Ransomware Defense and Cleanup Services

Crypto-Ransomware : Your Crippling IT Disaster
Ransomware has become a modern cyberplague that presents an existential danger for organizations vulnerable to an assault. Different versions of crypto-ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for a long time and continue to cause harm. Newer variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as daily unnamed malware, not only encrypt on-line information but also infect any available system protection mechanisms. Files synched to the cloud can also be corrupted. In a poorly designed environment, it can make automatic recovery useless and effectively sets the entire system back to zero.

Retrieving programs and data after a crypto-ransomware intrusion becomes a sprint against the clock as the targeted business fights to contain the damage, clear the virus, and resume business-critical operations. Since crypto-ransomware takes time to spread throughout a network, attacks are frequently launched on weekends and holidays, when successful attacks typically take more time to discover. This multiplies the difficulty of promptly assembling and coordinating a knowledgeable mitigation team.

Progent makes available a range of solutions for securing enterprises from ransomware attacks. Among these are staff training to help identify and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to identify and disable day-zero malware attacks. Progent in addition provides the services of seasoned ransomware recovery consultants with the track record and perseverance to rebuild a breached system as soon as possible.

Progent's Ransomware Restoration Support Services
Soon after a ransomware event, paying the ransom in cryptocurrency does not guarantee that cyber hackers will return the keys to decipher any or all of your data. Kaspersky ascertained that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The fallback is to re-install the key parts of your Information Technology environment. Without access to essential data backups, this requires a broad range of IT skills, top notch project management, and the willingness to work non-stop until the recovery project is done.

For two decades, Progent has made available professional IT services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have attained high-level certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP software solutions. This breadth of expertise provides Progent the capability to efficiently ascertain critical systems and re-organize the surviving parts of your computer network environment following a ransomware event and assemble them into a functioning system.

Progent's recovery team has state-of-the-art project management applications to orchestrate the sophisticated restoration process. Progent understands the urgency of working swiftly and in unison with a client's management and IT resources to assign priority to tasks and to get critical services back on line as fast as possible.

Business Case Study: A Successful Ransomware Virus Restoration
A customer contacted Progent after their organization was penetrated by Ryuk ransomware virus. Ryuk is thought to have been created by North Korean state criminal gangs, possibly using algorithms exposed from the U.S. NSA organization. Ryuk attacks specific businesses with little room for disruption and is one of the most profitable instances of crypto-ransomware. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business based in the Chicago metro area and has about 500 staff members. The Ryuk event had disabled all business operations and manufacturing capabilities. The majority of the client's backups had been directly accessible at the time of the attack and were encrypted. The client was taking steps for paying the ransom (more than two hundred thousand dollars) and wishfully thinking for the best, but ultimately brought in Progent.

Progent worked together with the client to rapidly get our arms around and assign priority to the key elements that had to be restored in order to continue company functions:

• Windows Active Directory
• Email
• Accounting/MRP

In less than 2 days, Progent was able to re-build Active Directory to its pre-virus state. Progent then accomplished setup and hard drive recovery of essential systems. All Exchange data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to assemble local OST data files (Outlook Off-Line Folder Files) on team workstations in order to recover email data. A not too old offline backup of the customer's financials/MRP systems made it possible to restore these vital programs back online for users. Although a large amount of work still had to be done to recover completely from the Ryuk event, the most important systems were returned to operations rapidly:

During the following few weeks key milestones in the restoration project were completed in close collaboration between Progent consultants and the customer:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Server containing more than 4 million archived emails was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory capabilities were completely restored.
• A new Palo Alto Networks 850 security appliance was set up.
• 90% of the user workstations were being used by staff.

Conclusion
A potential business-killing disaster was dodged with results-oriented professionals, a broad spectrum of subject matter expertise, and close teamwork. Although in hindsight the ransomware virus attack detailed here could have been blocked with modern security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and well thought out incident response procedures for data backup and keeping systems up to date with security patches, the fact remains that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware incursion, remember that Progent's roster of experts has extensive experience in ransomware virus blocking, cleanup, and file restoration.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Crypto-Ransomware Cleanup Expertise
For 24/7 crypto-ransomware remediation support services, contact Progent at 800-462-8800 or go to Contact Progent.