Ransomware Filtering and Restoration Solutions Toledo

Crypto-Ransomware : Your Crippling Information Technology Disaster
Crypto-Ransomware has become a modern cyberplague that represents an enterprise-level threat for businesses of all sizes vulnerable to an attack. Multiple generations of ransomware such as CryptoLocker, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been around for years and still cause havoc. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, plus daily unnamed newcomers, not only perform encryption of online files but also infect any available system protection mechanisms. Files synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly designed system, this can make any recovery impossible and effectively sets the datacenter back to square one.

Retrieving services and information after a crypto-ransomware intrusion becomes a sprint against time as the targeted organization fights to stop lateral movement, remove the ransomware, and resume enterprise-critical activity. Since ransomware takes time to replicate across a network, attacks are usually sprung during weekends and nights, when successful penetrations typically take more time to notice. This multiplies the difficulty of quickly assembling and orchestrating a qualified mitigation team.

Progent makes available an assortment of help services for securing Toledo enterprises from ransomware attacks. These include team member education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based threat defense to discover and suppress day-zero malware attacks. Progent in addition provides the services of expert ransomware recovery professionals with the talent and commitment to re-deploy a compromised system as soon as possible.

Progent's Crypto-Ransomware Restoration Services
Soon after a crypto-ransomware event, paying the ransom demands in cryptocurrency does not ensure that cyber criminals will return the codes to unencrypt any or all of your information. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The fallback is to piece back together the mission-critical elements of your Information Technology environment. Absent the availability of full information backups, this calls for a broad complement of IT skills, top notch project management, and the ability to work 24x7 until the job is complete.

For two decades, Progent has provided certified expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-recognized certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with accounting and ERP application software. This breadth of expertise provides Progent the ability to rapidly understand important systems and organize the surviving components of your IT environment after a ransomware attack and configure them into an operational network.

Progent's recovery group utilizes powerful project management systems to orchestrate the complex restoration process. Progent understands the urgency of acting swiftly and together with a client's management and Information Technology resources to prioritize tasks and to get critical systems back online as fast as possible.

Customer Story: A Successful Ransomware Attack Restoration
A customer sought out Progent after their organization was taken over by Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean state hackers, possibly adopting strategies leaked from the U.S. National Security Agency. Ryuk attacks specific companies with limited tolerance for disruption and is among the most profitable versions of ransomware malware. Headline victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer located in Chicago and has around 500 workers. The Ryuk event had brought down all business operations and manufacturing capabilities. Most of the client's information backups had been directly accessible at the beginning of the attack and were eventually encrypted. The client was evaluating paying the ransom (more than two hundred thousand dollars) and wishfully thinking for the best, but in the end utilized Progent.

Progent worked with the client to rapidly understand and assign priority to the most important elements that had to be restored to make it possible to restart departmental operations:

• Windows Active Directory
• Microsoft Exchange
• Financials/MRP

In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-penetration state. Progent then completed reinstallations and storage recovery of mission critical systems. All Exchange data and configuration information were usable, which greatly helped the restore of Exchange. Progent was also able to assemble local OST data files (Outlook Offline Data Files) on user desktop computers and laptops to recover mail data. A not too old off-line backup of the businesses manufacturing software made them able to restore these required services back available to users. Although significant work still had to be done to recover completely from the Ryuk virus, essential services were recovered rapidly:

Over the next couple of weeks critical milestones in the restoration process were completed through close cooperation between Progent consultants and the client:

• Self-hosted web sites were returned to operation without losing any data.
• The MailStore Server with over four million archived emails was spun up and available for users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables/Inventory Control functions were 100% operational.
• A new Palo Alto 850 security appliance was installed and configured.
• Nearly all of the desktops and laptops were functioning as before the incident.

Conclusion
A likely enterprise-killing catastrophe was averted by hard-working professionals, a broad array of knowledge, and close teamwork. Although in hindsight the ransomware penetration detailed here could have been disabled with current cyber security technology and NIST Cybersecurity Framework best practices, staff education, and properly executed security procedures for data backup and applying software patches, the fact is that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, remember that Progent's team of experts has substantial experience in ransomware virus defense, remediation, and information systems recovery.

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Toledo
For ransomware cleanup expertise in the Toledo area, call Progent at 800-462-8800 or see Contact Progent.