Ransomware Defense and Recovery Expertise São Paulo

Crypto-Ransomware : Your Crippling IT Catastrophe
Ransomware has become a modern cyber pandemic that poses an existential danger for businesses unprepared for an assault. Versions of crypto-ransomware such as CrySIS, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for many years and continue to inflict damage. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus daily unnamed malware, not only encrypt online data files but also infiltrate most accessible system restores and backups. Files replicated to off-premises disaster recovery sites can also be ransomed. In a poorly architected system, it can make automatic recovery useless and basically sets the network back to square one.

Recovering programs and information after a ransomware outage becomes a race against the clock as the targeted organization struggles to stop lateral movement, remove the ransomware, and restore enterprise-critical operations. Because crypto-ransomware takes time to spread throughout a network, attacks are often sprung on weekends, when successful penetrations in many cases take more time to discover. This multiplies the difficulty of promptly mobilizing and coordinating a capable response team.

Progent offers a variety of services for securing São Paulo organizations from ransomware attacks. These include user training to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to discover and extinguish day-zero malware attacks. Progent also offers the services of expert crypto-ransomware recovery engineers with the talent and perseverance to reconstruct a breached network as urgently as possible.

Progent's Ransomware Restoration Services
Soon after a crypto-ransomware penetration, sending the ransom in cryptocurrency does not guarantee that cyber criminals will respond with the codes to decrypt any or all of your data. Kaspersky determined that 17% of crypto-ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to re-install the key components of your Information Technology environment. Absent the availability of full system backups, this requires a wide range of IT skills, well-coordinated project management, and the willingness to work continuously until the job is finished.

For two decades, Progent has made available expert Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have been awarded high-level industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of expertise affords Progent the skills to quickly understand critical systems and consolidate the remaining components of your computer network environment following a ransomware attack and configure them into a functioning system.

Progent's security team of experts deploys state-of-the-art project management systems to orchestrate the sophisticated recovery process. Progent knows the importance of working swiftly and in unison with a customer's management and IT staff to prioritize tasks and to get critical systems back online as fast as possible.

Business Case Study: A Successful Ransomware Incident Restoration
A customer escalated to Progent after their company was taken over by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state cybercriminals, possibly using algorithms exposed from the U.S. NSA organization. Ryuk attacks specific businesses with limited room for disruption and is one of the most profitable versions of ransomware viruses. Major targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in the Chicago metro area with about 500 staff members. The Ryuk intrusion had shut down all business operations and manufacturing capabilities. Most of the client's data protection had been online at the beginning of the intrusion and were eventually encrypted. The client was evaluating paying the ransom demand (more than $200,000) and wishfully thinking for good luck, but ultimately engaged Progent.

Progent worked together with the client to rapidly assess and prioritize the mission critical systems that had to be restored to make it possible to continue departmental operations:

• Microsoft Active Directory
• E-Mail
• Accounting and Manufacturing Software

Within 2 days, Progent was able to rebuild Active Directory to its pre-penetration state. Progent then accomplished setup and hard drive recovery of critical servers. All Microsoft Exchange Server data and attributes were intact, which greatly helped the restore of Exchange. Progent was able to collect local OST data files (Outlook Offline Data Files) on staff desktop computers in order to recover email information. A not too old offline backup of the client's accounting software made them able to recover these vital programs back online. Although a lot of work needed to be completed to recover fully from the Ryuk attack, core services were returned to operations rapidly:

Throughout the following couple of weeks critical milestones in the recovery process were accomplished in close cooperation between Progent engineers and the customer:

• Self-hosted web applications were brought back up without losing any information.
• The MailStore Exchange Server exceeding four million archived messages was spun up and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were completely restored.
• A new Palo Alto Networks 850 firewall was deployed.
• Most of the user PCs were fully operational.

Conclusion
A likely business-killing catastrophe was averted with top-tier professionals, a wide spectrum of IT skills, and tight collaboration. Although in hindsight the ransomware incident detailed here would have been identified and stopped with up-to-date cyber security technology and ISO/IEC 27001 best practices, team training, and well designed security procedures for data backup and proper patching controls, the reality is that government-sponsored hackers from China, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware incident, feel confident that Progent's roster of experts has substantial experience in crypto-ransomware virus defense, removal, and file disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in São Paulo
For ransomware system restoration consulting in the São Paulo metro area, call Progent at 800-462-8800 or see Contact Progent.