Ransomware Defense and Restoration Consulting Santiago

Ransomware : Your Worst IT Catastrophe
Ransomware has become a modern cyber pandemic that represents an enterprise-level danger for organizations unprepared for an assault. Different versions of ransomware such as CryptoLocker, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been replicating for many years and continue to cause destruction. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, plus additional as yet unnamed viruses, not only perform encryption of online data files but also infect any accessible system restores and backups. Data synched to the cloud can also be encrypted. In a poorly architected environment, this can make any restore operations useless and effectively knocks the datacenter back to zero.

Getting back services and information after a ransomware intrusion becomes a sprint against time as the victim struggles to contain, clear the virus, and resume enterprise-critical operations. Due to the fact that ransomware needs time to spread throughout a network, penetrations are usually launched on weekends and holidays, when attacks may take more time to detect. This multiplies the difficulty of rapidly marshalling and organizing a capable mitigation team.

Progent makes available an assortment of support services for securing Santiago businesses from ransomware attacks. These include staff education to help recognize and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to detect and quarantine zero-day malware assaults. Progent also can provide the assistance of experienced ransomware recovery professionals with the skills and perseverance to reconstruct a breached environment as rapidly as possible.

Progent's Ransomware Restoration Help
Following a ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that criminal gangs will provide the needed keys to decipher all your data. Kaspersky Labs determined that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to re-install the vital components of your IT environment. Absent access to essential information backups, this requires a broad range of IT skills, well-coordinated project management, and the ability to work continuously until the recovery project is done.

For two decades, Progent has made available professional Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned advanced industry certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial systems and ERP applications. This breadth of experience gives Progent the skills to rapidly understand important systems and re-organize the surviving components of your IT system following a ransomware penetration and rebuild them into an operational system.

Progent's recovery team utilizes powerful project management systems to orchestrate the complex restoration process. Progent understands the importance of acting rapidly and in concert with a customer's management and IT team members to assign priority to tasks and to put essential systems back on-line as soon as possible.

Client Story: A Successful Ransomware Incident Recovery
A small business hired Progent after their network was crashed by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean government sponsored cybercriminals, possibly adopting algorithms exposed from the U.S. National Security Agency. Ryuk goes after specific organizations with little or no ability to sustain operational disruption and is one of the most profitable incarnations of ransomware malware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer headquartered in Chicago and has about 500 workers. The Ryuk attack had paralyzed all company operations and manufacturing processes. Most of the client's data protection had been directly accessible at the time of the attack and were damaged. The client was evaluating paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but in the end engaged Progent.

Progent worked hand in hand the customer to quickly assess and assign priority to the mission critical systems that needed to be addressed in order to continue departmental operations:

• Windows Active Directory
• Email
• Financials/MRP

Within 2 days, Progent was able to re-build Windows Active Directory to its pre-penetration state. Progent then initiated setup and hard drive recovery on mission critical servers. All Exchange Server schema and attributes were intact, which facilitated the restore of Exchange. Progent was also able to find local OST files (Microsoft Outlook Offline Folder Files) on various workstations to recover email messages. A not too old offline backup of the client's accounting/ERP systems made it possible to restore these required programs back online. Although a lot of work still had to be done to recover completely from the Ryuk event, the most important services were recovered rapidly:

Over the following few weeks key milestones in the restoration process were completed in tight collaboration between Progent team members and the client:

• Internal web applications were restored without losing any data.
• The MailStore Exchange Server exceeding 4 million archived emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory Control capabilities were 100 percent functional.
• A new Palo Alto 850 security appliance was set up.
• Most of the user desktops were functioning as before the incident.

Conclusion
A potential business-ending catastrophe was avoided due to top-tier experts, a broad range of technical expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware incident detailed here could have been identified and disabled with modern security technology solutions and ISO/IEC 27001 best practices, team education, and appropriate incident response procedures for data protection and applying software patches, the reality is that state-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has proven experience in crypto-ransomware virus defense, mitigation, and data recovery.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Santiago
For ransomware recovery consulting services in the Santiago metro area, call Progent at 800-462-8800 or see Contact Progent.