Ransomware Defense and Recovery Consulting Toronto

Ransomware : Your Crippling Information Technology Disaster
Crypto-Ransomware has become a modern cyberplague that represents an enterprise-level danger for organizations unprepared for an attack. Versions of ransomware such as CryptoLocker, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for years and still cause destruction. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as more unnamed newcomers, not only perform encryption of on-line critical data but also infiltrate any accessible system backup. Data synchronized to off-premises disaster recovery sites can also be ransomed. In a vulnerable environment, this can render automated restore operations useless and effectively knocks the datacenter back to zero.

Retrieving applications and data following a ransomware event becomes a race against time as the targeted business tries its best to stop lateral movement, clear the virus, and restore business-critical activity. Since ransomware requires time to replicate throughout a targeted network, penetrations are usually launched at night, when attacks typically take more time to discover. This compounds the difficulty of promptly marshalling and coordinating an experienced response team.

Progent provides an assortment of help services for securing Toronto enterprises from ransomware attacks. These include user education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat defense to identify and quarantine zero-day modern malware attacks. Progent also provides the assistance of seasoned crypto-ransomware recovery professionals with the skills and commitment to re-deploy a breached environment as rapidly as possible.

Progent's Ransomware Recovery Help
Subsequent to a crypto-ransomware event, even paying the ransom in cryptocurrency does not guarantee that cyber criminals will provide the needed codes to decrypt all your files. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their information even after having paid the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The fallback is to piece back together the key components of your Information Technology environment. Without the availability of complete data backups, this requires a wide range of IT skills, well-coordinated team management, and the ability to work continuously until the job is done.

For twenty years, Progent has offered expert IT services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with accounting and ERP software solutions. This breadth of experience provides Progent the skills to rapidly understand important systems and organize the surviving components of your computer network system after a ransomware attack and rebuild them into an operational network.

Progent's recovery team uses best of breed project management tools to orchestrate the complicated recovery process. Progent understands the urgency of acting rapidly and together with a client's management and Information Technology team members to prioritize tasks and to get the most important systems back on-line as soon as possible.

Customer Story: A Successful Crypto-Ransomware Penetration Response
A client engaged Progent after their network system was taken over by Ryuk ransomware virus. Ryuk is generally considered to have been launched by North Korean state sponsored criminal gangs, suspected of adopting techniques exposed from America's NSA organization. Ryuk goes after specific businesses with little room for operational disruption and is among the most profitable versions of ransomware. Major targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company located in Chicago and has around 500 workers. The Ryuk intrusion had frozen all essential operations and manufacturing processes. The majority of the client's backups had been online at the start of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (exceeding $200K) and hoping for the best, but ultimately made the decision to use Progent.

Progent worked together with the client to quickly assess and assign priority to the most important elements that had to be addressed to make it possible to resume departmental operations:

• Windows Active Directory
• Microsoft Exchange Email
• MRP System

Within 2 days, Progent was able to recover Active Directory to its pre-penetration state. Progent then performed reinstallations and storage recovery on critical systems. All Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to find non-encrypted OST files (Microsoft Outlook Off-Line Folder Files) on various workstations in order to recover email data. A not too old off-line backup of the client's accounting/ERP systems made it possible to return these essential applications back online. Although significant work needed to be completed to recover completely from the Ryuk damage, the most important services were recovered quickly:

During the following month key milestones in the restoration process were accomplished in tight collaboration between Progent consultants and the customer:

• In-house web applications were restored with no loss of data.
• The MailStore Server containing more than four million historical emails was brought on-line and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were completely restored.
• A new Palo Alto 850 firewall was installed.
• Ninety percent of the user desktops were being used by staff.

Conclusion
A potential company-ending catastrophe was dodged due to hard-working experts, a wide range of IT skills, and tight collaboration. Although in retrospect the crypto-ransomware virus incident described here should have been stopped with advanced cyber security technology and security best practices, user and IT administrator education, and appropriate security procedures for data protection and proper patching controls, the fact is that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incident, remember that Progent's team of professionals has a proven track record in crypto-ransomware virus defense, removal, and data disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Toronto
For ransomware recovery consulting in the Toronto area, call Progent at 800-462-8800 or visit Contact Progent.