Ransomware Prevention and Cleanup Consulting San Diego

Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware has become a too-frequent cyberplague that represents an existential danger for businesses vulnerable to an attack. Multiple generations of ransomware like the CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and continue to inflict havoc. More recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as more as yet unnamed viruses, not only perform encryption of online data but also infect most accessible system backups. Information replicated to cloud environments can also be corrupted. In a vulnerable system, this can make automatic restore operations impossible and effectively knocks the entire system back to zero.

Restoring services and information after a ransomware event becomes a sprint against time as the victim tries its best to contain, cleanup the ransomware, and resume business-critical activity. Since crypto-ransomware requires time to spread throughout a network, assaults are frequently launched on weekends, when successful penetrations may take more time to detect. This compounds the difficulty of rapidly marshalling and organizing a capable response team.

Progent has an assortment of solutions for protecting San Diego businesses from ransomware attacks. Among these are team education to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to identify and disable zero-day malware assaults. Progent in addition provides the services of seasoned ransomware recovery engineers with the track record and perseverance to reconstruct a compromised system as quickly as possible.

Progent's Ransomware Recovery Help
Soon after a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not ensure that distant criminals will return the codes to decipher any of your data. Kaspersky Labs determined that 17% of ransomware victims never recovered their files after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to piece back together the mission-critical parts of your Information Technology environment. Without the availability of full information backups, this calls for a wide range of skill sets, well-coordinated team management, and the willingness to work non-stop until the task is complete.

For decades, Progent has made available certified expert Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded advanced certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in accounting and ERP software solutions. This breadth of experience affords Progent the skills to rapidly determine necessary systems and consolidate the remaining pieces of your network environment following a ransomware attack and configure them into a functioning network.

Progent's security team deploys powerful project management tools to orchestrate the complicated recovery process. Progent appreciates the importance of working swiftly and in unison with a customer's management and Information Technology resources to prioritize tasks and to put the most important applications back on line as fast as possible.

Client Case Study: A Successful Ransomware Incident Response
A client escalated to Progent after their company was attacked by Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean state hackers, possibly using approaches leaked from the U.S. National Security Agency. Ryuk seeks specific businesses with limited room for disruption and is one of the most lucrative incarnations of ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer located in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing processes. The majority of the client's information backups had been online at the time of the intrusion and were destroyed. The client considered paying the ransom demand (in excess of $200K) and hoping for the best, but in the end brought in Progent.

Progent worked with the client to quickly get our arms around and prioritize the key applications that needed to be restored to make it possible to resume departmental functions:

• Active Directory
• Microsoft Exchange Email
• Accounting/MRP

In less than 2 days, Progent was able to restore Active Directory to its pre-penetration state. Progent then performed setup and storage recovery on critical applications. All Microsoft Exchange Server schema and configuration information were intact, which accelerated the restore of Exchange. Progent was able to find non-encrypted OST files (Outlook Email Off-Line Folder Files) on various desktop computers and laptops in order to recover email information. A not too old offline backup of the client's accounting/MRP software made them able to return these essential programs back available to users. Although a large amount of work remained to recover fully from the Ryuk damage, essential systems were restored quickly:

During the following few weeks key milestones in the restoration process were made in close collaboration between Progent team members and the customer:

• In-house web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was brought on-line and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control capabilities were 100 percent restored.
• A new Palo Alto 850 security appliance was set up and programmed.
• Ninety percent of the desktop computers were fully operational.

Conclusion
A potential enterprise-killing disaster was averted through the efforts of top-tier professionals, a broad range of technical expertise, and close collaboration. Although in retrospect the crypto-ransomware penetration detailed here should have been prevented with advanced security solutions and best practices, team education, and well designed security procedures for data protection and applying software patches, the reality is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware virus, remember that Progent's team of experts has proven experience in crypto-ransomware virus blocking, mitigation, and data recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in San Diego
For ransomware cleanup consulting services in the San Diego metro area, call Progent at 800-462-8800 or go to Contact Progent.