Ransomware Filtering and Cleanup Consulting Scottsdale
Ransomware System-Rebuild: An Example
Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a too-frequent cyberplague that presents an enterprise-level threat for organizations poorly prepared for an attack. Multiple generations of crypto-ransomware like the Reveton, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for a long time and still inflict damage. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, along with additional unnamed viruses, not only encrypt online files but also infect any accessible system protection. Files synched to cloud environments can also be ransomed. In a poorly designed data protection solution, it can make automated restoration useless and effectively knocks the datacenter back to square one.
Getting back applications and information after a ransomware outage becomes a sprint against time as the targeted business struggles to contain the damage, cleanup the virus, and resume business-critical operations. Due to the fact that ransomware needs time to move laterally across a targeted network, assaults are frequently launched at night, when successful penetrations in many cases take more time to uncover. This compounds the difficulty of rapidly mobilizing and organizing a qualified response team.
Progent has a range of support services for securing Scottsdale enterprises from ransomware events. Among these are team member education to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to detect and disable zero-day malware assaults. Progent in addition can provide the assistance of experienced ransomware recovery consultants with the talent and perseverance to reconstruct a breached network as rapidly as possible.
Progent's Ransomware Recovery Support Services
After a crypto-ransomware event, sending the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the codes to decipher all your files. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their files even after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The alternative is to piece back together the mission-critical elements of your IT environment. Without the availability of full data backups, this calls for a wide range of IT skills, professional project management, and the willingness to work continuously until the recovery project is complete.
For decades, Progent has made available professional Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained top industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in accounting and ERP software solutions. This breadth of expertise affords Progent the skills to efficiently identify important systems and re-organize the remaining components of your Information Technology environment after a crypto-ransomware event and rebuild them into a functioning network.
Progent's security group deploys powerful project management applications to coordinate the sophisticated restoration process. Progent appreciates the urgency of working rapidly and in unison with a client's management and IT team members to prioritize tasks and to put the most important services back on line as soon as humanly possible.
Client Story: A Successful Ransomware Intrusion Recovery
A small business escalated to Progent after their organization was crashed by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state hackers, suspected of adopting algorithms leaked from the U.S. NSA organization. Ryuk goes after specific companies with little or no ability to sustain disruption and is one of the most lucrative instances of crypto-ransomware. Major targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing business located in the Chicago metro area with about 500 workers. The Ryuk penetration had brought down all business operations and manufacturing capabilities. The majority of the client's data protection had been online at the start of the intrusion and were damaged. The client considered paying the ransom demand (in excess of two hundred thousand dollars) and hoping for the best, but in the end made the decision to use Progent.
Progent worked hand in hand the customer to quickly determine and assign priority to the most important applications that needed to be restored to make it possible to resume company operations:
- Active Directory
- Electronic Mail
- MRP System
In less than 2 days, Progent was able to re-build Active Directory services to its pre-virus state. Progent then helped perform rebuilding and storage recovery of key applications. All Exchange Server schema and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to find local OST files (Microsoft Outlook Off-Line Data Files) on user desktop computers and laptops in order to recover email data. A not too old offline backup of the customer's financials/MRP systems made them able to recover these required applications back online for users. Although a large amount of work needed to be completed to recover fully from the Ryuk damage, critical services were returned to operations quickly:
Throughout the following couple of weeks important milestones in the restoration process were made through close collaboration between Progent team members and the client:
- In-house web sites were returned to operation with no loss of data.
- The MailStore Exchange Server exceeding 4 million historical emails was brought on-line and accessible to users.
- CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory functions were 100% recovered.
- A new Palo Alto 850 security appliance was installed and configured.
- Ninety percent of the user workstations were operational.
Conclusion
A probable business-ending catastrophe was dodged by hard-working professionals, a broad range of technical expertise, and tight collaboration. Although in hindsight the ransomware penetration detailed here should have been identified and prevented with current cyber security solutions and NIST Cybersecurity Framework best practices, user education, and appropriate security procedures for data protection and keeping systems up to date with security patches, the reality remains that state-sponsored cybercriminals from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a crypto-ransomware incident, feel confident that Progent's team of experts has a proven track record in ransomware virus defense, mitigation, and information systems restoration.
Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware System Restoration Consulting Services in Scottsdale
For ransomware recovery services in the Scottsdale metro area, call Progent at
Select Topic: