Ransomware Filtering and Cleanup Solutions Curitiba

Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become a too-frequent cyberplague that presents an extinction-level danger for businesses of all sizes unprepared for an assault. Different versions of ransomware such as CrySIS, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for many years and continue to cause destruction. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as more as yet unnamed newcomers, not only encrypt online critical data but also infiltrate most available system backups. Files synchronized to off-premises disaster recovery sites can also be rendered useless. In a vulnerable data protection solution, this can make automated restoration useless and effectively knocks the datacenter back to square one.

Getting back on-line programs and data following a crypto-ransomware outage becomes a sprint against time as the targeted business tries its best to stop lateral movement, cleanup the ransomware, and restore enterprise-critical activity. Due to the fact that crypto-ransomware requires time to move laterally throughout a network, penetrations are frequently sprung during nights and weekends, when penetrations may take more time to uncover. This multiplies the difficulty of rapidly mobilizing and organizing a knowledgeable mitigation team.

Progent provides an assortment of services for securing Curitiba businesses from crypto-ransomware attacks. These include user training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to detect and extinguish zero-day malware attacks. Progent in addition provides the assistance of experienced crypto-ransomware recovery professionals with the track record and perseverance to re-deploy a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a ransomware penetration, sending the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will provide the codes to unencrypt any of your information. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to re-install the vital parts of your Information Technology environment. Absent the availability of full system backups, this requires a wide range of skills, well-coordinated project management, and the ability to work continuously until the job is complete.

For twenty years, Progent has offered professional Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded top certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-recognized certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of expertise gives Progent the skills to efficiently identify critical systems and integrate the remaining pieces of your computer network environment after a ransomware penetration and rebuild them into an operational system.

Progent's security team utilizes top notch project management systems to orchestrate the complicated recovery process. Progent understands the importance of acting rapidly and in unison with a client's management and IT team members to prioritize tasks and to get the most important services back on line as soon as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Intrusion Restoration
A small business escalated to Progent after their organization was attacked by the Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean government sponsored cybercriminals, suspected of using techniques exposed from the United States National Security Agency. Ryuk seeks specific organizations with little room for operational disruption and is among the most lucrative iterations of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in the Chicago metro area and has about 500 workers. The Ryuk penetration had disabled all essential operations and manufacturing processes. The majority of the client's backups had been online at the start of the attack and were damaged. The client was taking steps for paying the ransom (exceeding two hundred thousand dollars) and praying for good luck, but in the end reached out to Progent.

Progent worked together with the customer to quickly understand and assign priority to the essential areas that needed to be recovered in order to continue departmental operations:

• Active Directory (AD)
• Email
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then charged ahead with setup and storage recovery of mission critical servers. All Exchange schema and configuration information were usable, which greatly helped the restore of Exchange. Progent was also able to collect intact OST files (Outlook Offline Data Files) on team workstations and laptops in order to recover email messages. A not too old offline backup of the client's accounting systems made it possible to restore these vital programs back available to users. Although significant work remained to recover completely from the Ryuk virus, essential services were restored rapidly:

During the next month key milestones in the recovery project were achieved through tight collaboration between Progent engineers and the customer:

• Internal web sites were returned to operation without losing any information.
• The MailStore Exchange Server containing more than 4 million historical messages was brought on-line and available for users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory capabilities were 100% functional.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Nearly all of the user desktops were being used by staff.

Conclusion
A probable business extinction catastrophe was avoided by top-tier professionals, a broad array of IT skills, and close collaboration. Although in hindsight the crypto-ransomware penetration detailed here should have been identified and stopped with up-to-date security technology and NIST Cybersecurity Framework best practices, user and IT administrator training, and well designed incident response procedures for data backup and proper patching controls, the reality is that government-sponsored hackers from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware penetration, feel confident that Progent's roster of experts has extensive experience in ransomware virus blocking, mitigation, and information systems recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Curitiba
For ransomware system restoration consulting in the Curitiba area, phone Progent at 800-462-8800 or visit Contact Progent.