Ransomware Protection and Restoration Services Tampa

Ransomware : Your Worst IT Catastrophe
Ransomware has become a too-frequent cyberplague that represents an existential danger for organizations vulnerable to an attack. Versions of ransomware such as CrySIS, Fusob, Locky, NotPetya and MongoLock cryptoworms have been circulating for many years and still inflict damage. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with more unnamed newcomers, not only encrypt on-line files but also infect all accessible system backups. Data replicated to the cloud can also be rendered useless. In a poorly architected data protection solution, it can render automatic recovery impossible and effectively knocks the network back to square one.

Recovering applications and information after a crypto-ransomware outage becomes a sprint against the clock as the victim tries its best to stop the spread, remove the ransomware, and resume enterprise-critical operations. Due to the fact that crypto-ransomware needs time to spread throughout a network, penetrations are usually sprung during weekends and nights, when successful attacks typically take more time to recognize. This multiplies the difficulty of rapidly assembling and coordinating a qualified response team.

Progent provides an assortment of help services for protecting Tampa businesses from crypto-ransomware attacks. Among these are team training to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat protection to identify and suppress day-zero malware assaults. Progent also can provide the assistance of experienced crypto-ransomware recovery engineers with the track record and commitment to reconstruct a breached network as rapidly as possible.

Progent's Crypto-Ransomware Restoration Help
After a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not guarantee that cyber hackers will return the needed keys to unencrypt any or all of your data. Kaspersky determined that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The fallback is to piece back together the essential components of your IT environment. Absent the availability of essential data backups, this calls for a wide range of skills, professional project management, and the ability to work non-stop until the recovery project is over.

For decades, Progent has offered professional IT services for companies throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded high-level certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP applications. This breadth of expertise gives Progent the skills to knowledgably ascertain critical systems and consolidate the surviving pieces of your Information Technology environment after a ransomware attack and configure them into a functioning network.

Progent's security team of experts uses state-of-the-art project management systems to orchestrate the complex recovery process. Progent appreciates the importance of working swiftly and in concert with a customer's management and Information Technology team members to prioritize tasks and to put essential applications back on line as soon as possible.

Customer Story: A Successful Crypto-Ransomware Penetration Restoration
A business engaged Progent after their organization was taken over by the Ryuk ransomware. Ryuk is believed to have been developed by North Korean state sponsored criminal gangs, suspected of using algorithms leaked from the United States NSA organization. Ryuk targets specific businesses with little or no room for operational disruption and is one of the most lucrative versions of ransomware viruses. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in Chicago and has around 500 staff members. The Ryuk event had disabled all business operations and manufacturing capabilities. Most of the client's system backups had been on-line at the time of the attack and were eventually encrypted. The client considered paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but ultimately brought in Progent.

Progent worked together with the customer to quickly identify and assign priority to the mission critical systems that had to be recovered to make it possible to resume company operations:

• Windows Active Directory
• E-Mail
• Financials/MRP

Within 48 hours, Progent was able to recover Active Directory to its pre-penetration state. Progent then accomplished rebuilding and storage recovery on key applications. All Microsoft Exchange Server data and configuration information were usable, which accelerated the restore of Exchange. Progent was able to locate intact OST files (Outlook Off-Line Data Files) on team desktop computers to recover email data. A recent off-line backup of the customer's accounting/MRP software made it possible to recover these required applications back online. Although major work still had to be done to recover totally from the Ryuk attack, core services were restored rapidly:

During the next couple of weeks critical milestones in the recovery project were completed through close collaboration between Progent engineers and the customer:

• In-house web sites were restored with no loss of information.
• The MailStore Exchange Server with over four million archived messages was brought on-line and available for users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory functions were 100% functional.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Nearly all of the user workstations were being used by staff.

Conclusion
A possible business-killing catastrophe was dodged through the efforts of results-oriented professionals, a broad range of technical expertise, and tight collaboration. Although upon completion of forensics the ransomware virus attack detailed here could have been stopped with modern security technology and best practices, user education, and properly executed incident response procedures for backup and applying software patches, the fact is that government-sponsored cybercriminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware virus, feel confident that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and data recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Tampa
For ransomware cleanup consulting in the Tampa area, call Progent at 800-462-8800 or see Contact Progent.