Ransomware Defense and Recovery Consulting Stockton

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that presents an extinction-level danger for businesses vulnerable to an assault. Different versions of ransomware like the Dharma, WannaCry, Locky, SamSam and MongoLock cryptoworms have been circulating for a long time and continue to cause harm. Modern variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, along with more as yet unnamed newcomers, not only perform encryption of online data files but also infiltrate all configured system backups. Files synchronized to cloud environments can also be rendered useless. In a vulnerable system, it can make automatic restore operations hopeless and basically sets the network back to square one.

Getting back online applications and information after a crypto-ransomware intrusion becomes a race against time as the victim fights to contain the damage, remove the virus, and restore business-critical operations. Because ransomware requires time to replicate across a network, assaults are frequently launched on weekends, when attacks in many cases take longer to discover. This multiplies the difficulty of quickly mobilizing and organizing an experienced mitigation team.

Progent offers a range of services for protecting Stockton businesses from ransomware penetrations. Among these are team member education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to identify and disable day-zero modern malware attacks. Progent in addition can provide the services of experienced crypto-ransomware recovery consultants with the track record and commitment to reconstruct a compromised environment as soon as possible.

Progent's Ransomware Recovery Help
Following a ransomware invasion, sending the ransom in cryptocurrency does not provide any assurance that cyber criminals will respond with the keys to unencrypt any or all of your files. Kaspersky estimated that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to setup from scratch the key components of your IT environment. Absent the availability of full system backups, this requires a wide range of skill sets, professional project management, and the capability to work 24x7 until the recovery project is over.

For decades, Progent has provided professional IT services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have been awarded top industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in accounting and ERP application software. This breadth of expertise affords Progent the skills to efficiently understand important systems and integrate the surviving parts of your network environment after a crypto-ransomware penetration and configure them into an operational network.

Progent's recovery team deploys top notch project management applications to orchestrate the sophisticated recovery process. Progent appreciates the importance of working quickly and in unison with a client's management and Information Technology resources to assign priority to tasks and to put the most important services back on line as soon as humanly possible.

Customer Case Study: A Successful Crypto-Ransomware Incident Response
A business contacted Progent after their network system was brought down by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored cybercriminals, suspected of using techniques leaked from America's National Security Agency. Ryuk goes after specific organizations with little or no tolerance for operational disruption and is one of the most lucrative incarnations of ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in Chicago with about 500 employees. The Ryuk event had shut down all business operations and manufacturing capabilities. Most of the client's data backups had been on-line at the beginning of the attack and were damaged. The client was evaluating paying the ransom (in excess of $200,000) and hoping for the best, but in the end reached out to Progent.

Progent worked with the client to rapidly determine and assign priority to the most important applications that needed to be recovered in order to continue departmental operations:

• Windows Active Directory
• Email
• Accounting and Manufacturing Software

Within 2 days, Progent was able to rebuild Active Directory to its pre-virus state. Progent then helped perform reinstallations and storage recovery of the most important applications. All Exchange ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to find non-encrypted OST data files (Microsoft Outlook Offline Data Files) on user PCs in order to recover email messages. A recent off-line backup of the businesses financials/MRP software made them able to restore these vital programs back on-line. Although major work needed to be completed to recover totally from the Ryuk event, essential systems were restored quickly:

Throughout the next couple of weeks key milestones in the recovery project were made in close cooperation between Progent team members and the client:

• Self-hosted web applications were restored with no loss of information.
• The MailStore Server containing more than four million historical messages was spun up and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory modules were 100 percent functional.
• A new Palo Alto 850 firewall was deployed.
• Nearly all of the desktops and laptops were operational.

Conclusion
A likely business extinction catastrophe was evaded with top-tier professionals, a broad range of technical expertise, and tight collaboration. Although in retrospect the crypto-ransomware virus penetration described here could have been disabled with advanced cyber security technology and ISO/IEC 27001 best practices, team education, and appropriate security procedures for backup and keeping systems up to date with security patches, the fact remains that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware incursion, remember that Progent's roster of experts has a proven track record in crypto-ransomware virus blocking, removal, and data disaster recovery.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Stockton
For ransomware cleanup consulting services in the Stockton metro area, phone Progent at 800-462-8800 or go to Contact Progent.