Ransomware Prevention and Cleanup Services Santa Rosa

Crypto-Ransomware : Your Worst IT Catastrophe
Ransomware has become an escalating cyber pandemic that presents an extinction-level danger for organizations poorly prepared for an attack. Versions of ransomware like the CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for a long time and still cause havoc. Newer versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus more unnamed newcomers, not only perform encryption of on-line data but also infiltrate any accessible system protection mechanisms. Data synched to the cloud can also be encrypted. In a poorly designed system, this can make automated restore operations impossible and basically sets the network back to square one.

Recovering applications and data after a ransomware event becomes a sprint against time as the victim tries its best to contain the damage, eradicate the virus, and resume mission-critical activity. Since ransomware takes time to move laterally throughout a targeted network, attacks are usually launched on weekends, when successful attacks typically take longer to recognize. This compounds the difficulty of quickly marshalling and organizing a qualified mitigation team.

Progent has an assortment of solutions for securing Santa Rosa enterprises from crypto-ransomware penetrations. These include staff training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to identify and quarantine zero-day modern malware attacks. Progent also offers the services of veteran ransomware recovery engineers with the skills and perseverance to restore a compromised network as rapidly as possible.

Progent's Ransomware Recovery Help
After a ransomware penetration, sending the ransom demands in cryptocurrency does not ensure that cyber hackers will provide the keys to decipher any or all of your files. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The fallback is to re-install the key parts of your IT environment. Without the availability of essential system backups, this calls for a wide complement of IT skills, well-coordinated project management, and the ability to work 24x7 until the recovery project is finished.

For decades, Progent has provided certified expert IT services for companies throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded advanced certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP application software. This breadth of experience affords Progent the skills to knowledgably identify critical systems and re-organize the remaining pieces of your computer network environment following a ransomware penetration and configure them into an operational network.

Progent's security group has best of breed project management systems to coordinate the sophisticated restoration process. Progent appreciates the urgency of acting quickly and in concert with a customer's management and IT team members to assign priority to tasks and to get key services back on-line as soon as possible.

Customer Case Study: A Successful Ransomware Virus Restoration
A client engaged Progent after their organization was brought down by the Ryuk ransomware virus. Ryuk is believed to have been deployed by North Korean state hackers, suspected of using approaches exposed from America's National Security Agency. Ryuk attacks specific companies with little ability to sustain operational disruption and is among the most lucrative incarnations of ransomware viruses. Major targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing company based in the Chicago metro area with about 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing processes. Most of the client's data protection had been on-line at the start of the intrusion and were destroyed. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but ultimately utilized Progent.

Progent worked hand in hand the customer to rapidly get our arms around and assign priority to the critical applications that had to be restored to make it possible to continue company functions:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

Within two days, Progent was able to re-build Active Directory to its pre-virus state. Progent then initiated reinstallations and storage recovery of needed servers. All Exchange ties and configuration information were intact, which facilitated the restore of Exchange. Progent was able to find non-encrypted OST data files (Outlook Off-Line Folder Files) on staff desktop computers in order to recover email messages. A recent offline backup of the customer's financials/MRP systems made it possible to return these vital services back online. Although a large amount of work was left to recover fully from the Ryuk virus, essential systems were recovered rapidly:

Over the following few weeks critical milestones in the recovery project were made through close cooperation between Progent engineers and the client:

• Internal web applications were restored without losing any data.
• The MailStore Microsoft Exchange Server containing more than 4 million historical emails was spun up and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/AR/Inventory capabilities were fully operational.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Ninety percent of the user desktops and notebooks were operational.

Conclusion
A potential company-ending disaster was evaded with results-oriented professionals, a broad spectrum of subject matter expertise, and tight teamwork. Although in retrospect the ransomware attack detailed here would have been identified and stopped with modern security technology and security best practices, staff education, and well thought out incident response procedures for backup and keeping systems up to date with security patches, the fact is that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware incident, remember that Progent's team of experts has extensive experience in ransomware virus defense, remediation, and data disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Santa Rosa
For ransomware recovery consulting services in the Santa Rosa area, phone Progent at 800-462-8800 or go to Contact Progent.