Ransomware Protection and Removal Services Chattanooga

Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become an escalating cyber pandemic that represents an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Versions of ransomware such as Dharma, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for years and continue to inflict havoc. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, plus frequent unnamed viruses, not only perform encryption of on-line information but also infect many available system restores and backups. Data synched to cloud environments can also be rendered useless. In a vulnerable environment, this can render automatic restoration impossible and basically knocks the datacenter back to zero.

Retrieving programs and information after a ransomware intrusion becomes a sprint against time as the victim tries its best to stop the spread, eradicate the crypto-ransomware, and resume enterprise-critical operations. Because crypto-ransomware requires time to move laterally across a network, assaults are frequently launched at night, when penetrations in many cases take more time to recognize. This multiplies the difficulty of quickly mobilizing and coordinating an experienced response team.

Progent provides a range of support services for protecting Chattanooga businesses from ransomware penetrations. These include team member training to help identify and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to discover and quarantine day-zero modern malware assaults. Progent also can provide the assistance of veteran ransomware recovery professionals with the track record and commitment to reconstruct a compromised environment as rapidly as possible.

Progent's Ransomware Recovery Support Services
Soon after a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will respond with the needed codes to decrypt any of your files. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their information even after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to re-install the vital parts of your IT environment. Without the availability of essential system backups, this calls for a broad range of IT skills, top notch project management, and the willingness to work continuously until the recovery project is finished.

For two decades, Progent has made available professional IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have been awarded advanced certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in accounting and ERP application software. This breadth of expertise affords Progent the ability to efficiently understand important systems and consolidate the surviving pieces of your network environment following a ransomware attack and configure them into an operational network.

Progent's recovery group has powerful project management tools to orchestrate the sophisticated recovery process. Progent appreciates the importance of acting quickly and in concert with a customer's management and IT resources to prioritize tasks and to put the most important applications back online as fast as humanly possible.

Client Story: A Successful Ransomware Incident Restoration
A customer engaged Progent after their company was brought down by the Ryuk ransomware virus. Ryuk is believed to have been created by North Korean state hackers, possibly using technology leaked from America's National Security Agency. Ryuk seeks specific companies with limited tolerance for disruption and is among the most lucrative iterations of ransomware malware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in the Chicago metro area with about 500 staff members. The Ryuk attack had frozen all essential operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the start of the attack and were encrypted. The client was pursuing financing for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but ultimately reached out to Progent.

Progent worked with the customer to quickly understand and assign priority to the essential areas that had to be addressed in order to restart departmental operations:

• Active Directory
• Email
• Accounting and Manufacturing Software

Within two days, Progent was able to restore Active Directory services to its pre-penetration state. Progent then accomplished setup and storage recovery of the most important servers. All Microsoft Exchange Server ties and configuration information were usable, which accelerated the restore of Exchange. Progent was able to collect non-encrypted OST data files (Microsoft Outlook Offline Folder Files) on team desktop computers and laptops in order to recover email messages. A not too old off-line backup of the customer's financials/ERP software made it possible to recover these essential programs back online for users. Although a lot of work was left to recover totally from the Ryuk damage, the most important services were restored rapidly:

Throughout the following month critical milestones in the recovery project were completed in close cooperation between Progent engineers and the customer:

• Self-hosted web applications were returned to operation with no loss of information.
• The MailStore Exchange Server containing more than 4 million archived emails was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory modules were 100% operational.
• A new Palo Alto Networks 850 firewall was set up.
• Ninety percent of the user workstations were operational.

Conclusion
A potential enterprise-killing disaster was averted through the efforts of dedicated professionals, a broad spectrum of technical expertise, and tight collaboration. Although in retrospect the crypto-ransomware penetration described here could have been identified and blocked with advanced cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and appropriate incident response procedures for backup and keeping systems up to date with security patches, the fact remains that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's team of professionals has substantial experience in ransomware virus blocking, mitigation, and data restoration.

Download the Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Chattanooga
For ransomware cleanup services in the Chattanooga metro area, call Progent at 800-462-8800 or see Contact Progent.