Ransomware Prevention and Removal Expertise Reno

Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyberplague that poses an enterprise-level danger for organizations poorly prepared for an attack. Versions of ransomware such as Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been around for years and still inflict havoc. Modern strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, along with frequent as yet unnamed newcomers, not only perform encryption of on-line data but also infect any available system backup. Data synched to off-premises disaster recovery sites can also be encrypted. In a poorly designed system, this can render automated restore operations impossible and effectively sets the datacenter back to square one.

Getting back applications and information after a crypto-ransomware event becomes a race against time as the victim fights to contain, eradicate the crypto-ransomware, and restore enterprise-critical operations. Because ransomware requires time to replicate across a network, penetrations are frequently sprung on weekends and holidays, when penetrations may take longer to recognize. This multiplies the difficulty of quickly assembling and organizing an experienced response team.

Progent has a variety of help services for securing Reno businesses from crypto-ransomware penetrations. Among these are team member education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat protection to discover and suppress zero-day malware attacks. Progent in addition can provide the services of seasoned ransomware recovery consultants with the track record and commitment to re-deploy a breached network as urgently as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will return the needed keys to decrypt any or all of your data. Kaspersky Labs determined that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to setup from scratch the essential elements of your IT environment. Without access to essential information backups, this requires a broad complement of IT skills, professional team management, and the willingness to work non-stop until the task is finished.

For decades, Progent has provided professional Information Technology services for businesses across the US and has achieved Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned advanced certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with accounting and ERP software solutions. This breadth of experience gives Progent the skills to efficiently understand necessary systems and consolidate the surviving pieces of your network system after a ransomware attack and configure them into an operational system.

Progent's security team of experts uses top notch project management applications to coordinate the sophisticated restoration process. Progent understands the urgency of working rapidly and in unison with a client's management and Information Technology team members to assign priority to tasks and to get key applications back on-line as soon as possible.

Case Study: A Successful Ransomware Incident Response
A customer escalated to Progent after their organization was penetrated by Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean government sponsored hackers, suspected of using algorithms leaked from the U.S. National Security Agency. Ryuk targets specific businesses with little tolerance for operational disruption and is one of the most lucrative versions of crypto-ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business located in the Chicago metro area with about 500 employees. The Ryuk event had shut down all business operations and manufacturing capabilities. The majority of the client's system backups had been directly accessible at the time of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and praying for the best, but in the end brought in Progent.

Progent worked with the client to rapidly get our arms around and prioritize the most important areas that had to be restored to make it possible to restart business functions:

• Microsoft Active Directory
• Email
• Accounting/MRP

In less than 48 hours, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then accomplished setup and storage recovery of mission critical applications. All Microsoft Exchange Server schema and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to collect local OST files (Outlook Email Offline Data Files) on user PCs and laptops to recover email messages. A recent off-line backup of the customer's financials/MRP systems made them able to recover these vital services back available to users. Although significant work needed to be completed to recover totally from the Ryuk virus, critical systems were restored rapidly:

During the next few weeks critical milestones in the recovery process were completed through tight cooperation between Progent consultants and the client:

• Internal web applications were brought back up without losing any data.
• The MailStore Exchange Server containing more than 4 million historical messages was brought on-line and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control capabilities were 100 percent recovered.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Ninety percent of the user workstations were being used by staff.

Conclusion
A probable enterprise-killing catastrophe was evaded due to results-oriented professionals, a wide spectrum of subject matter expertise, and close teamwork. Although in post mortem the ransomware virus incident described here would have been identified and prevented with up-to-date cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and well thought out security procedures for information protection and proper patching controls, the reality remains that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware penetration, feel confident that Progent's team of experts has proven experience in crypto-ransomware virus defense, remediation, and data recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Reno
For ransomware system recovery consulting in the Reno area, call Progent at 800-462-8800 or see Contact Progent.