Ransomware Prevention and Recovery Consulting

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyberplague that represents an existential threat for organizations vulnerable to an attack. Different iterations of ransomware such as Reveton, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for a long time and continue to cause damage. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, along with frequent as yet unnamed malware, not only perform encryption of on-line data but also infect any accessible system backups. Files replicated to cloud environments can also be ransomed. In a poorly designed environment, this can render any recovery useless and effectively knocks the network back to square one.

Getting back programs and data following a crypto-ransomware event becomes a sprint against time as the victim fights to stop the spread, clear the ransomware, and restore enterprise-critical activity. Due to the fact that ransomware requires time to replicate throughout a targeted network, attacks are usually sprung on weekends, when successful penetrations are likely to take more time to identify. This multiplies the difficulty of rapidly assembling and organizing a qualified mitigation team.

Progent has an assortment of services for securing enterprises from crypto-ransomware events. Among these are team training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat protection to detect and extinguish zero-day modern malware assaults. Progent also offers the services of veteran ransomware recovery engineers with the skills and perseverance to restore a breached system as quickly as possible.

Progent's Crypto-Ransomware Restoration Help
Following a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not guarantee that distant criminals will provide the needed codes to unencrypt all your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to setup from scratch the critical components of your IT environment. Absent the availability of complete data backups, this calls for a wide complement of skills, professional project management, and the ability to work non-stop until the job is done.

For decades, Progent has offered certified expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with financial systems and ERP software solutions. This breadth of experience provides Progent the capability to knowledgably determine important systems and integrate the surviving components of your IT environment after a ransomware penetration and assemble them into a functioning system.

Progent's security group deploys powerful project management systems to orchestrate the complex restoration process. Progent knows the importance of working rapidly and in concert with a customer's management and IT staff to assign priority to tasks and to put the most important systems back on-line as fast as possible.

Business Case Study: A Successful Ransomware Attack Restoration
A customer engaged Progent after their network was taken over by Ryuk ransomware virus. Ryuk is generally considered to have been launched by North Korean government sponsored cybercriminals, possibly adopting techniques exposed from America's NSA organization. Ryuk goes after specific companies with little or no room for disruption and is one of the most profitable examples of ransomware malware. Major victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturer based in the Chicago metro area with around 500 staff members. The Ryuk event had disabled all company operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the beginning of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (more than $200K) and praying for the best, but in the end made the decision to use Progent.

Progent worked hand in hand the client to quickly assess and assign priority to the mission critical systems that needed to be restored in order to restart business operations:

• Active Directory
• Electronic Messaging
• Accounting/MRP

In less than 2 days, Progent was able to re-build Active Directory services to its pre-attack state. Progent then initiated rebuilding and storage recovery of mission critical applications. All Microsoft Exchange Server data and attributes were usable, which greatly helped the restore of Exchange. Progent was able to assemble non-encrypted OST data files (Outlook Offline Folder Files) on staff workstations and laptops to recover mail messages. A not too old off-line backup of the client's accounting/MRP software made it possible to return these vital services back online. Although a lot of work needed to be completed to recover completely from the Ryuk event, critical services were restored quickly:

Throughout the next couple of weeks important milestones in the recovery process were made through close collaboration between Progent engineers and the customer:

• Internal web applications were returned to operation without losing any information.
• The MailStore Server containing more than 4 million historical emails was spun up and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control modules were 100 percent operational.
• A new Palo Alto 850 security appliance was deployed.
• Nearly all of the user desktops were fully operational.

Conclusion
A potential company-ending disaster was evaded with top-tier professionals, a broad range of knowledge, and tight teamwork. Although in retrospect the ransomware incident detailed here would have been blocked with modern security technology solutions and best practices, user education, and well thought out incident response procedures for information backup and proper patching controls, the fact remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware virus, remember that Progent's team of professionals has extensive experience in ransomware virus defense, remediation, and file recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Crypto-Ransomware Removal Expertise
For 24x7x365 crypto-ransomware remediation expertise, reach out to Progent at 800-462-8800 or go to Contact Progent.