Ransomware Defense and Cleanup Services Walnut Creek

Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become an escalating cyber pandemic that poses an enterprise-level danger for organizations unprepared for an assault. Different versions of ransomware like the Dharma, Fusob, Locky, Syskey and MongoLock cryptoworms have been replicating for a long time and continue to cause damage. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Egregor, as well as additional unnamed viruses, not only perform encryption of on-line critical data but also infect all available system backups. Files replicated to off-premises disaster recovery sites can also be ransomed. In a poorly architected data protection solution, this can make any restore operations hopeless and basically knocks the entire system back to square one.

Getting back on-line services and information after a crypto-ransomware outage becomes a race against time as the targeted business tries its best to stop lateral movement, clear the ransomware, and restore enterprise-critical activity. Since ransomware needs time to move laterally across a network, attacks are often launched during weekends and nights, when successful attacks typically take more time to uncover. This multiplies the difficulty of promptly mobilizing and coordinating a qualified response team.

Progent provides a range of solutions for protecting Walnut Creek enterprises from ransomware events. These include team member training to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat protection to discover and disable zero-day modern malware attacks. Progent in addition offers the services of experienced ransomware recovery consultants with the talent and perseverance to rebuild a compromised environment as soon as possible.

Progent's Ransomware Recovery Help
After a ransomware invasion, even paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will provide the keys to unencrypt any or all of your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The other path is to piece back together the essential parts of your Information Technology environment. Without the availability of full data backups, this calls for a wide range of IT skills, well-coordinated team management, and the ability to work continuously until the task is over.

For twenty years, Progent has provided expert IT services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP software solutions. This breadth of expertise gives Progent the skills to rapidly understand critical systems and consolidate the surviving parts of your network system after a crypto-ransomware event and configure them into a functioning system.

Progent's security team of experts deploys top notch project management applications to coordinate the complex restoration process. Progent knows the urgency of acting swiftly and in concert with a customer's management and Information Technology staff to prioritize tasks and to put key applications back on-line as fast as possible.

Case Study: A Successful Ransomware Virus Restoration
A business engaged Progent after their network was brought down by Ryuk ransomware. Ryuk is believed to have been created by North Korean state criminal gangs, suspected of using approaches leaked from the United States National Security Agency. Ryuk goes after specific companies with limited tolerance for disruption and is one of the most lucrative instances of ransomware viruses. Headline targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in the Chicago metro area and has about 500 staff members. The Ryuk attack had brought down all essential operations and manufacturing capabilities. The majority of the client's backups had been on-line at the beginning of the intrusion and were damaged. The client was pursuing financing for paying the ransom demand (more than $200K) and hoping for the best, but in the end brought in Progent.

Progent worked together with the client to rapidly determine and prioritize the most important areas that needed to be addressed to make it possible to resume departmental operations:

• Microsoft Active Directory
• Electronic Messaging
• Accounting/MRP

Within 2 days, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then charged ahead with rebuilding and hard drive recovery of mission critical systems. All Microsoft Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to collect local OST files (Microsoft Outlook Off-Line Folder Files) on team workstations and laptops in order to recover mail data. A recent offline backup of the businesses financials/MRP software made them able to restore these vital services back available to users. Although a lot of work needed to be completed to recover totally from the Ryuk event, critical systems were restored rapidly:

Throughout the following few weeks critical milestones in the recovery process were accomplished through tight cooperation between Progent engineers and the client:

• Self-hosted web sites were returned to operation with no loss of information.
• The MailStore Server containing more than 4 million archived emails was brought online and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory modules were 100 percent operational.
• A new Palo Alto Networks 850 security appliance was deployed.
• Nearly all of the user workstations were functioning as before the incident.

Conclusion
A probable business disaster was dodged through the efforts of hard-working professionals, a broad array of technical expertise, and close teamwork. Although in post mortem the crypto-ransomware attack detailed here could have been blocked with up-to-date cyber security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and appropriate security procedures for data backup and proper patching controls, the fact remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware penetration, feel confident that Progent's team of experts has extensive experience in ransomware virus blocking, removal, and file restoration.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Walnut Creek
For ransomware recovery consulting in the Walnut Creek area, phone Progent at 800-462-8800 or go to Contact Progent.