Ransomware Filtering and Remediation Expertise Tulsa

Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become a too-frequent cyberplague that represents an existential danger for businesses of all sizes poorly prepared for an attack. Different versions of ransomware like the CryptoLocker, WannaCry, Locky, SamSam and MongoLock cryptoworms have been around for many years and still cause destruction. More recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with daily as yet unnamed newcomers, not only perform encryption of on-line critical data but also infiltrate all accessible system protection mechanisms. Information replicated to the cloud can also be rendered useless. In a poorly designed environment, it can render automated recovery useless and effectively knocks the entire system back to zero.

Recovering programs and information after a ransomware event becomes a sprint against time as the targeted organization tries its best to stop lateral movement, remove the crypto-ransomware, and restore enterprise-critical operations. Since crypto-ransomware requires time to move laterally throughout a network, attacks are usually sprung during weekends and nights, when successful penetrations typically take more time to discover. This compounds the difficulty of quickly mobilizing and orchestrating a capable response team.

Progent has an assortment of support services for securing Tulsa businesses from ransomware attacks. These include team training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat protection to identify and extinguish zero-day malware attacks. Progent in addition offers the assistance of veteran ransomware recovery professionals with the track record and commitment to restore a compromised system as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Soon after a ransomware attack, paying the ransom in cryptocurrency does not ensure that cyber criminals will return the needed codes to decrypt all your data. Kaspersky Labs determined that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The fallback is to re-install the key components of your Information Technology environment. Absent the availability of complete information backups, this requires a wide range of skill sets, well-coordinated project management, and the capability to work continuously until the task is done.

For decades, Progent has provided professional IT services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained advanced certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP software solutions. This breadth of experience gives Progent the skills to quickly ascertain necessary systems and re-organize the remaining components of your computer network system following a ransomware penetration and configure them into a functioning system.

Progent's recovery team deploys powerful project management systems to coordinate the sophisticated restoration process. Progent knows the importance of acting swiftly and together with a customer's management and Information Technology resources to assign priority to tasks and to get key services back on-line as fast as humanly possible.

Case Study: A Successful Crypto-Ransomware Penetration Restoration
A client escalated to Progent after their network system was taken over by Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored hackers, possibly using strategies exposed from America's National Security Agency. Ryuk seeks specific businesses with little or no ability to sustain disruption and is one of the most lucrative iterations of ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturer headquartered in the Chicago metro area with about 500 employees. The Ryuk penetration had brought down all business operations and manufacturing processes. Most of the client's data backups had been on-line at the start of the intrusion and were eventually encrypted. The client was evaluating paying the ransom (exceeding $200K) and wishfully thinking for the best, but in the end engaged Progent.

Progent worked hand in hand the customer to quickly determine and assign priority to the most important systems that had to be restored in order to restart business functions:

• Windows Active Directory
• Electronic Mail
• MRP System

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then accomplished reinstallations and hard drive recovery on key systems. All Exchange Server ties and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to locate intact OST data files (Outlook Off-Line Data Files) on user workstations to recover mail information. A not too old offline backup of the businesses manufacturing systems made it possible to restore these essential programs back online. Although significant work still had to be done to recover totally from the Ryuk attack, critical services were recovered quickly:

During the following couple of weeks critical milestones in the recovery project were completed in tight cooperation between Progent engineers and the customer:

• Internal web applications were brought back up without losing any information.
• The MailStore Exchange Server with over 4 million historical emails was spun up and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory capabilities were 100 percent operational.
• A new Palo Alto 850 firewall was set up and programmed.
• Nearly all of the user workstations were being used by staff.

Conclusion
A probable business-killing disaster was avoided with results-oriented professionals, a broad range of knowledge, and close teamwork. Although in post mortem the crypto-ransomware virus incident detailed here should have been identified and stopped with modern security solutions and best practices, user and IT administrator training, and properly executed security procedures for backup and keeping systems up to date with security patches, the fact is that government-sponsored cyber criminals from China, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware attack, feel confident that Progent's team of professionals has substantial experience in ransomware virus blocking, remediation, and data disaster recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Tulsa
For ransomware recovery consulting in the Tulsa area, call Progent at 800-462-8800 or go to Contact Progent.