Ransomware Prevention and Removal Solutions Sioux Falls

Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a too-frequent cyberplague that represents an existential threat for businesses of all sizes vulnerable to an attack. Versions of crypto-ransomware like the CrySIS, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for years and still inflict harm. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with additional as yet unnamed viruses, not only encrypt online information but also infect many accessible system protection mechanisms. Files synched to off-premises disaster recovery sites can also be rendered useless. In a poorly architected system, it can render any restore operations useless and effectively sets the network back to square one.

Retrieving applications and data following a crypto-ransomware intrusion becomes a race against time as the targeted business tries its best to stop lateral movement, eradicate the crypto-ransomware, and resume mission-critical operations. Due to the fact that ransomware takes time to spread throughout a network, assaults are frequently sprung at night, when successful attacks in many cases take longer to uncover. This compounds the difficulty of promptly assembling and organizing a qualified mitigation team.

Progent has a variety of services for protecting Sioux Falls enterprises from ransomware attacks. Among these are staff education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based threat protection to detect and quarantine day-zero malware assaults. Progent in addition provides the assistance of expert crypto-ransomware recovery professionals with the skills and perseverance to re-deploy a compromised system as urgently as possible.

Progent's Ransomware Recovery Services
After a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will return the needed keys to decipher all your information. Kaspersky determined that seventeen percent of ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to re-install the essential parts of your IT environment. Absent access to essential information backups, this calls for a broad complement of skill sets, top notch project management, and the willingness to work 24x7 until the task is over.

For two decades, Progent has made available expert Information Technology services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial systems and ERP software solutions. This breadth of experience affords Progent the capability to quickly ascertain necessary systems and organize the remaining components of your Information Technology system after a ransomware attack and rebuild them into an operational system.

Progent's ransomware group has state-of-the-art project management systems to coordinate the complex recovery process. Progent appreciates the importance of acting rapidly and together with a client's management and Information Technology team members to prioritize tasks and to put essential services back on-line as fast as humanly possible.

Client Story: A Successful Ransomware Incident Restoration
A client escalated to Progent after their network system was crashed by Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean government sponsored criminal gangs, possibly adopting techniques exposed from the United States NSA organization. Ryuk seeks specific companies with limited ability to sustain operational disruption and is among the most profitable examples of crypto-ransomware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in Chicago and has around 500 staff members. The Ryuk penetration had frozen all essential operations and manufacturing capabilities. Most of the client's system backups had been on-line at the time of the intrusion and were damaged. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for good luck, but ultimately utilized Progent.

Progent worked hand in hand the customer to quickly identify and prioritize the critical systems that needed to be restored to make it possible to continue company operations:

• Windows Active Directory
• Exchange Server
• MRP System

Within 2 days, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then charged ahead with reinstallations and storage recovery on mission critical systems. All Exchange schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was also able to find non-encrypted OST data files (Microsoft Outlook Offline Folder Files) on staff workstations and laptops to recover mail messages. A not too old off-line backup of the client's financials/ERP systems made it possible to restore these required applications back available to users. Although a large amount of work was left to recover fully from the Ryuk damage, core systems were restored quickly:

Over the next month key milestones in the recovery process were completed in tight collaboration between Progent team members and the client:

• Internal web sites were brought back up without losing any information.
• The MailStore Server with over 4 million historical messages was spun up and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory modules were completely restored.
• A new Palo Alto 850 security appliance was brought on-line.
• Ninety percent of the user workstations were fully operational.

Conclusion
A probable business extinction catastrophe was avoided due to hard-working professionals, a broad spectrum of subject matter expertise, and close teamwork. Although in post mortem the ransomware attack detailed here could have been identified and blocked with up-to-date security technology and best practices, staff education, and appropriate security procedures for information protection and keeping systems up to date with security patches, the fact remains that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's roster of professionals has extensive experience in ransomware virus blocking, cleanup, and file disaster recovery.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Sioux Falls
For ransomware system restoration expertise in the Sioux Falls area, call Progent at 800-462-8800 or go to Contact Progent.