Ransomware Filtering and Remediation Services Reading

Crypto-Ransomware : Your Crippling IT Nightmare
Ransomware has become a too-frequent cyberplague that represents an extinction-level threat for businesses of all sizes unprepared for an assault. Different iterations of crypto-ransomware like the CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for many years and still inflict damage. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, plus additional as yet unnamed malware, not only encrypt online data files but also infect many accessible system backup. Files replicated to off-premises disaster recovery sites can also be rendered useless. In a poorly architected system, this can make automatic restoration impossible and basically sets the datacenter back to square one.

Recovering programs and data following a crypto-ransomware outage becomes a race against time as the victim tries its best to contain the damage, clear the crypto-ransomware, and resume business-critical activity. Due to the fact that ransomware takes time to spread throughout a network, assaults are usually sprung during weekends and nights, when successful attacks in many cases take longer to recognize. This compounds the difficulty of promptly marshalling and orchestrating a knowledgeable mitigation team.

Progent provides an assortment of services for protecting Reading businesses from ransomware attacks. These include user training to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat protection to detect and disable zero-day malware assaults. Progent in addition can provide the assistance of expert ransomware recovery engineers with the skills and perseverance to re-deploy a breached environment as quickly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Following a ransomware invasion, paying the ransom in cryptocurrency does not guarantee that distant criminals will respond with the needed codes to decipher any of your data. Kaspersky ascertained that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The alternative is to piece back together the vital parts of your Information Technology environment. Absent the availability of complete data backups, this requires a broad complement of skills, professional project management, and the ability to work non-stop until the job is completed.

For decades, Progent has made available expert IT services for businesses across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned advanced certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP software solutions. This breadth of expertise provides Progent the skills to quickly identify necessary systems and re-organize the remaining components of your network system after a crypto-ransomware event and configure them into an operational network.

Progent's ransomware team of experts has top notch project management tools to coordinate the complicated restoration process. Progent understands the urgency of working rapidly and in concert with a customer's management and IT staff to assign priority to tasks and to put essential services back on line as soon as humanly possible.

Client Story: A Successful Ransomware Virus Restoration
A client sought out Progent after their organization was taken over by the Ryuk ransomware. Ryuk is thought to have been created by North Korean government sponsored cybercriminals, possibly using strategies leaked from the United States National Security Agency. Ryuk goes after specific businesses with limited room for disruption and is one of the most lucrative versions of ransomware malware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business located in the Chicago metro area and has about 500 staff members. The Ryuk penetration had disabled all business operations and manufacturing capabilities. The majority of the client's data backups had been on-line at the beginning of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but in the end made the decision to use Progent.

Progent worked with the client to rapidly determine and assign priority to the critical areas that had to be restored in order to resume business functions:

• Active Directory (AD)
• Exchange Server
• Accounting and Manufacturing Software

Within 2 days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then charged ahead with rebuilding and hard drive recovery on critical applications. All Microsoft Exchange Server ties and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to find local OST data files (Outlook Email Off-Line Data Files) on team workstations and laptops to recover mail messages. A recent offline backup of the client's accounting/ERP software made them able to recover these essential applications back online for users. Although significant work remained to recover completely from the Ryuk damage, core systems were recovered rapidly:

During the next month important milestones in the recovery project were made through tight cooperation between Progent consultants and the client:

• Self-hosted web applications were brought back up without losing any information.
• The MailStore Server containing more than 4 million archived emails was restored to operations and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables/Inventory Control functions were 100 percent restored.
• A new Palo Alto Networks 850 firewall was set up.
• Nearly all of the desktop computers were functioning as before the incident.

Conclusion
A probable business catastrophe was evaded by top-tier experts, a broad range of IT skills, and close collaboration. Although upon completion of forensics the crypto-ransomware virus incident described here could have been prevented with up-to-date security solutions and best practices, team training, and appropriate security procedures for data protection and keeping systems up to date with security patches, the fact is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware incursion, feel confident that Progent's team of experts has proven experience in ransomware virus defense, remediation, and information systems recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Reading
For ransomware system recovery consulting services in the Reading metro area, phone Progent at 800-462-8800 or see Contact Progent.