Ransomware Protection and Removal Services Roseville

Ransomware : Your Worst Information Technology Disaster
Ransomware has become an escalating cyberplague that represents an extinction-level danger for organizations vulnerable to an attack. Multiple generations of crypto-ransomware like the Dharma, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to cause harm. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as more as yet unnamed malware, not only perform encryption of on-line data but also infiltrate all accessible system protection. Files synched to the cloud can also be corrupted. In a poorly architected environment, this can render any recovery hopeless and effectively sets the network back to zero.

Getting back online applications and information after a ransomware event becomes a sprint against the clock as the victim struggles to stop lateral movement, cleanup the crypto-ransomware, and resume business-critical operations. Due to the fact that ransomware needs time to replicate across a targeted network, attacks are frequently launched at night, when successful penetrations typically take longer to discover. This compounds the difficulty of quickly assembling and orchestrating a qualified response team.

Progent provides an assortment of services for protecting Roseville enterprises from ransomware events. These include staff education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to detect and extinguish day-zero modern malware assaults. Progent also provides the assistance of expert crypto-ransomware recovery consultants with the talent and commitment to restore a compromised environment as soon as possible.

Progent's Ransomware Restoration Services
Soon after a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not guarantee that merciless criminals will provide the keys to decrypt any or all of your information. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never restored their files even after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to re-install the mission-critical elements of your Information Technology environment. Absent access to essential system backups, this calls for a broad range of skills, professional project management, and the ability to work non-stop until the job is complete.

For two decades, Progent has offered certified expert IT services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have earned internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of experience affords Progent the ability to knowledgably determine important systems and integrate the surviving parts of your computer network system after a crypto-ransomware attack and configure them into a functioning network.

Progent's ransomware team of experts utilizes state-of-the-art project management applications to coordinate the complex recovery process. Progent appreciates the importance of working quickly and in unison with a client's management and Information Technology resources to prioritize tasks and to put key systems back on-line as soon as possible.

Business Case Study: A Successful Ransomware Attack Response
A client contacted Progent after their network was attacked by Ryuk ransomware. Ryuk is believed to have been launched by North Korean state sponsored hackers, suspected of using techniques exposed from the United States NSA organization. Ryuk goes after specific businesses with little tolerance for disruption and is among the most profitable examples of ransomware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in Chicago and has about 500 staff members. The Ryuk intrusion had paralyzed all business operations and manufacturing processes. The majority of the client's data backups had been on-line at the time of the intrusion and were damaged. The client was taking steps for paying the ransom demand (more than $200,000) and hoping for the best, but in the end brought in Progent.

Progent worked hand in hand the customer to rapidly determine and assign priority to the critical areas that needed to be restored in order to continue company functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Accounting and Manufacturing Software

In less than two days, Progent was able to restore Active Directory to its pre-attack state. Progent then performed reinstallations and storage recovery on essential systems. All Exchange Server schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to collect non-encrypted OST files (Outlook Email Off-Line Data Files) on various desktop computers and laptops in order to recover mail information. A not too old offline backup of the businesses financials/ERP systems made them able to recover these vital programs back online for users. Although a lot of work needed to be completed to recover totally from the Ryuk event, core systems were returned to operations quickly:

Throughout the following month important milestones in the restoration process were completed through tight collaboration between Progent consultants and the client:

• Internal web applications were returned to operation without losing any information.
• The MailStore Server containing more than four million archived emails was brought online and accessible to users.
• CRM/Orders/Invoices/AP/AR/Inventory modules were 100 percent recovered.
• A new Palo Alto 850 security appliance was set up and programmed.
• Nearly all of the desktops and laptops were being used by staff.

Conclusion
A possible business extinction catastrophe was evaded by results-oriented professionals, a broad array of knowledge, and close collaboration. Although in analyzing the event afterwards the ransomware virus incident detailed here should have been disabled with up-to-date cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and well thought out incident response procedures for data backup and applying software patches, the fact is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a crypto-ransomware incident, feel confident that Progent's team of professionals has substantial experience in ransomware virus defense, remediation, and file recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Roseville
For ransomware recovery services in the Roseville metro area, phone Progent at 800-462-8800 or go to Contact Progent.