Ransomware Defense and Recovery Consulting San Francisco

Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become a too-frequent cyberplague that presents an extinction-level threat for businesses of all sizes unprepared for an assault. Different versions of ransomware such as CrySIS, Fusob, Locky, Syskey and MongoLock cryptoworms have been running rampant for years and still inflict harm. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, as well as additional unnamed viruses, not only perform encryption of on-line critical data but also infiltrate many available system backup. Files replicated to cloud environments can also be rendered useless. In a vulnerable environment, it can render automatic restoration useless and effectively sets the network back to square one.

Restoring services and data after a crypto-ransomware outage becomes a sprint against the clock as the targeted business fights to stop the spread, remove the crypto-ransomware, and resume business-critical operations. Since crypto-ransomware needs time to replicate across a targeted network, attacks are usually sprung at night, when penetrations typically take longer to identify. This multiplies the difficulty of quickly mobilizing and coordinating an experienced response team.

Progent offers a range of services for protecting San Francisco businesses from ransomware penetrations. Among these are team training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to discover and suppress day-zero malware attacks. Progent also provides the assistance of veteran ransomware recovery professionals with the talent and perseverance to restore a breached environment as quickly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Subsequent to a crypto-ransomware penetration, paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will provide the codes to unencrypt all your files. Kaspersky estimated that seventeen percent of crypto-ransomware victims never restored their data even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to setup from scratch the vital parts of your IT environment. Without the availability of essential system backups, this requires a broad complement of skill sets, well-coordinated project management, and the ability to work non-stop until the task is finished.

For twenty years, Progent has offered expert Information Technology services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of experience affords Progent the ability to knowledgably understand important systems and consolidate the surviving pieces of your computer network environment after a crypto-ransomware event and assemble them into an operational system.

Progent's ransomware group utilizes best of breed project management systems to coordinate the complicated restoration process. Progent knows the urgency of acting swiftly and in concert with a client's management and IT staff to prioritize tasks and to get critical services back on line as fast as possible.

Client Case Study: A Successful Ransomware Virus Recovery
A client engaged Progent after their network system was penetrated by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state sponsored criminal gangs, possibly adopting algorithms exposed from the U.S. NSA organization. Ryuk targets specific companies with limited tolerance for disruption and is one of the most lucrative examples of ransomware malware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company located in the Chicago metro area and has about 500 employees. The Ryuk event had frozen all company operations and manufacturing processes. The majority of the client's data protection had been on-line at the start of the attack and were damaged. The client was evaluating paying the ransom (more than $200K) and hoping for the best, but in the end made the decision to use Progent.

Progent worked hand in hand the customer to quickly determine and prioritize the most important systems that needed to be addressed in order to resume departmental operations:

• Windows Active Directory
• Email
• Accounting and Manufacturing Software

Within 2 days, Progent was able to restore Active Directory services to its pre-attack state. Progent then charged ahead with rebuilding and hard drive recovery of key applications. All Microsoft Exchange Server ties and attributes were intact, which accelerated the restore of Exchange. Progent was also able to locate local OST data files (Microsoft Outlook Offline Data Files) on various desktop computers and laptops to recover mail information. A not too old offline backup of the customer's financials/MRP systems made them able to restore these essential programs back available to users. Although a lot of work needed to be completed to recover fully from the Ryuk event, core services were restored quickly:

Over the following couple of weeks key milestones in the restoration project were completed through close collaboration between Progent team members and the customer:

• In-house web sites were restored without losing any data.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was spun up and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables/Inventory capabilities were 100 percent recovered.
• A new Palo Alto 850 firewall was set up.
• Ninety percent of the desktops and laptops were operational.

Conclusion
A potential business-ending disaster was evaded due to hard-working experts, a broad range of knowledge, and close collaboration. Although in post mortem the ransomware penetration described here should have been identified and blocked with modern cyber security solutions and NIST Cybersecurity Framework best practices, user education, and well designed security procedures for information protection and applying software patches, the fact remains that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware virus, remember that Progent's roster of experts has extensive experience in ransomware virus defense, mitigation, and information systems restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in San Francisco
For ransomware recovery expertise in the San Francisco metro area, call Progent at 800-462-8800 or see Contact Progent.