Ransomware Protection and Remediation Consulting Recife

Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that represents an enterprise-level danger for organizations poorly prepared for an attack. Versions of ransomware such as Dharma, Fusob, Locky, Syskey and MongoLock cryptoworms have been running rampant for a long time and continue to inflict havoc. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus daily as yet unnamed malware, not only perform encryption of on-line critical data but also infect any available system restores and backups. Information replicated to cloud environments can also be rendered useless. In a poorly designed system, it can render automatic recovery useless and effectively sets the network back to square one.

Getting back applications and information after a ransomware outage becomes a sprint against the clock as the targeted organization tries its best to stop the spread, cleanup the crypto-ransomware, and resume enterprise-critical operations. Due to the fact that ransomware needs time to spread throughout a targeted network, assaults are usually sprung at night, when successful penetrations typically take longer to uncover. This compounds the difficulty of promptly marshalling and organizing an experienced response team.

Progent makes available a range of help services for securing Recife businesses from crypto-ransomware events. These include team member education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to discover and suppress zero-day modern malware assaults. Progent also can provide the services of veteran crypto-ransomware recovery engineers with the talent and perseverance to reconstruct a compromised network as urgently as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that cyber criminals will respond with the needed keys to unencrypt all your files. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to re-install the critical parts of your IT environment. Absent access to complete system backups, this requires a wide complement of IT skills, well-coordinated team management, and the ability to work continuously until the recovery project is done.

For two decades, Progent has made available professional Information Technology services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained top industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have earned internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial management and ERP applications. This breadth of experience affords Progent the ability to quickly identify necessary systems and re-organize the remaining components of your computer network system following a crypto-ransomware penetration and configure them into an operational system.

Progent's security group has powerful project management tools to coordinate the complicated restoration process. Progent appreciates the importance of acting rapidly and in unison with a client's management and Information Technology team members to prioritize tasks and to get the most important applications back on-line as fast as possible.

Customer Story: A Successful Ransomware Intrusion Restoration
A business sought out Progent after their organization was taken over by Ryuk ransomware. Ryuk is believed to have been developed by North Korean government sponsored hackers, suspected of adopting strategies leaked from the U.S. NSA organization. Ryuk targets specific organizations with limited room for disruption and is one of the most profitable incarnations of ransomware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in the Chicago metro area and has about 500 employees. The Ryuk penetration had paralyzed all company operations and manufacturing processes. Most of the client's information backups had been online at the beginning of the attack and were destroyed. The client was taking steps for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately reached out to Progent.

Progent worked hand in hand the customer to rapidly assess and prioritize the critical services that had to be restored in order to restart departmental operations:

• Windows Active Directory
• Email
• Financials/MRP

In less than two days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then completed reinstallations and hard drive recovery on needed servers. All Exchange data and attributes were intact, which accelerated the restore of Exchange. Progent was able to locate non-encrypted OST files (Microsoft Outlook Off-Line Folder Files) on staff workstations in order to recover email messages. A recent off-line backup of the client's financials/ERP software made it possible to return these required applications back available to users. Although a large amount of work needed to be completed to recover completely from the Ryuk damage, critical services were recovered quickly:

During the next month critical milestones in the recovery process were completed in close collaboration between Progent team members and the client:

• In-house web sites were restored with no loss of information.
• The MailStore Server exceeding four million historical messages was brought on-line and available for users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory functions were completely operational.
• A new Palo Alto Networks 850 firewall was set up.
• 90% of the user PCs were operational.

Conclusion
A likely business extinction catastrophe was averted with top-tier experts, a wide array of knowledge, and close collaboration. Although in analyzing the event afterwards the ransomware virus penetration detailed here should have been stopped with modern cyber security technology and NIST Cybersecurity Framework best practices, user and IT administrator training, and well designed incident response procedures for data protection and proper patching controls, the reality is that state-sponsored hackers from China, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware virus, feel confident that Progent's team of experts has substantial experience in ransomware virus blocking, cleanup, and file restoration.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Recife
For ransomware recovery consulting in the Recife metro area, phone Progent at 800-462-8800 or see Contact Progent.