Ransomware Prevention and Recovery Expertise New Haven

Ransomware : Your Worst IT Nightmare
Ransomware has become a modern cyber pandemic that poses an existential danger for organizations vulnerable to an assault. Different versions of ransomware like the Reveton, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for a long time and continue to cause destruction. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, as well as additional unnamed viruses, not only encrypt on-line data but also infiltrate many accessible system protection. Files replicated to off-premises disaster recovery sites can also be encrypted. In a vulnerable data protection solution, this can make automatic recovery useless and effectively knocks the entire system back to square one.

Restoring programs and data after a ransomware intrusion becomes a race against the clock as the targeted business fights to stop the spread, eradicate the virus, and resume business-critical activity. Since ransomware requires time to replicate across a network, assaults are frequently launched on weekends, when successful penetrations may take longer to identify. This compounds the difficulty of rapidly assembling and coordinating a qualified mitigation team.

Progent offers a range of solutions for protecting New Haven organizations from ransomware events. Among these are team member training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat protection to detect and disable day-zero modern malware attacks. Progent in addition provides the assistance of expert ransomware recovery consultants with the talent and perseverance to restore a breached system as quickly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a crypto-ransomware penetration, paying the ransom in cryptocurrency does not ensure that merciless criminals will respond with the needed keys to decipher any or all of your data. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their data even after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The alternative is to piece back together the key parts of your IT environment. Without access to essential data backups, this calls for a broad range of IT skills, professional project management, and the capability to work continuously until the task is done.

For two decades, Progent has made available certified expert Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded top certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP software solutions. This breadth of expertise provides Progent the capability to rapidly determine important systems and consolidate the remaining components of your IT system following a crypto-ransomware attack and rebuild them into a functioning system.

Progent's ransomware team of experts has best of breed project management tools to coordinate the complex restoration process. Progent appreciates the urgency of acting swiftly and in unison with a client's management and IT resources to prioritize tasks and to get essential applications back online as soon as humanly possible.

Business Case Study: A Successful Ransomware Penetration Recovery
A client hired Progent after their company was taken over by Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored criminal gangs, possibly using approaches leaked from the United States NSA organization. Ryuk attacks specific companies with little or no tolerance for operational disruption and is one of the most lucrative instances of ransomware viruses. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturer located in the Chicago metro area and has around 500 workers. The Ryuk attack had paralyzed all business operations and manufacturing capabilities. Most of the client's backups had been on-line at the start of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom demand (more than $200,000) and hoping for good luck, but in the end reached out to Progent.

Progent worked with the customer to quickly get our arms around and prioritize the mission critical areas that needed to be addressed in order to resume business operations:

• Active Directory (AD)
• Exchange Server
• MRP System

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-intrusion state. Progent then helped perform setup and hard drive recovery on needed systems. All Exchange Server ties and attributes were intact, which greatly helped the restore of Exchange. Progent was also able to locate intact OST files (Outlook Off-Line Data Files) on various PCs and laptops in order to recover mail data. A recent off-line backup of the client's accounting/MRP software made it possible to recover these required services back available to users. Although a lot of work still had to be done to recover fully from the Ryuk event, essential systems were restored quickly:

During the next month important milestones in the restoration process were accomplished through tight collaboration between Progent consultants and the client:

• In-house web applications were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server with over four million archived emails was brought on-line and available for users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 firewall was brought online.
• 90% of the user PCs were functioning as before the incident.

Conclusion
A probable company-ending disaster was averted by top-tier experts, a broad array of IT skills, and close collaboration. Although upon completion of forensics the ransomware virus attack detailed here would have been stopped with modern security technology solutions and best practices, team training, and properly executed incident response procedures for data protection and proper patching controls, the fact is that government-sponsored hackers from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware attack, remember that Progent's roster of professionals has proven experience in ransomware virus defense, mitigation, and data disaster recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in New Haven
For ransomware cleanup expertise in the New Haven metro area, phone Progent at 800-462-8800 or see Contact Progent.