Ransomware Protection and Remediation Services Spartanburg
Ransomware Cleanup: An Example
Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware has become a too-frequent cyber pandemic that poses an existential threat for organizations vulnerable to an attack. Different iterations of crypto-ransomware like the Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been running rampant for many years and continue to inflict damage. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, along with daily unnamed malware, not only perform encryption of on-line data but also infiltrate all accessible system restores and backups. Data replicated to cloud environments can also be encrypted. In a poorly architected data protection solution, this can make automatic recovery impossible and basically knocks the network back to square one.
Recovering programs and data after a ransomware intrusion becomes a race against time as the targeted business tries its best to stop lateral movement, eradicate the ransomware, and resume mission-critical activity. Due to the fact that crypto-ransomware needs time to replicate throughout a network, penetrations are usually sprung during weekends and nights, when successful attacks may take more time to discover. This compounds the difficulty of promptly mobilizing and coordinating a capable mitigation team.
Progent makes available a range of solutions for securing Spartanburg organizations from ransomware events. Among these are team member education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to discover and disable day-zero malware attacks. Progent also can provide the assistance of veteran ransomware recovery engineers with the talent and commitment to rebuild a breached system as soon as possible.
Progent's Ransomware Restoration Services
Soon after a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not guarantee that cyber hackers will provide the needed codes to decrypt any or all of your data. Kaspersky determined that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The alternative is to re-install the essential parts of your Information Technology environment. Without the availability of complete information backups, this requires a broad range of skills, professional team management, and the ability to work 24x7 until the task is done.
For two decades, Progent has provided expert Information Technology services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained advanced certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with financial management and ERP application software. This breadth of expertise gives Progent the capability to quickly identify important systems and organize the remaining components of your Information Technology environment after a crypto-ransomware attack and configure them into an operational system.
Progent's recovery team has powerful project management applications to orchestrate the complicated recovery process. Progent appreciates the urgency of acting quickly and together with a client's management and IT team members to prioritize tasks and to get essential services back on-line as soon as possible.
Case Study: A Successful Ransomware Virus Response
A business sought out Progent after their company was taken over by the Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean state sponsored cybercriminals, possibly using approaches exposed from America's National Security Agency. Ryuk targets specific companies with little or no tolerance for disruption and is one of the most lucrative incarnations of ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company based in the Chicago metro area with about 500 workers. The Ryuk attack had shut down all company operations and manufacturing processes. Most of the client's backups had been on-line at the time of the attack and were destroyed. The client considered paying the ransom (in excess of $200,000) and hoping for the best, but in the end engaged Progent.
Progent worked with the client to quickly get our arms around and prioritize the essential applications that needed to be recovered in order to resume company operations:
- Microsoft Active Directory
- Accounting and Manufacturing Software
In less than 2 days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then accomplished rebuilding and hard drive recovery of critical applications. All Exchange ties and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to find local OST data files (Microsoft Outlook Offline Data Files) on team workstations and laptops to recover mail messages. A not too old off-line backup of the customer's accounting/MRP software made them able to recover these essential applications back online for users. Although a lot of work remained to recover fully from the Ryuk damage, critical services were recovered quickly:
Over the next few weeks important milestones in the recovery process were made in close collaboration between Progent team members and the client:
- Internal web sites were restored with no loss of information.
- The MailStore Exchange Server containing more than four million historical emails was brought online and accessible to users.
- CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control capabilities were 100 percent restored.
- A new Palo Alto 850 security appliance was brought on-line.
- Ninety percent of the user workstations were being used by staff.
Conclusion
A probable business disaster was evaded due to top-tier professionals, a broad spectrum of subject matter expertise, and close collaboration. Although upon completion of forensics the ransomware penetration detailed here could have been blocked with up-to-date cyber security technology and ISO/IEC 27001 best practices, user training, and appropriate security procedures for information protection and proper patching controls, the fact is that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, mitigation, and data disaster recovery.
Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware System Restoration Consulting in Spartanburg
For ransomware system restoration services in the Spartanburg metro area, call Progent at
Select Topic: