Ransomware Protection and Remediation Solutions Stamford
Ransomware Recovery: An Example
Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that represents an extinction-level threat for businesses vulnerable to an assault. Different iterations of ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for a long time and still cause harm. Newer versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, plus additional as yet unnamed malware, not only encrypt online data files but also infect most configured system protection. Information replicated to the cloud can also be encrypted. In a poorly designed system, this can make automatic recovery hopeless and basically sets the datacenter back to zero.
Recovering services and data after a ransomware event becomes a sprint against the clock as the victim fights to contain the damage, eradicate the ransomware, and restore business-critical operations. Since crypto-ransomware needs time to move laterally throughout a network, assaults are often sprung at night, when attacks tend to take more time to detect. This multiplies the difficulty of rapidly assembling and coordinating a qualified mitigation team.
Progent offers a range of solutions for protecting Stamford businesses from crypto-ransomware penetrations. Among these are team member training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat protection to detect and extinguish day-zero modern malware assaults. Progent in addition provides the assistance of veteran crypto-ransomware recovery professionals with the track record and perseverance to reconstruct a compromised environment as rapidly as possible.
Progent's Crypto-Ransomware Restoration Services
Following a ransomware penetration, even paying the ransom in cryptocurrency does not provide any assurance that distant criminals will return the needed codes to unencrypt any of your data. Kaspersky Labs ascertained that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The fallback is to setup from scratch the key components of your IT environment. Absent the availability of full data backups, this calls for a broad range of skills, top notch team management, and the capability to work continuously until the task is done.
For twenty years, Progent has offered certified expert Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned top industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial management and ERP software solutions. This breadth of experience gives Progent the capability to rapidly identify necessary systems and integrate the surviving pieces of your computer network system following a ransomware attack and rebuild them into an operational system.
Progent's security team utilizes state-of-the-art project management tools to orchestrate the sophisticated restoration process. Progent appreciates the urgency of working rapidly and together with a client's management and IT resources to prioritize tasks and to put essential systems back on line as soon as humanly possible.
Case Study: A Successful Ransomware Attack Recovery
A customer escalated to Progent after their organization was penetrated by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean government sponsored cybercriminals, suspected of using algorithms exposed from the U.S. NSA organization. Ryuk goes after specific companies with limited tolerance for disruption and is one of the most lucrative incarnations of ransomware. Major targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company based in the Chicago metro area with around 500 staff members. The Ryuk penetration had paralyzed all business operations and manufacturing capabilities. Most of the client's system backups had been on-line at the beginning of the attack and were damaged. The client was pursuing financing for paying the ransom (more than $200,000) and wishfully thinking for good luck, but ultimately made the decision to use Progent.
Progent worked together with the customer to rapidly determine and assign priority to the critical systems that had to be addressed in order to continue company functions:
- Windows Active Directory
- Electronic Messaging
- Accounting and Manufacturing Software
In less than two days, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then assisted with rebuilding and hard drive recovery of mission critical applications. All Microsoft Exchange Server data and configuration information were usable, which facilitated the restore of Exchange. Progent was also able to find non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on staff desktop computers to recover email information. A recent offline backup of the customer's manufacturing systems made them able to recover these vital services back online for users. Although a lot of work remained to recover fully from the Ryuk virus, core services were restored rapidly:
Throughout the following month key milestones in the recovery process were completed in close cooperation between Progent consultants and the client:
- Self-hosted web applications were restored with no loss of data.
- The MailStore Exchange Server with over 4 million archived messages was brought on-line and available for users.
- CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were 100% recovered.
- A new Palo Alto Networks 850 firewall was set up and programmed.
- Most of the desktops and laptops were back into operation.
Conclusion
A likely business-killing catastrophe was dodged due to results-oriented experts, a broad spectrum of subject matter expertise, and tight collaboration. Although in hindsight the ransomware virus penetration described here could have been shut down with modern cyber security technology and best practices, user training, and properly executed incident response procedures for data backup and applying software patches, the reality is that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, remember that Progent's roster of professionals has a proven track record in ransomware virus blocking, cleanup, and information systems disaster recovery.
Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)
Contact Progent for Ransomware Recovery Services in Stamford
For ransomware system recovery services in the Stamford area, call Progent at
Select Topic: