Ransomware Protection and Cleanup Expertise Riverside

Ransomware : Your Feared Information Technology Catastrophe
Crypto-Ransomware has become an escalating cyberplague that presents an extinction-level threat for businesses of all sizes vulnerable to an assault. Different versions of crypto-ransomware like the CrySIS, Fusob, Locky, NotPetya and MongoLock cryptoworms have been circulating for a long time and still cause harm. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, plus frequent as yet unnamed newcomers, not only encrypt on-line data but also infect many configured system restores and backups. Information synched to off-premises disaster recovery sites can also be rendered useless. In a poorly designed data protection solution, this can render any recovery hopeless and effectively sets the network back to zero.

Getting back applications and data after a ransomware intrusion becomes a sprint against time as the targeted organization fights to stop lateral movement, remove the ransomware, and restore enterprise-critical activity. Due to the fact that crypto-ransomware takes time to move laterally throughout a network, penetrations are frequently sprung on weekends and holidays, when successful penetrations in many cases take longer to identify. This compounds the difficulty of rapidly marshalling and organizing an experienced mitigation team.

Progent provides a range of solutions for protecting Riverside enterprises from crypto-ransomware attacks. These include user education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat protection to identify and extinguish zero-day modern malware assaults. Progent also provides the assistance of veteran ransomware recovery engineers with the track record and commitment to restore a compromised system as urgently as possible.

Progent's Ransomware Restoration Help
After a ransomware event, even paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will respond with the needed keys to unencrypt any of your information. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their files after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The alternative is to re-install the essential elements of your Information Technology environment. Without access to complete information backups, this requires a wide complement of IT skills, well-coordinated team management, and the willingness to work non-stop until the task is complete.

For two decades, Progent has provided expert IT services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned top industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of experience provides Progent the ability to knowledgably identify necessary systems and re-organize the remaining pieces of your network system after a ransomware penetration and configure them into a functioning network.

Progent's ransomware team of experts utilizes top notch project management tools to coordinate the sophisticated restoration process. Progent understands the urgency of acting swiftly and together with a customer's management and IT staff to assign priority to tasks and to get critical services back on line as soon as humanly possible.

Client Story: A Successful Ransomware Incident Recovery
A business sought out Progent after their company was brought down by Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean government sponsored criminal gangs, suspected of using strategies leaked from the U.S. NSA organization. Ryuk attacks specific organizations with little or no room for disruption and is among the most lucrative instances of ransomware malware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer based in Chicago and has around 500 staff members. The Ryuk penetration had frozen all company operations and manufacturing processes. The majority of the client's backups had been on-line at the time of the intrusion and were encrypted. The client considered paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but in the end engaged Progent.

Progent worked together with the client to quickly assess and assign priority to the essential elements that had to be restored in order to restart departmental operations:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

Within two days, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then performed reinstallations and storage recovery of the most important applications. All Exchange ties and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to locate local OST files (Microsoft Outlook Offline Folder Files) on team workstations to recover mail messages. A recent offline backup of the businesses accounting/MRP software made it possible to restore these vital services back online. Although a lot of work needed to be completed to recover totally from the Ryuk event, essential services were recovered quickly:

Over the following month key milestones in the recovery project were made in tight cooperation between Progent team members and the client:

• Self-hosted web applications were brought back up without losing any information.
• The MailStore Microsoft Exchange Server with over four million historical messages was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables/Inventory capabilities were completely operational.
• A new Palo Alto Networks 850 firewall was deployed.
• 90% of the user desktops were functioning as before the incident.

Conclusion
A likely enterprise-killing catastrophe was avoided by dedicated experts, a wide spectrum of subject matter expertise, and close collaboration. Although in hindsight the crypto-ransomware virus penetration detailed here would have been prevented with modern security technology and best practices, staff training, and properly executed incident response procedures for backup and applying software patches, the fact is that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware penetration, remember that Progent's team of experts has extensive experience in ransomware virus defense, remediation, and information systems recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Riverside
For ransomware cleanup services in the Riverside area, phone Progent at 800-462-8800 or see Contact Progent.