Ransomware Prevention and Remediation Consulting St. Paul

Crypto-Ransomware : Your Worst IT Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that poses an existential danger for organizations unprepared for an assault. Versions of crypto-ransomware like the Reveton, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for a long time and continue to inflict harm. More recent variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, along with frequent as yet unnamed viruses, not only perform encryption of online information but also infect any available system protection. Data synchronized to off-premises disaster recovery sites can also be encrypted. In a vulnerable data protection solution, this can render automated restoration hopeless and basically sets the datacenter back to square one.

Getting back on-line applications and information following a ransomware event becomes a sprint against time as the targeted organization tries its best to contain, remove the virus, and resume mission-critical activity. Due to the fact that ransomware needs time to move laterally across a targeted network, attacks are often sprung on weekends and holidays, when penetrations tend to take longer to detect. This multiplies the difficulty of promptly assembling and coordinating a capable mitigation team.

Progent has a range of solutions for securing St. Paul businesses from ransomware penetrations. Among these are team training to help identify and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to identify and disable day-zero modern malware assaults. Progent in addition provides the services of experienced crypto-ransomware recovery consultants with the track record and commitment to rebuild a breached environment as urgently as possible.

Progent's Ransomware Restoration Support Services
Following a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not ensure that cyber hackers will respond with the needed codes to decrypt any or all of your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their information even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to piece back together the mission-critical components of your Information Technology environment. Without access to full information backups, this calls for a broad complement of IT skills, top notch project management, and the ability to work 24x7 until the task is over.

For decades, Progent has made available certified expert IT services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded top certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of expertise gives Progent the skills to knowledgably understand necessary systems and re-organize the surviving parts of your computer network environment after a ransomware penetration and rebuild them into an operational network.

Progent's security group uses powerful project management tools to coordinate the complex recovery process. Progent understands the urgency of working quickly and together with a customer's management and IT team members to assign priority to tasks and to get key applications back on-line as fast as humanly possible.

Business Case Study: A Successful Ransomware Incident Response
A business contacted Progent after their organization was brought down by the Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state sponsored hackers, suspected of using techniques exposed from the U.S. NSA organization. Ryuk attacks specific organizations with little tolerance for disruption and is one of the most profitable incarnations of crypto-ransomware. Major victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business headquartered in Chicago with about 500 employees. The Ryuk penetration had shut down all company operations and manufacturing capabilities. Most of the client's backups had been directly accessible at the start of the intrusion and were encrypted. The client was evaluating paying the ransom (more than $200,000) and wishfully thinking for good luck, but in the end called Progent.

Progent worked together with the client to quickly identify and assign priority to the mission critical areas that had to be addressed in order to continue departmental functions:

• Active Directory (AD)
• E-Mail
• Financials/MRP

In less than two days, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then charged ahead with rebuilding and hard drive recovery on essential servers. All Exchange data and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to collect local OST files (Outlook Offline Folder Files) on team desktop computers to recover email information. A not too old off-line backup of the businesses manufacturing systems made them able to recover these essential applications back available to users. Although major work remained to recover fully from the Ryuk event, essential systems were returned to operations rapidly:

Over the following few weeks critical milestones in the restoration project were completed through close cooperation between Progent consultants and the customer:

• In-house web sites were returned to operation without losing any data.
• The MailStore Server exceeding four million historical messages was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory functions were completely recovered.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Most of the desktop computers were being used by staff.

Conclusion
A probable enterprise-killing catastrophe was averted by hard-working experts, a broad spectrum of knowledge, and close collaboration. Although in retrospect the ransomware attack detailed here could have been shut down with up-to-date security solutions and ISO/IEC 27001 best practices, team education, and appropriate incident response procedures for information backup and applying software patches, the fact remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware incursion, feel confident that Progent's team of professionals has a proven track record in ransomware virus blocking, remediation, and data disaster recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in St. Paul
For ransomware cleanup consulting services in the St. Paul metro area, call Progent at 800-462-8800 or go to Contact Progent.