Ransomware Filtering and Remediation Services Mobile

Ransomware : Your Crippling IT Catastrophe
Ransomware has become a modern cyber pandemic that poses an extinction-level danger for businesses of all sizes poorly prepared for an assault. Multiple generations of ransomware like the Reveton, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for a long time and continue to cause destruction. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, plus more unnamed viruses, not only encrypt on-line files but also infect all configured system protection. Information synched to cloud environments can also be corrupted. In a poorly architected data protection solution, it can render automated recovery hopeless and basically knocks the entire system back to square one.

Getting back applications and data after a ransomware attack becomes a race against the clock as the targeted business tries its best to contain the damage, cleanup the virus, and restore business-critical activity. Due to the fact that ransomware needs time to replicate throughout a targeted network, assaults are often launched during nights and weekends, when successful attacks tend to take more time to uncover. This multiplies the difficulty of rapidly assembling and organizing a capable mitigation team.

Progent has a range of services for securing Mobile enterprises from crypto-ransomware attacks. These include team education to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to identify and suppress day-zero modern malware attacks. Progent also can provide the assistance of experienced ransomware recovery consultants with the track record and commitment to reconstruct a compromised network as rapidly as possible.

Progent's Ransomware Restoration Services
Subsequent to a ransomware invasion, sending the ransom in cryptocurrency does not provide any assurance that distant criminals will respond with the keys to decrypt any or all of your information. Kaspersky estimated that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The other path is to setup from scratch the vital elements of your Information Technology environment. Absent access to complete system backups, this calls for a wide complement of skill sets, professional team management, and the capability to work non-stop until the task is over.

For two decades, Progent has made available certified expert IT services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have been awarded advanced certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial management and ERP applications. This breadth of expertise affords Progent the ability to efficiently identify critical systems and integrate the surviving components of your Information Technology environment following a crypto-ransomware attack and rebuild them into an operational system.

Progent's recovery team of experts utilizes best of breed project management systems to coordinate the complicated restoration process. Progent appreciates the urgency of working quickly and together with a customer's management and Information Technology resources to assign priority to tasks and to put essential applications back on line as fast as possible.

Client Case Study: A Successful Crypto-Ransomware Incident Restoration
A client hired Progent after their network system was brought down by the Ryuk ransomware virus. Ryuk is generally considered to have been launched by North Korean state sponsored criminal gangs, suspected of adopting algorithms leaked from the U.S. National Security Agency. Ryuk targets specific organizations with little ability to sustain disruption and is among the most profitable incarnations of ransomware viruses. Major victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company based in Chicago with around 500 staff members. The Ryuk penetration had shut down all business operations and manufacturing capabilities. The majority of the client's information backups had been online at the time of the intrusion and were eventually encrypted. The client considered paying the ransom (exceeding $200,000) and praying for good luck, but ultimately reached out to Progent.

Progent worked together with the customer to quickly identify and prioritize the critical services that had to be recovered in order to resume departmental operations:

• Windows Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to recover Active Directory services to its pre-penetration state. Progent then accomplished setup and storage recovery on essential systems. All Exchange Server schema and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to collect local OST files (Outlook Off-Line Folder Files) on staff workstations to recover email messages. A recent off-line backup of the customer's accounting software made it possible to return these required applications back on-line. Although significant work was left to recover fully from the Ryuk damage, critical services were returned to operations quickly:

During the following few weeks critical milestones in the restoration project were achieved in close collaboration between Progent consultants and the customer:

• Self-hosted web applications were returned to operation with no loss of information.
• The MailStore Exchange Server containing more than four million historical emails was brought online and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory Control capabilities were fully functional.
• A new Palo Alto Networks 850 security appliance was brought online.
• Nearly all of the user PCs were fully operational.

Conclusion
A possible business disaster was dodged with results-oriented experts, a wide array of technical expertise, and close teamwork. Although in retrospect the ransomware penetration described here should have been shut down with current security technology and security best practices, team education, and well thought out incident response procedures for information backup and keeping systems up to date with security patches, the fact is that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, mitigation, and data restoration.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Mobile
For ransomware cleanup consulting in the Mobile area, call Progent at 800-462-8800 or go to Contact Progent.