Ransomware Defense and Removal Expertise Shreveport

Crypto-Ransomware : Your Feared IT Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an existential danger for businesses of all sizes unprepared for an attack. Versions of crypto-ransomware such as Reveton, Fusob, Locky, Syskey and MongoLock cryptoworms have been running rampant for a long time and continue to inflict destruction. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, plus additional unnamed malware, not only encrypt on-line information but also infiltrate all configured system protection mechanisms. Files replicated to off-premises disaster recovery sites can also be corrupted. In a poorly designed system, it can make any restore operations useless and effectively knocks the datacenter back to square one.

Getting back on-line applications and data after a ransomware event becomes a race against time as the targeted business fights to contain the damage, eradicate the crypto-ransomware, and restore enterprise-critical activity. Since ransomware requires time to replicate throughout a targeted network, penetrations are frequently sprung on weekends, when successful penetrations tend to take longer to uncover. This compounds the difficulty of promptly marshalling and coordinating a qualified response team.

Progent makes available an assortment of solutions for protecting Shreveport businesses from crypto-ransomware attacks. These include user education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat protection to detect and extinguish zero-day malware assaults. Progent also can provide the services of seasoned ransomware recovery professionals with the track record and commitment to reconstruct a compromised system as quickly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a ransomware invasion, sending the ransom demands in cryptocurrency does not provide any assurance that distant criminals will return the codes to unencrypt any or all of your data. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never restored their files after having paid the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to re-install the critical components of your IT environment. Without access to complete data backups, this calls for a broad range of IT skills, professional team management, and the capability to work non-stop until the task is over.

For twenty years, Progent has offered certified expert Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have attained high-level certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial management and ERP software solutions. This breadth of experience provides Progent the ability to efficiently determine necessary systems and integrate the surviving components of your Information Technology environment following a ransomware attack and rebuild them into an operational network.

Progent's recovery team utilizes state-of-the-art project management systems to coordinate the complicated recovery process. Progent appreciates the urgency of working quickly and together with a client's management and Information Technology staff to prioritize tasks and to put the most important services back on line as soon as humanly possible.

Client Story: A Successful Ransomware Intrusion Restoration
A customer hired Progent after their company was taken over by Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean government sponsored criminal gangs, suspected of using techniques leaked from the United States National Security Agency. Ryuk attacks specific businesses with limited tolerance for disruption and is one of the most profitable incarnations of ransomware viruses. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in Chicago and has around 500 employees. The Ryuk attack had disabled all essential operations and manufacturing capabilities. The majority of the client's data backups had been on-line at the beginning of the attack and were eventually encrypted. The client was taking steps for paying the ransom demand (in excess of $200K) and hoping for good luck, but ultimately brought in Progent.

Progent worked with the customer to rapidly determine and prioritize the mission critical areas that had to be addressed in order to continue business functions:

• Active Directory (AD)
• E-Mail
• Accounting/MRP

Within 48 hours, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then initiated rebuilding and storage recovery on essential servers. All Microsoft Exchange Server data and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to collect local OST files (Outlook Off-Line Folder Files) on staff desktop computers in order to recover mail information. A recent off-line backup of the customer's accounting software made them able to recover these vital services back servicing users. Although significant work still had to be done to recover completely from the Ryuk damage, core systems were restored rapidly:

During the next couple of weeks key milestones in the restoration project were achieved in tight cooperation between Progent team members and the client:

• Self-hosted web applications were restored without losing any information.
• The MailStore Exchange Server containing more than 4 million archived emails was brought on-line and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were 100% restored.
• A new Palo Alto Networks 850 firewall was set up.
• Most of the user desktops and notebooks were operational.

Conclusion
A likely business-ending catastrophe was avoided by dedicated experts, a wide spectrum of subject matter expertise, and close teamwork. Although in post mortem the ransomware virus penetration described here could have been identified and prevented with modern security solutions and best practices, user and IT administrator education, and well thought out security procedures for information protection and keeping systems up to date with security patches, the fact remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware incident, remember that Progent's team of professionals has substantial experience in ransomware virus blocking, removal, and file restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Shreveport
For ransomware cleanup expertise in the Shreveport area, call Progent at 800-462-8800 or go to Contact Progent.