Ransomware Prevention and Recovery Expertise San Bernardino

Crypto-Ransomware : Your Crippling IT Disaster
Ransomware has become a too-frequent cyber pandemic that presents an extinction-level threat for businesses vulnerable to an assault. Different versions of ransomware like the Dharma, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and continue to cause harm. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with more as yet unnamed malware, not only encrypt online critical data but also infiltrate all available system protection. Information synched to the cloud can also be ransomed. In a poorly architected environment, it can render any restore operations impossible and effectively knocks the entire system back to square one.

Restoring programs and information after a ransomware attack becomes a race against the clock as the targeted organization struggles to stop lateral movement, cleanup the ransomware, and restore mission-critical activity. Due to the fact that ransomware requires time to spread throughout a network, attacks are often sprung on weekends, when successful attacks may take more time to detect. This compounds the difficulty of quickly assembling and orchestrating an experienced response team.

Progent offers a range of help services for securing San Bernardino businesses from ransomware attacks. Among these are user training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to discover and suppress day-zero modern malware assaults. Progent also offers the services of seasoned ransomware recovery consultants with the talent and commitment to rebuild a breached network as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Following a ransomware invasion, sending the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will return the needed keys to decipher any or all of your data. Kaspersky Labs determined that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The other path is to setup from scratch the vital parts of your Information Technology environment. Without access to complete information backups, this requires a wide complement of skills, well-coordinated project management, and the ability to work 24x7 until the job is over.

For decades, Progent has offered professional Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained high-level certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-recognized certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial systems and ERP application software. This breadth of experience gives Progent the capability to efficiently determine necessary systems and re-organize the remaining parts of your IT environment after a ransomware penetration and assemble them into a functioning network.

Progent's security team of experts has state-of-the-art project management applications to orchestrate the complicated recovery process. Progent appreciates the urgency of working rapidly and in unison with a client's management and IT staff to prioritize tasks and to get key systems back online as fast as possible.

Customer Story: A Successful Ransomware Intrusion Response
A client hired Progent after their network was crashed by Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean state hackers, suspected of adopting techniques leaked from the United States National Security Agency. Ryuk targets specific organizations with little room for operational disruption and is one of the most profitable iterations of ransomware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer located in the Chicago metro area and has around 500 workers. The Ryuk penetration had paralyzed all business operations and manufacturing processes. Most of the client's system backups had been on-line at the time of the intrusion and were encrypted. The client was taking steps for paying the ransom (in excess of $200K) and praying for good luck, but ultimately called Progent.

Progent worked with the customer to quickly identify and assign priority to the most important applications that had to be restored to make it possible to resume business operations:

• Microsoft Active Directory
• Electronic Mail
• MRP System

In less than 48 hours, Progent was able to restore Active Directory services to its pre-virus state. Progent then completed reinstallations and storage recovery of key applications. All Exchange ties and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to locate non-encrypted OST files (Outlook Offline Folder Files) on team workstations and laptops in order to recover mail data. A recent off-line backup of the client's manufacturing software made it possible to restore these vital programs back servicing users. Although a lot of work still had to be done to recover totally from the Ryuk attack, critical systems were returned to operations rapidly:

Over the following couple of weeks critical milestones in the recovery project were completed through tight cooperation between Progent team members and the customer:

• Internal web sites were brought back up without losing any information.
• The MailStore Server exceeding 4 million archived emails was spun up and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control modules were fully restored.
• A new Palo Alto 850 security appliance was brought online.
• 90% of the user workstations were fully operational.

Conclusion
A potential enterprise-killing catastrophe was averted due to dedicated experts, a wide spectrum of IT skills, and tight collaboration. Although in retrospect the crypto-ransomware virus incident detailed here would have been shut down with modern cyber security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and well thought out security procedures for information backup and applying software patches, the reality is that state-sponsored hackers from China, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's team of experts has substantial experience in ransomware virus blocking, mitigation, and data restoration.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in San Bernardino
For ransomware cleanup expertise in the San Bernardino area, call Progent at 800-462-8800 or see Contact Progent.