Ransomware Defense and Restoration Expertise Santos

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that presents an extinction-level threat for businesses of all sizes poorly prepared for an assault. Different iterations of crypto-ransomware like the Dharma, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for many years and continue to cause havoc. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, along with additional unnamed newcomers, not only encrypt online data files but also infect any accessible system protection mechanisms. Data synched to cloud environments can also be corrupted. In a poorly architected system, it can render automated restoration hopeless and basically knocks the datacenter back to zero.

Getting back on-line applications and data following a crypto-ransomware attack becomes a race against the clock as the victim struggles to contain, remove the crypto-ransomware, and restore business-critical operations. Because crypto-ransomware takes time to move laterally throughout a targeted network, penetrations are often sprung during weekends and nights, when attacks may take more time to detect. This multiplies the difficulty of quickly assembling and coordinating a qualified response team.

Progent has a range of services for securing Santos businesses from ransomware events. These include team education to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to identify and extinguish zero-day malware assaults. Progent in addition provides the services of seasoned crypto-ransomware recovery consultants with the talent and commitment to re-deploy a compromised environment as soon as possible.

Progent's Ransomware Recovery Support Services
Soon after a crypto-ransomware event, paying the ransom in cryptocurrency does not ensure that distant criminals will provide the codes to unencrypt any of your data. Kaspersky Labs ascertained that seventeen percent of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to piece back together the essential elements of your Information Technology environment. Absent access to full information backups, this requires a wide range of skill sets, well-coordinated project management, and the ability to work 24x7 until the job is over.

For twenty years, Progent has provided certified expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained advanced certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of expertise provides Progent the capability to rapidly determine necessary systems and re-organize the surviving components of your IT system after a crypto-ransomware penetration and configure them into a functioning network.

Progent's recovery team of experts uses powerful project management systems to orchestrate the complicated restoration process. Progent knows the importance of working quickly and in unison with a client's management and Information Technology staff to prioritize tasks and to put key systems back online as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Intrusion Response
A business escalated to Progent after their network system was brought down by the Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean government sponsored hackers, suspected of adopting techniques leaked from the United States National Security Agency. Ryuk targets specific companies with little room for disruption and is among the most profitable instances of ransomware viruses. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in the Chicago metro area and has about 500 employees. The Ryuk intrusion had paralyzed all business operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the start of the attack and were encrypted. The client was actively seeking loans for paying the ransom (exceeding two hundred thousand dollars) and hoping for the best, but in the end utilized Progent.

Progent worked with the client to quickly get our arms around and prioritize the critical areas that needed to be restored to make it possible to continue business operations:

• Windows Active Directory
• Email
• MRP System

Within 48 hours, Progent was able to re-build Active Directory services to its pre-attack state. Progent then completed reinstallations and hard drive recovery on key servers. All Exchange Server ties and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to find non-encrypted OST files (Microsoft Outlook Offline Folder Files) on various PCs and laptops in order to recover email messages. A not too old offline backup of the businesses financials/ERP software made it possible to restore these vital programs back servicing users. Although a large amount of work remained to recover totally from the Ryuk damage, the most important systems were returned to operations quickly:

Throughout the next month important milestones in the restoration process were made in close collaboration between Progent engineers and the customer:

• Internal web sites were restored without losing any data.
• The MailStore Exchange Server containing more than four million historical emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were fully recovered.
• A new Palo Alto 850 security appliance was installed.
• Most of the desktops and laptops were operational.

Conclusion
A probable business-killing disaster was dodged through the efforts of dedicated experts, a wide spectrum of subject matter expertise, and close collaboration. Although upon completion of forensics the crypto-ransomware virus incident detailed here could have been identified and stopped with advanced cyber security technology solutions and ISO/IEC 27001 best practices, staff education, and properly executed security procedures for information backup and proper patching controls, the reality remains that state-sponsored hackers from Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware incident, remember that Progent's team of experts has substantial experience in ransomware virus blocking, remediation, and data recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Santos
For ransomware cleanup expertise in the Santos metro area, call Progent at 800-462-8800 or visit Contact Progent.