Ransomware Filtering and Cleanup Services Seattle

Ransomware : Your Worst IT Nightmare
Ransomware has become a modern cyberplague that poses an existential threat for businesses of all sizes vulnerable to an assault. Versions of ransomware like the CryptoLocker, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been around for years and still cause harm. More recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as additional as yet unnamed newcomers, not only perform encryption of on-line files but also infiltrate many available system restores and backups. Information synchronized to off-premises disaster recovery sites can also be ransomed. In a poorly architected system, it can render any restore operations useless and basically knocks the datacenter back to zero.

Recovering programs and information after a ransomware intrusion becomes a race against time as the targeted organization tries its best to contain the damage, clear the ransomware, and resume enterprise-critical activity. Since ransomware takes time to move laterally throughout a targeted network, assaults are usually sprung on weekends, when successful penetrations may take longer to discover. This compounds the difficulty of rapidly mobilizing and coordinating a qualified mitigation team.

Progent makes available a variety of support services for protecting Seattle organizations from crypto-ransomware events. These include team education to help identify and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat defense to discover and quarantine zero-day malware attacks. Progent also offers the assistance of expert crypto-ransomware recovery professionals with the skills and commitment to reconstruct a compromised network as quickly as possible.

Progent's Ransomware Recovery Help
Soon after a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will respond with the keys to decipher all your data. Kaspersky determined that seventeen percent of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to setup from scratch the critical elements of your IT environment. Without access to full data backups, this calls for a broad range of skill sets, well-coordinated team management, and the willingness to work 24x7 until the job is complete.

For twenty years, Progent has offered expert IT services for companies throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained high-level industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in accounting and ERP applications. This breadth of experience gives Progent the skills to rapidly determine necessary systems and integrate the surviving components of your Information Technology environment following a crypto-ransomware attack and assemble them into an operational network.

Progent's recovery team of experts uses top notch project management applications to coordinate the complex restoration process. Progent understands the importance of working rapidly and in unison with a customer's management and Information Technology team members to prioritize tasks and to put key applications back on line as fast as humanly possible.

Case Study: A Successful Ransomware Virus Restoration
A small business contacted Progent after their organization was penetrated by Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean government sponsored hackers, suspected of using approaches exposed from America's NSA organization. Ryuk targets specific companies with little or no ability to sustain operational disruption and is one of the most profitable versions of ransomware malware. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company located in the Chicago metro area with about 500 staff members. The Ryuk event had shut down all business operations and manufacturing capabilities. The majority of the client's system backups had been online at the beginning of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but in the end called Progent.

Progent worked together with the customer to rapidly understand and prioritize the essential areas that needed to be addressed in order to restart business functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Accounting/MRP

Within 2 days, Progent was able to recover Active Directory services to its pre-penetration state. Progent then initiated setup and hard drive recovery on essential systems. All Microsoft Exchange Server schema and attributes were usable, which facilitated the restore of Exchange. Progent was also able to find intact OST data files (Outlook Email Off-Line Data Files) on team PCs in order to recover email messages. A recent offline backup of the businesses financials/MRP systems made it possible to return these vital services back online. Although a lot of work was left to recover completely from the Ryuk attack, critical services were recovered rapidly:

Over the next month critical milestones in the restoration process were completed through close cooperation between Progent consultants and the customer:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Server containing more than 4 million archived messages was brought online and available for users.
• CRM/Customer Orders/Invoicing/AP/AR/Inventory Control functions were 100 percent operational.
• A new Palo Alto 850 security appliance was brought online.
• Nearly all of the user desktops were being used by staff.

Conclusion
A likely business-killing catastrophe was avoided by dedicated experts, a broad array of knowledge, and close teamwork. Although in post mortem the crypto-ransomware virus attack detailed here could have been identified and prevented with advanced cyber security technology solutions and recognized best practices, team training, and appropriate security procedures for data backup and proper patching controls, the reality remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware virus, remember that Progent's roster of experts has proven experience in ransomware virus defense, mitigation, and information systems restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Seattle
For ransomware cleanup expertise in the Seattle area, phone Progent at 800-462-8800 or go to Contact Progent.