Ransomware Filtering and Cleanup Expertise San Rafael

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become an escalating cyberplague that poses an extinction-level threat for businesses of all sizes poorly prepared for an assault. Multiple generations of crypto-ransomware such as Dharma, Fusob, Locky, NotPetya and MongoLock cryptoworms have been around for many years and continue to cause havoc. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with more unnamed malware, not only encrypt online data files but also infect most available system backup. Files synched to the cloud can also be corrupted. In a poorly architected system, it can make any restoration impossible and basically sets the datacenter back to zero.

Restoring applications and data after a crypto-ransomware intrusion becomes a race against the clock as the targeted business tries its best to stop the spread, cleanup the virus, and restore business-critical activity. Because crypto-ransomware takes time to replicate across a targeted network, attacks are often sprung during weekends and nights, when successful attacks may take longer to notice. This compounds the difficulty of rapidly marshalling and coordinating a knowledgeable response team.

Progent provides an assortment of support services for securing San Rafael enterprises from ransomware penetrations. These include staff training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat protection to detect and suppress day-zero modern malware attacks. Progent in addition offers the assistance of veteran ransomware recovery consultants with the skills and commitment to rebuild a breached system as urgently as possible.

Progent's Ransomware Restoration Support Services
Soon after a ransomware invasion, paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will provide the codes to unencrypt any of your files. Kaspersky Labs determined that 17% of ransomware victims never restored their information after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The other path is to setup from scratch the essential parts of your Information Technology environment. Absent the availability of full information backups, this requires a wide complement of skill sets, professional team management, and the capability to work continuously until the task is done.

For two decades, Progent has offered expert IT services for companies throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of expertise gives Progent the ability to efficiently identify necessary systems and integrate the remaining components of your IT environment after a ransomware penetration and rebuild them into an operational network.

Progent's security team of experts deploys powerful project management applications to orchestrate the complex recovery process. Progent knows the importance of acting swiftly and in concert with a client's management and IT staff to assign priority to tasks and to put the most important systems back online as soon as possible.

Client Story: A Successful Ransomware Virus Recovery
A customer contacted Progent after their network was penetrated by Ryuk ransomware. Ryuk is thought to have been created by North Korean state sponsored hackers, suspected of using techniques exposed from the United States NSA organization. Ryuk attacks specific companies with limited room for operational disruption and is among the most profitable versions of ransomware viruses. Headline victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company based in Chicago and has about 500 workers. The Ryuk penetration had brought down all essential operations and manufacturing capabilities. Most of the client's data backups had been online at the start of the attack and were eventually encrypted. The client considered paying the ransom (more than two hundred thousand dollars) and hoping for the best, but ultimately engaged Progent.

Progent worked hand in hand the customer to rapidly identify and prioritize the critical areas that needed to be addressed to make it possible to continue business operations:

• Microsoft Active Directory
• E-Mail
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then completed reinstallations and storage recovery on essential servers. All Microsoft Exchange Server data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to find local OST data files (Outlook Off-Line Folder Files) on user desktop computers and laptops in order to recover mail data. A not too old offline backup of the businesses manufacturing systems made them able to return these essential programs back available to users. Although major work was left to recover fully from the Ryuk damage, essential services were restored quickly:

During the following few weeks important milestones in the restoration process were achieved in tight collaboration between Progent engineers and the customer:

• Internal web applications were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was brought online and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control functions were 100 percent recovered.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Ninety percent of the desktop computers were being used by staff.

Conclusion
A probable business extinction catastrophe was avoided through the efforts of results-oriented experts, a broad spectrum of subject matter expertise, and close collaboration. Although in retrospect the ransomware virus attack described here could have been identified and stopped with up-to-date security technology and recognized best practices, user and IT administrator education, and appropriate incident response procedures for information backup and keeping systems up to date with security patches, the fact is that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware attack, remember that Progent's team of experts has proven experience in ransomware virus defense, removal, and data restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in San Rafael
For ransomware system recovery expertise in the San Rafael metro area, phone Progent at 800-462-8800 or see Contact Progent.