Ransomware Filtering and Cleanup Expertise Santa Monica

Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that presents an extinction-level threat for businesses vulnerable to an attack. Different versions of crypto-ransomware such as Reveton, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for years and still cause damage. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, along with daily unnamed malware, not only encrypt online files but also infect any accessible system backups. Data replicated to cloud environments can also be encrypted. In a poorly architected system, this can render automatic restoration hopeless and effectively knocks the entire system back to zero.

Restoring services and data following a ransomware attack becomes a race against time as the targeted business fights to stop the spread, clear the ransomware, and restore mission-critical operations. Because ransomware needs time to move laterally across a targeted network, assaults are often sprung during weekends and nights, when penetrations tend to take longer to uncover. This compounds the difficulty of rapidly mobilizing and orchestrating a qualified response team.

Progent has an assortment of solutions for protecting Santa Monica businesses from ransomware attacks. These include team education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat defense to discover and quarantine zero-day malware assaults. Progent in addition provides the services of expert ransomware recovery professionals with the track record and commitment to re-deploy a compromised environment as rapidly as possible.

Progent's Ransomware Restoration Services
After a crypto-ransomware invasion, even paying the ransom in cryptocurrency does not ensure that criminal gangs will return the keys to decrypt any of your files. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to piece back together the vital elements of your Information Technology environment. Absent access to complete information backups, this requires a wide complement of skill sets, professional project management, and the ability to work continuously until the recovery project is over.

For two decades, Progent has offered professional IT services for businesses throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have been awarded top certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial management and ERP application software. This breadth of experience provides Progent the skills to rapidly understand necessary systems and integrate the surviving pieces of your Information Technology system after a ransomware attack and rebuild them into an operational system.

Progent's security team has powerful project management systems to orchestrate the sophisticated restoration process. Progent knows the importance of acting quickly and in concert with a client's management and Information Technology staff to assign priority to tasks and to put essential applications back on line as fast as humanly possible.

Customer Story: A Successful Ransomware Attack Restoration
A customer engaged Progent after their company was crashed by the Ryuk ransomware. Ryuk is believed to have been developed by North Korean state sponsored cybercriminals, possibly adopting strategies leaked from America's NSA organization. Ryuk seeks specific organizations with little room for disruption and is one of the most profitable iterations of ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company located in Chicago with about 500 workers. The Ryuk event had disabled all essential operations and manufacturing processes. Most of the client's data protection had been on-line at the start of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (exceeding $200K) and praying for the best, but ultimately engaged Progent.

Progent worked together with the customer to rapidly understand and assign priority to the key areas that had to be restored in order to restart departmental operations:

• Active Directory
• E-Mail
• Financials/MRP

In less than two days, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then performed reinstallations and storage recovery of mission critical servers. All Exchange Server data and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to find local OST files (Outlook Email Off-Line Folder Files) on user PCs in order to recover mail information. A not too old offline backup of the client's financials/ERP software made it possible to recover these required programs back available to users. Although a lot of work needed to be completed to recover fully from the Ryuk virus, critical systems were returned to operations rapidly:

Throughout the following month critical milestones in the restoration process were achieved through tight cooperation between Progent engineers and the client:

• In-house web sites were brought back up without losing any data.
• The MailStore Exchange Server containing more than four million historical messages was restored to operations and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control capabilities were 100% recovered.
• A new Palo Alto 850 security appliance was set up.
• Ninety percent of the user desktops and notebooks were back into operation.

Conclusion
A probable business-killing disaster was avoided with top-tier experts, a wide spectrum of technical expertise, and close teamwork. Although in retrospect the crypto-ransomware virus incident detailed here would have been identified and stopped with up-to-date cyber security systems and recognized best practices, user education, and well designed incident response procedures for data protection and keeping systems up to date with security patches, the reality remains that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware incident, remember that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, remediation, and file disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Santa Monica
For ransomware cleanup consulting services in the Santa Monica area, phone Progent at 800-462-8800 or go to Contact Progent.