Ransomware Defense and Removal Consulting Rochester

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that presents an enterprise-level danger for businesses poorly prepared for an attack. Versions of ransomware such as CryptoLocker, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and continue to inflict destruction. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus frequent unnamed newcomers, not only encrypt on-line data but also infiltrate all configured system protection mechanisms. Information replicated to the cloud can also be corrupted. In a vulnerable data protection solution, it can render automated restore operations useless and effectively sets the datacenter back to square one.

Getting back on-line programs and information after a crypto-ransomware intrusion becomes a race against the clock as the targeted organization struggles to stop the spread, remove the virus, and resume mission-critical activity. Due to the fact that ransomware requires time to replicate throughout a network, attacks are usually sprung at night, when attacks typically take more time to recognize. This multiplies the difficulty of quickly marshalling and orchestrating a qualified mitigation team.

Progent provides a variety of help services for securing Rochester enterprises from ransomware penetrations. These include user education to help identify and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat protection to detect and suppress day-zero malware attacks. Progent also can provide the services of veteran crypto-ransomware recovery consultants with the track record and perseverance to rebuild a compromised network as soon as possible.

Progent's Crypto-Ransomware Restoration Services
Soon after a ransomware attack, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will return the needed codes to decrypt any or all of your data. Kaspersky ascertained that seventeen percent of ransomware victims never restored their information even after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to piece back together the critical elements of your IT environment. Absent the availability of complete system backups, this requires a wide complement of skill sets, top notch project management, and the capability to work continuously until the task is done.

For two decades, Progent has offered professional IT services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained top industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial systems and ERP application software. This breadth of experience provides Progent the ability to rapidly understand necessary systems and re-organize the remaining pieces of your Information Technology system following a crypto-ransomware attack and configure them into an operational network.

Progent's recovery team deploys powerful project management applications to orchestrate the sophisticated recovery process. Progent appreciates the importance of working rapidly and together with a client's management and Information Technology team members to prioritize tasks and to put the most important systems back online as soon as possible.

Customer Story: A Successful Ransomware Intrusion Restoration
A small business contacted Progent after their network was attacked by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state sponsored cybercriminals, suspected of adopting technology exposed from America's NSA organization. Ryuk targets specific businesses with little or no ability to sustain disruption and is among the most lucrative incarnations of crypto-ransomware. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company based in Chicago and has about 500 staff members. The Ryuk attack had brought down all business operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the beginning of the attack and were destroyed. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and praying for good luck, but ultimately made the decision to use Progent.

Progent worked hand in hand the client to rapidly get our arms around and prioritize the essential services that had to be recovered in order to resume company functions:

• Active Directory (AD)
• E-Mail
• MRP System

In less than 48 hours, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then assisted with reinstallations and storage recovery of needed applications. All Exchange data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Outlook Email Offline Folder Files) on staff PCs and laptops to recover mail information. A not too old off-line backup of the customer's financials/MRP software made them able to recover these essential programs back available to users. Although a lot of work needed to be completed to recover fully from the Ryuk damage, critical systems were restored quickly:

Over the next couple of weeks key milestones in the recovery project were made in close cooperation between Progent team members and the client:

• Self-hosted web applications were restored without losing any data.
• The MailStore Server with over 4 million archived messages was spun up and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory modules were fully operational.
• A new Palo Alto 850 security appliance was installed and configured.
• Most of the user desktops and notebooks were operational.

Conclusion
A potential business extinction disaster was evaded by hard-working professionals, a wide array of IT skills, and close collaboration. Although in analyzing the event afterwards the ransomware virus incident described here should have been identified and disabled with current security technology and best practices, user training, and well thought out security procedures for information protection and applying software patches, the reality remains that government-sponsored cyber criminals from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware incident, feel confident that Progent's team of experts has substantial experience in ransomware virus blocking, mitigation, and file recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Rochester
For ransomware system restoration expertise in the Rochester metro area, phone Progent at 800-462-8800 or see Contact Progent.