Ransomware Protection and Restoration Solutions Calgary

Crypto-Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a modern cyberplague that poses an existential danger for businesses of all sizes poorly prepared for an assault. Multiple generations of crypto-ransomware like the CrySIS, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for a long time and continue to inflict harm. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, along with frequent unnamed newcomers, not only encrypt on-line data files but also infect all available system restores and backups. Information synched to cloud environments can also be corrupted. In a vulnerable system, this can make any recovery useless and basically sets the network back to square one.

Restoring applications and data following a ransomware intrusion becomes a sprint against the clock as the targeted business fights to stop the spread, cleanup the ransomware, and restore enterprise-critical operations. Due to the fact that ransomware takes time to move laterally throughout a targeted network, penetrations are usually sprung at night, when successful penetrations tend to take more time to discover. This multiplies the difficulty of quickly marshalling and organizing a capable mitigation team.

Progent provides a range of services for securing Calgary enterprises from crypto-ransomware events. These include team training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to discover and quarantine zero-day malware assaults. Progent in addition can provide the services of expert crypto-ransomware recovery professionals with the track record and perseverance to re-deploy a compromised system as soon as possible.

Progent's Crypto-Ransomware Restoration Help
After a ransomware event, sending the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the needed codes to decrypt all your files. Kaspersky determined that 17% of ransomware victims never restored their information after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to piece back together the vital parts of your IT environment. Without the availability of complete information backups, this requires a wide range of IT skills, professional team management, and the willingness to work continuously until the task is finished.

For decades, Progent has made available certified expert IT services for companies throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded high-level certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial systems and ERP application software. This breadth of expertise gives Progent the ability to knowledgably determine important systems and consolidate the remaining components of your IT system following a ransomware event and rebuild them into a functioning system.

Progent's security group has powerful project management tools to coordinate the sophisticated recovery process. Progent knows the importance of working quickly and in unison with a customer's management and IT staff to assign priority to tasks and to get essential applications back online as fast as humanly possible.

Case Study: A Successful Ransomware Virus Restoration
A small business hired Progent after their company was brought down by Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean government sponsored criminal gangs, suspected of adopting technology leaked from the U.S. NSA organization. Ryuk attacks specific organizations with limited ability to sustain disruption and is among the most profitable examples of ransomware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in Chicago and has about 500 workers. The Ryuk intrusion had disabled all company operations and manufacturing capabilities. Most of the client's information backups had been directly accessible at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom (exceeding $200K) and hoping for the best, but in the end made the decision to use Progent.

Progent worked with the client to rapidly get our arms around and assign priority to the most important elements that needed to be recovered to make it possible to continue business functions:

• Active Directory (AD)
• Microsoft Exchange
• Financials/MRP

Within two days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then completed reinstallations and storage recovery of critical applications. All Exchange Server schema and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to locate non-encrypted OST data files (Microsoft Outlook Offline Data Files) on user PCs and laptops to recover mail messages. A recent off-line backup of the customer's accounting systems made them able to recover these required services back on-line. Although significant work was left to recover completely from the Ryuk virus, essential services were returned to operations rapidly:

During the next month important milestones in the recovery process were completed in tight collaboration between Progent consultants and the customer:

• Self-hosted web applications were brought back up with no loss of information.
• The MailStore Server containing more than four million historical messages was restored to operations and available for users.
• CRM/Orders/Invoicing/AP/AR/Inventory capabilities were fully restored.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Ninety percent of the desktops and laptops were functioning as before the incident.

Conclusion
A likely company-ending catastrophe was avoided due to results-oriented experts, a broad array of IT skills, and tight teamwork. Although in retrospect the ransomware penetration described here should have been identified and disabled with advanced cyber security technology and recognized best practices, user education, and appropriate incident response procedures for data protection and keeping systems up to date with security patches, the fact is that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware attack, remember that Progent's team of professionals has substantial experience in ransomware virus blocking, cleanup, and data recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Calgary
For ransomware recovery services in the Calgary area, phone Progent at 800-462-8800 or go to Contact Progent.