Ransomware Prevention and Restoration Expertise San Diego UCSD

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become an escalating cyberplague that presents an existential danger for businesses of all sizes unprepared for an assault. Different iterations of ransomware such as Dharma, Fusob, Locky, NotPetya and MongoLock cryptoworms have been replicating for a long time and still inflict harm. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, along with daily as yet unnamed newcomers, not only perform encryption of on-line critical data but also infiltrate all available system restores and backups. Information synchronized to the cloud can also be corrupted. In a vulnerable system, this can render automatic restoration useless and basically knocks the network back to zero.

Recovering applications and information following a ransomware intrusion becomes a sprint against time as the targeted business struggles to contain the damage, clear the ransomware, and resume mission-critical operations. Due to the fact that ransomware takes time to spread across a network, attacks are often launched during weekends and nights, when successful penetrations in many cases take more time to recognize. This multiplies the difficulty of rapidly mobilizing and orchestrating a capable response team.

Progent offers a variety of support services for securing San Diego UCSD enterprises from ransomware penetrations. Among these are user education to help identify and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat protection to discover and suppress day-zero modern malware attacks. Progent in addition can provide the assistance of seasoned ransomware recovery consultants with the track record and commitment to rebuild a breached network as urgently as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a ransomware invasion, even paying the ransom demands in cryptocurrency does not guarantee that distant criminals will return the codes to decipher any or all of your information. Kaspersky Labs determined that 17% of crypto-ransomware victims never restored their information even after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to setup from scratch the mission-critical components of your Information Technology environment. Without the availability of essential data backups, this calls for a wide complement of skill sets, professional project management, and the willingness to work 24x7 until the recovery project is done.

For two decades, Progent has made available professional IT services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned advanced certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP applications. This breadth of expertise gives Progent the capability to rapidly determine important systems and re-organize the surviving parts of your Information Technology environment after a ransomware attack and configure them into an operational network.

Progent's recovery team of experts uses best of breed project management tools to orchestrate the complex restoration process. Progent appreciates the importance of acting rapidly and in unison with a client's management and Information Technology team members to prioritize tasks and to get essential applications back online as fast as humanly possible.

Client Story: A Successful Ransomware Attack Response
A client engaged Progent after their company was taken over by the Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored hackers, suspected of adopting approaches exposed from the United States National Security Agency. Ryuk goes after specific businesses with little or no room for disruption and is among the most profitable iterations of ransomware. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in the Chicago metro area and has about 500 employees. The Ryuk event had paralyzed all company operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the time of the attack and were encrypted. The client was pursuing financing for paying the ransom (more than $200K) and hoping for the best, but ultimately utilized Progent.

Progent worked together with the client to rapidly understand and prioritize the most important areas that had to be addressed to make it possible to restart departmental operations:

• Active Directory
• Electronic Messaging
• Accounting/MRP

Within 48 hours, Progent was able to recover Active Directory to its pre-penetration state. Progent then completed setup and storage recovery on needed servers. All Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to locate intact OST files (Outlook Email Off-Line Folder Files) on team PCs in order to recover mail messages. A not too old offline backup of the businesses accounting/ERP systems made it possible to recover these required services back servicing users. Although a lot of work was left to recover totally from the Ryuk virus, the most important services were restored rapidly:

During the following few weeks key milestones in the recovery project were made through tight cooperation between Progent engineers and the customer:

• In-house web applications were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million archived emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables/Inventory modules were completely operational.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Nearly all of the user desktops were fully operational.

Conclusion
A likely company-ending disaster was evaded with hard-working professionals, a broad spectrum of technical expertise, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware attack described here would have been stopped with current cyber security technology and best practices, staff training, and well thought out security procedures for data backup and applying software patches, the fact remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of experts has a proven track record in ransomware virus defense, remediation, and data recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in San Diego UCSD
For ransomware recovery consulting in the San Diego UCSD area, phone Progent at 800-462-8800 or visit Contact Progent.