Ransomware Filtering and Removal Expertise Sydney

Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyber pandemic that represents an enterprise-level threat for organizations poorly prepared for an assault. Multiple generations of crypto-ransomware like the Reveton, Fusob, Locky, Syskey and MongoLock cryptoworms have been replicating for a long time and continue to cause havoc. Modern strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus additional as yet unnamed newcomers, not only encrypt on-line data but also infect most accessible system backups. Data synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly architected data protection solution, this can render any recovery useless and effectively knocks the datacenter back to zero.

Getting back applications and data following a ransomware event becomes a sprint against time as the victim struggles to contain the damage, cleanup the ransomware, and restore enterprise-critical operations. Since ransomware requires time to replicate throughout a network, penetrations are frequently launched at night, when successful attacks tend to take more time to notice. This multiplies the difficulty of rapidly mobilizing and orchestrating a qualified response team.

Progent provides a range of help services for securing Sydney organizations from ransomware attacks. These include staff training to help recognize and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to detect and quarantine day-zero modern malware assaults. Progent in addition provides the assistance of experienced ransomware recovery consultants with the talent and perseverance to restore a breached environment as quickly as possible.

Progent's Ransomware Restoration Services
Soon after a ransomware event, paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the keys to decrypt any of your information. Kaspersky Labs ascertained that seventeen percent of crypto-ransomware victims never recovered their files even after having paid the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The alternative is to re-install the key components of your IT environment. Absent access to complete data backups, this calls for a broad complement of skill sets, well-coordinated project management, and the capability to work continuously until the recovery project is over.

For decades, Progent has offered professional IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned top certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in accounting and ERP applications. This breadth of experience affords Progent the skills to quickly understand necessary systems and integrate the surviving components of your IT environment following a ransomware attack and rebuild them into a functioning system.

Progent's recovery team of experts has state-of-the-art project management systems to orchestrate the complex recovery process. Progent appreciates the importance of acting rapidly and in concert with a customer's management and Information Technology staff to prioritize tasks and to put key systems back on line as soon as possible.

Case Study: A Successful Crypto-Ransomware Virus Response
A small business escalated to Progent after their company was taken over by the Ryuk crypto-ransomware. Ryuk is believed to have been launched by North Korean government sponsored hackers, suspected of adopting approaches leaked from the United States NSA organization. Ryuk targets specific companies with little room for operational disruption and is among the most lucrative examples of ransomware viruses. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company located in the Chicago metro area with around 500 employees. The Ryuk attack had shut down all company operations and manufacturing processes. The majority of the client's system backups had been on-line at the beginning of the intrusion and were damaged. The client was pursuing financing for paying the ransom (exceeding two hundred thousand dollars) and praying for the best, but ultimately called Progent.

Progent worked together with the client to quickly determine and prioritize the critical elements that needed to be restored to make it possible to restart business operations:

• Microsoft Active Directory
• Email
• MRP System

Within 48 hours, Progent was able to re-build Active Directory services to its pre-attack state. Progent then performed setup and storage recovery on the most important servers. All Microsoft Exchange Server data and attributes were usable, which greatly helped the restore of Exchange. Progent was able to locate local OST data files (Outlook Email Off-Line Data Files) on team desktop computers and laptops in order to recover mail data. A recent offline backup of the client's accounting/MRP systems made it possible to recover these vital services back online for users. Although major work was left to recover completely from the Ryuk event, essential systems were restored quickly:

Throughout the following month critical milestones in the restoration project were made through close cooperation between Progent engineers and the client:

• In-house web applications were restored with no loss of data.
• The MailStore Exchange Server exceeding four million historical emails was spun up and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory Control capabilities were completely restored.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Ninety percent of the user desktops were back into operation.

Conclusion
A possible business extinction disaster was averted due to results-oriented professionals, a broad spectrum of technical expertise, and tight collaboration. Although in retrospect the crypto-ransomware virus incident detailed here could have been shut down with up-to-date cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and appropriate incident response procedures for information backup and keeping systems up to date with security patches, the fact remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's roster of experts has a proven track record in crypto-ransomware virus blocking, mitigation, and file recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Sydney
For ransomware recovery expertise in the Sydney metro area, call Progent at 800-462-8800 or see Contact Progent.