Ransomware Filtering and Removal Expertise Saddle Brook

Ransomware : Your Crippling IT Nightmare
Ransomware has become a modern cyberplague that poses an extinction-level threat for organizations vulnerable to an assault. Different versions of ransomware like the Dharma, Fusob, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and still inflict destruction. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with daily as yet unnamed malware, not only perform encryption of online critical data but also infect most accessible system backup. Files synched to cloud environments can also be rendered useless. In a poorly architected environment, this can render automatic restore operations impossible and basically sets the network back to square one.

Getting back online applications and information after a ransomware event becomes a sprint against the clock as the victim tries its best to contain, remove the ransomware, and restore business-critical activity. Since ransomware requires time to spread throughout a targeted network, penetrations are frequently launched during nights and weekends, when successful penetrations tend to take more time to recognize. This multiplies the difficulty of quickly mobilizing and organizing an experienced response team.

Progent offers a range of help services for securing Saddle Brook businesses from ransomware penetrations. These include team member education to help identify and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to discover and extinguish day-zero modern malware attacks. Progent in addition provides the assistance of experienced ransomware recovery engineers with the talent and perseverance to reconstruct a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
After a crypto-ransomware event, sending the ransom demands in cryptocurrency does not guarantee that criminal gangs will respond with the keys to decipher any or all of your data. Kaspersky determined that seventeen percent of crypto-ransomware victims never restored their files after having paid the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to piece back together the vital parts of your IT environment. Without access to essential data backups, this calls for a broad complement of IT skills, professional project management, and the willingness to work non-stop until the recovery project is finished.

For decades, Progent has provided certified expert Information Technology services for businesses across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained top industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of expertise provides Progent the ability to efficiently identify critical systems and integrate the surviving parts of your network environment following a ransomware penetration and assemble them into an operational network.

Progent's ransomware group uses top notch project management tools to coordinate the sophisticated restoration process. Progent appreciates the urgency of working quickly and in concert with a customer's management and IT staff to assign priority to tasks and to get critical applications back online as soon as humanly possible.

Customer Story: A Successful Ransomware Virus Restoration
A client hired Progent after their network was crashed by Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean state hackers, possibly adopting technology leaked from the United States National Security Agency. Ryuk seeks specific companies with little room for operational disruption and is among the most profitable examples of ransomware viruses. Headline targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturer based in Chicago with around 500 staff members. The Ryuk attack had paralyzed all company operations and manufacturing processes. The majority of the client's information backups had been directly accessible at the time of the attack and were encrypted. The client was taking steps for paying the ransom demand (more than $200K) and wishfully thinking for good luck, but in the end brought in Progent.

Progent worked hand in hand the client to quickly get our arms around and assign priority to the most important services that needed to be addressed to make it possible to restart business functions:

• Active Directory
• Electronic Messaging
• Accounting/MRP

In less than 48 hours, Progent was able to re-build Active Directory to its pre-attack state. Progent then helped perform rebuilding and hard drive recovery on needed systems. All Exchange Server schema and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to find non-encrypted OST files (Microsoft Outlook Offline Data Files) on staff desktop computers in order to recover mail data. A recent offline backup of the businesses manufacturing systems made them able to recover these vital services back online. Although significant work needed to be completed to recover completely from the Ryuk virus, core services were recovered quickly:

Throughout the next couple of weeks key milestones in the recovery project were completed in close collaboration between Progent engineers and the customer:

• Self-hosted web applications were brought back up with no loss of data.
• The MailStore Exchange Server containing more than four million historical messages was restored to operations and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/AR/Inventory capabilities were 100 percent restored.
• A new Palo Alto Networks 850 firewall was installed.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A potential business disaster was evaded with top-tier experts, a broad array of subject matter expertise, and tight collaboration. Although in hindsight the crypto-ransomware virus penetration detailed here would have been shut down with up-to-date security technology and best practices, team education, and appropriate security procedures for information protection and keeping systems up to date with security patches, the fact is that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware incident, feel confident that Progent's team of experts has proven experience in crypto-ransomware virus defense, removal, and information systems restoration.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Saddle Brook
For ransomware cleanup expertise in the Saddle Brook area, phone Progent at 800-462-8800 or see Contact Progent.