Ransomware Prevention and Restoration Expertise Vancouver

Crypto-Ransomware : Your Crippling IT Catastrophe
Ransomware has become a modern cyber pandemic that represents an extinction-level danger for businesses of all sizes unprepared for an attack. Multiple generations of ransomware such as Dharma, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for many years and continue to cause destruction. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as frequent unnamed newcomers, not only encrypt on-line files but also infiltrate any configured system protection. Information synchronized to the cloud can also be rendered useless. In a poorly designed data protection solution, it can make automated restoration impossible and effectively knocks the datacenter back to zero.

Getting back on-line programs and data following a ransomware attack becomes a race against time as the victim fights to stop lateral movement, cleanup the ransomware, and restore business-critical operations. Since ransomware needs time to move laterally across a network, attacks are frequently launched during nights and weekends, when successful penetrations typically take more time to notice. This multiplies the difficulty of promptly assembling and orchestrating a qualified mitigation team.

Progent has a range of support services for protecting Vancouver organizations from crypto-ransomware penetrations. Among these are user education to help recognize and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat defense to discover and quarantine zero-day malware assaults. Progent also offers the assistance of veteran ransomware recovery professionals with the skills and commitment to re-deploy a compromised environment as soon as possible.

Progent's Crypto-Ransomware Recovery Services
Soon after a ransomware event, sending the ransom demands in cryptocurrency does not provide any assurance that distant criminals will provide the needed keys to decipher all your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their information even after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to setup from scratch the essential parts of your IT environment. Absent access to full data backups, this requires a broad complement of skill sets, top notch project management, and the capability to work 24x7 until the job is complete.

For decades, Progent has made available expert Information Technology services for companies throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in accounting and ERP applications. This breadth of experience gives Progent the capability to quickly ascertain necessary systems and integrate the remaining pieces of your network system following a crypto-ransomware penetration and assemble them into an operational system.

Progent's security team has state-of-the-art project management systems to orchestrate the complex restoration process. Progent appreciates the importance of working rapidly and in concert with a customer's management and IT resources to prioritize tasks and to put critical applications back on-line as fast as humanly possible.

Case Study: A Successful Ransomware Intrusion Response
A customer contacted Progent after their network was crashed by the Ryuk crypto-ransomware. Ryuk is believed to have been launched by North Korean government sponsored cybercriminals, possibly using technology leaked from the United States National Security Agency. Ryuk attacks specific organizations with limited tolerance for operational disruption and is among the most profitable incarnations of ransomware viruses. Major organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in the Chicago metro area and has around 500 employees. The Ryuk penetration had frozen all essential operations and manufacturing processes. The majority of the client's data protection had been on-line at the time of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for the best, but in the end brought in Progent.

Progent worked hand in hand the client to quickly understand and prioritize the critical systems that had to be addressed to make it possible to continue departmental functions:

• Windows Active Directory
• E-Mail
• MRP System

Within 2 days, Progent was able to restore Active Directory to its pre-attack state. Progent then completed setup and hard drive recovery of essential servers. All Exchange ties and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to assemble local OST files (Outlook Offline Data Files) on various PCs and laptops in order to recover email information. A not too old offline backup of the client's financials/ERP software made them able to restore these essential applications back servicing users. Although a large amount of work was left to recover totally from the Ryuk attack, essential systems were returned to operations quickly:

Over the next month important milestones in the restoration process were completed through close collaboration between Progent consultants and the customer:

• In-house web applications were returned to operation with no loss of information.
• The MailStore Server with over four million historical messages was brought on-line and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were completely restored.
• A new Palo Alto 850 firewall was installed and configured.
• 90% of the user desktops and notebooks were being used by staff.

Conclusion
A possible business catastrophe was evaded with top-tier experts, a wide array of technical expertise, and close collaboration. Although upon completion of forensics the ransomware virus incident detailed here would have been identified and blocked with current cyber security systems and ISO/IEC 27001 best practices, team training, and well thought out incident response procedures for backup and keeping systems up to date with security patches, the reality remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware attack, remember that Progent's team of professionals has extensive experience in crypto-ransomware virus defense, mitigation, and data disaster recovery.

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Vancouver
For ransomware system restoration expertise in the Vancouver metro area, call Progent at 800-462-8800 or go to Contact Progent.