was spun up and available for users.
- CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were fully functional.
- A new Palo Alto 850 firewall was set up.
- Nearly all of the user workstations were back into operation.
Conclusion
A likely enterprise-killing catastrophe was avoided with hard-working professionals, a wide spectrum of subject matter expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware incident described here would have been blocked with current security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and appropriate incident response procedures for backup and applying software patches, the fact remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's roster of professionals has proven experience in ransomware virus blocking, remediation, and data restoration.
Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Consulting in Mission Viejo
For ransomware system recovery expertise in the Mission Viejo metro area, phone Progent at
Select Topic: