Ransomware Defense and Removal Consulting Spartanburg

Ransomware : Your Worst IT Nightmare
Ransomware has become a too-frequent cyberplague that presents an extinction-level threat for businesses unprepared for an assault. Multiple generations of ransomware like the CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and still cause destruction. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus frequent as yet unnamed malware, not only perform encryption of on-line files but also infiltrate many available system backup. Data synchronized to cloud environments can also be rendered useless. In a vulnerable system, this can render any recovery useless and basically sets the datacenter back to square one.

Retrieving programs and information following a ransomware outage becomes a sprint against the clock as the victim struggles to stop lateral movement, remove the virus, and resume mission-critical operations. Since ransomware takes time to replicate throughout a targeted network, penetrations are usually sprung during nights and weekends, when penetrations tend to take longer to recognize. This compounds the difficulty of promptly marshalling and coordinating an experienced response team.

Progent provides an assortment of services for protecting Spartanburg organizations from ransomware attacks. Among these are team member education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat defense to detect and suppress zero-day malware assaults. Progent in addition provides the services of veteran ransomware recovery professionals with the talent and commitment to re-deploy a breached system as urgently as possible.

Progent's Crypto-Ransomware Recovery Services
Following a crypto-ransomware attack, even paying the ransom in cryptocurrency does not guarantee that merciless criminals will return the needed keys to decrypt all your information. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their data even after having paid the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The fallback is to re-install the vital components of your IT environment. Without access to essential data backups, this calls for a wide complement of IT skills, professional project management, and the capability to work 24x7 until the task is complete.

For decades, Progent has offered expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have earned advanced certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial management and ERP application software. This breadth of experience affords Progent the skills to quickly understand important systems and integrate the surviving pieces of your Information Technology environment following a ransomware event and rebuild them into an operational system.

Progent's security team has state-of-the-art project management tools to orchestrate the sophisticated restoration process. Progent appreciates the importance of working swiftly and in concert with a customer's management and IT staff to prioritize tasks and to get the most important services back on line as soon as possible.

Case Study: A Successful Ransomware Virus Response
A customer contacted Progent after their company was brought down by the Ryuk crypto-ransomware. Ryuk is thought to have been developed by North Korean state cybercriminals, suspected of adopting technology leaked from America's National Security Agency. Ryuk goes after specific companies with little or no room for disruption and is among the most profitable incarnations of ransomware viruses. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in the Chicago metro area and has about 500 staff members. The Ryuk attack had brought down all business operations and manufacturing processes. The majority of the client's system backups had been online at the time of the attack and were damaged. The client considered paying the ransom demand (more than $200K) and hoping for good luck, but in the end reached out to Progent.

Progent worked hand in hand the customer to quickly identify and assign priority to the most important services that needed to be recovered to make it possible to continue departmental operations:

• Active Directory
• Microsoft Exchange
• Accounting/MRP

Within two days, Progent was able to restore Active Directory services to its pre-penetration state. Progent then assisted with reinstallations and hard drive recovery of key applications. All Microsoft Exchange Server data and attributes were usable, which facilitated the restore of Exchange. Progent was able to assemble non-encrypted OST files (Outlook Offline Data Files) on various PCs and laptops in order to recover mail data. A recent offline backup of the customer's financials/ERP systems made it possible to return these essential applications back servicing users. Although significant work needed to be completed to recover fully from the Ryuk event, critical services were returned to operations rapidly:

Over the next month key milestones in the recovery process were achieved through tight cooperation between Progent consultants and the client:

• In-house web sites were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server with over four million historical emails was brought on-line and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory capabilities were 100 percent operational.
• A new Palo Alto 850 firewall was deployed.
• Ninety percent of the user desktops were being used by staff.

Conclusion
A probable business extinction catastrophe was avoided due to top-tier experts, a wide spectrum of knowledge, and tight collaboration. Although in hindsight the crypto-ransomware attack detailed here should have been identified and stopped with up-to-date security solutions and security best practices, team training, and appropriate security procedures for backup and keeping systems up to date with security patches, the reality remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a crypto-ransomware virus, remember that Progent's roster of experts has substantial experience in ransomware virus defense, removal, and data restoration.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Spartanburg
For ransomware system restoration consulting services in the Spartanburg metro area, call Progent at 800-462-8800 or visit Contact Progent.