Ransomware Defense and Restoration Solutions Spokane

Crypto-Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that represents an existential danger for businesses of all sizes unprepared for an attack. Multiple generations of crypto-ransomware such as Dharma, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for many years and continue to inflict destruction. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, as well as additional as yet unnamed newcomers, not only encrypt on-line data but also infiltrate many configured system protection. Information synchronized to the cloud can also be corrupted. In a vulnerable environment, it can render automated recovery impossible and effectively sets the network back to zero.

Restoring services and data following a crypto-ransomware outage becomes a race against the clock as the targeted organization fights to contain, remove the crypto-ransomware, and restore mission-critical operations. Due to the fact that crypto-ransomware takes time to spread across a network, assaults are frequently launched on weekends, when penetrations typically take longer to notice. This multiplies the difficulty of promptly marshalling and orchestrating a capable mitigation team.

Progent provides a variety of solutions for securing Spokane organizations from crypto-ransomware attacks. Among these are staff training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to detect and suppress day-zero modern malware assaults. Progent in addition can provide the services of experienced crypto-ransomware recovery consultants with the track record and commitment to reconstruct a breached system as urgently as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will return the needed keys to unencrypt any or all of your information. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to setup from scratch the key parts of your IT environment. Absent access to essential information backups, this requires a wide range of skill sets, professional team management, and the willingness to work continuously until the job is finished.

For two decades, Progent has provided certified expert IT services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded top certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial management and ERP software solutions. This breadth of experience affords Progent the capability to knowledgably determine necessary systems and organize the surviving pieces of your network system after a ransomware attack and configure them into a functioning network.

Progent's recovery team utilizes top notch project management applications to coordinate the sophisticated recovery process. Progent understands the importance of working quickly and together with a client's management and IT staff to assign priority to tasks and to put the most important applications back online as fast as humanly possible.

Client Case Study: A Successful Ransomware Virus Response
A customer escalated to Progent after their organization was taken over by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored criminal gangs, suspected of adopting approaches leaked from America's NSA organization. Ryuk targets specific businesses with limited ability to sustain operational disruption and is among the most profitable instances of ransomware viruses. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing business based in Chicago with about 500 employees. The Ryuk intrusion had shut down all company operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the beginning of the attack and were eventually encrypted. The client was taking steps for paying the ransom (in excess of $200,000) and hoping for good luck, but ultimately brought in Progent.

Progent worked with the client to rapidly determine and prioritize the mission critical elements that needed to be addressed to make it possible to continue company functions:

• Microsoft Active Directory
• E-Mail
• Accounting and Manufacturing Software

Within two days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then helped perform reinstallations and storage recovery on the most important systems. All Exchange Server schema and configuration information were usable, which facilitated the restore of Exchange. Progent was able to find local OST data files (Microsoft Outlook Offline Folder Files) on team workstations and laptops to recover email information. A not too old offline backup of the businesses accounting systems made them able to restore these required applications back online. Although a lot of work needed to be completed to recover totally from the Ryuk damage, core services were restored quickly:

Throughout the following couple of weeks important milestones in the restoration project were completed in tight collaboration between Progent consultants and the customer:

• Self-hosted web sites were restored with no loss of information.
• The MailStore Microsoft Exchange Server containing more than 4 million historical messages was brought on-line and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control functions were completely restored.
• A new Palo Alto Networks 850 firewall was set up.
• Most of the desktop computers were being used by staff.

Conclusion
A probable enterprise-killing catastrophe was evaded with dedicated experts, a wide array of knowledge, and close teamwork. Although in analyzing the event afterwards the ransomware virus incident described here would have been identified and blocked with up-to-date security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and appropriate security procedures for data protection and keeping systems up to date with security patches, the fact remains that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and will continue. If you do get hit by a ransomware incident, remember that Progent's roster of professionals has a proven track record in crypto-ransomware virus blocking, mitigation, and information systems restoration.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Spokane
For ransomware system recovery consulting services in the Spokane metro area, phone Progent at 800-462-8800 or visit Contact Progent.