Ransomware Protection and Restoration Expertise Rancho Cordova

Crypto-Ransomware : Your Worst IT Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that poses an extinction-level danger for businesses of all sizes vulnerable to an attack. Different versions of crypto-ransomware such as CryptoLocker, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been around for years and still cause havoc. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, as well as additional as yet unnamed viruses, not only perform encryption of online data but also infiltrate many configured system backups. Files synchronized to off-premises disaster recovery sites can also be rendered useless. In a poorly designed data protection solution, this can make automatic restoration hopeless and basically sets the datacenter back to square one.

Recovering services and data after a ransomware event becomes a race against the clock as the victim struggles to stop lateral movement, clear the ransomware, and restore mission-critical operations. Because ransomware requires time to replicate across a network, penetrations are often launched at night, when successful attacks may take longer to discover. This compounds the difficulty of rapidly assembling and organizing a knowledgeable mitigation team.

Progent has a range of support services for securing Rancho Cordova organizations from ransomware events. Among these are staff training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based threat defense to detect and suppress zero-day modern malware assaults. Progent in addition can provide the services of veteran crypto-ransomware recovery engineers with the talent and commitment to re-deploy a breached environment as soon as possible.

Progent's Ransomware Restoration Help
After a ransomware invasion, paying the ransom in cryptocurrency does not guarantee that cyber criminals will respond with the codes to decipher any of your information. Kaspersky Labs determined that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The alternative is to setup from scratch the key elements of your Information Technology environment. Absent access to essential data backups, this calls for a wide range of IT skills, professional team management, and the ability to work non-stop until the recovery project is done.

For two decades, Progent has offered professional IT services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of expertise affords Progent the skills to rapidly understand critical systems and consolidate the remaining parts of your computer network environment following a ransomware attack and assemble them into an operational network.

Progent's ransomware group utilizes powerful project management applications to orchestrate the sophisticated recovery process. Progent appreciates the urgency of acting rapidly and in concert with a client's management and IT team members to assign priority to tasks and to put key systems back on-line as fast as possible.

Case Study: A Successful Crypto-Ransomware Intrusion Recovery
A client hired Progent after their network system was attacked by Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean government sponsored hackers, suspected of using approaches exposed from the U.S. National Security Agency. Ryuk seeks specific organizations with little or no ability to sustain operational disruption and is among the most profitable examples of crypto-ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company based in Chicago with around 500 staff members. The Ryuk event had disabled all business operations and manufacturing capabilities. The majority of the client's data backups had been online at the time of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and hoping for good luck, but ultimately reached out to Progent.

Progent worked together with the client to quickly assess and assign priority to the critical systems that had to be recovered in order to restart company functions:

• Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

Within two days, Progent was able to re-build Active Directory to its pre-attack state. Progent then completed setup and storage recovery of needed servers. All Microsoft Exchange Server data and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to assemble local OST files (Outlook Email Offline Folder Files) on user PCs and laptops to recover mail data. A not too old offline backup of the customer's accounting/MRP systems made it possible to restore these essential applications back on-line. Although significant work still had to be done to recover completely from the Ryuk attack, the most important services were returned to operations rapidly:

Over the next couple of weeks critical milestones in the recovery project were achieved through tight collaboration between Progent team members and the client:

• Internal web applications were restored without losing any data.
• The MailStore Microsoft Exchange Server exceeding 4 million historical messages was spun up and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables/Inventory capabilities were 100% functional.
• A new Palo Alto Networks 850 firewall was deployed.
• Ninety percent of the user workstations were being used by staff.

Conclusion
A probable company-ending disaster was evaded due to dedicated professionals, a wide array of IT skills, and close collaboration. Although in analyzing the event afterwards the ransomware attack detailed here would have been blocked with up-to-date security systems and recognized best practices, user training, and properly executed security procedures for backup and applying software patches, the fact remains that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's roster of professionals has a proven track record in ransomware virus blocking, remediation, and data disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Rancho Cordova
For ransomware system recovery consulting in the Rancho Cordova area, call Progent at 800-462-8800 or go to Contact Progent.