Ransomware Protection and Restoration Expertise Spartanburg

Ransomware : Your Feared IT Disaster
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level danger for organizations poorly prepared for an attack. Different versions of crypto-ransomware like the CryptoLocker, Fusob, Locky, SamSam and MongoLock cryptoworms have been replicating for a long time and continue to inflict destruction. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, plus frequent unnamed viruses, not only perform encryption of online information but also infect any configured system restores and backups. Files replicated to cloud environments can also be corrupted. In a vulnerable data protection solution, this can make automatic restoration impossible and basically knocks the network back to square one.

Getting back on-line applications and information following a ransomware outage becomes a race against time as the targeted business fights to stop the spread, remove the crypto-ransomware, and restore mission-critical activity. Because ransomware needs time to replicate throughout a network, attacks are usually sprung at night, when attacks typically take more time to discover. This multiplies the difficulty of quickly mobilizing and organizing a capable response team.

Progent makes available a range of support services for securing Spartanburg businesses from ransomware events. Among these are team member education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based cyberthreat protection to detect and extinguish day-zero malware assaults. Progent also offers the services of experienced crypto-ransomware recovery professionals with the skills and commitment to reconstruct a compromised network as rapidly as possible.

Progent's Ransomware Recovery Support Services
After a ransomware event, paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will provide the codes to decrypt all your information. Kaspersky ascertained that seventeen percent of ransomware victims never restored their data even after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to piece back together the vital components of your Information Technology environment. Absent access to complete information backups, this calls for a wide complement of skill sets, well-coordinated project management, and the capability to work continuously until the task is completed.

For twenty years, Progent has offered expert Information Technology services for companies across the US and has achieved Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have earned high-level industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in accounting and ERP application software. This breadth of expertise affords Progent the capability to efficiently ascertain important systems and integrate the surviving components of your network environment following a ransomware penetration and assemble them into a functioning system.

Progent's ransomware group deploys powerful project management systems to orchestrate the sophisticated recovery process. Progent appreciates the urgency of working rapidly and together with a customer's management and Information Technology resources to assign priority to tasks and to put the most important applications back on line as fast as humanly possible.

Case Study: A Successful Crypto-Ransomware Penetration Response
A business hired Progent after their organization was brought down by Ryuk ransomware. Ryuk is believed to have been launched by North Korean government sponsored hackers, possibly using approaches exposed from America's National Security Agency. Ryuk goes after specific businesses with little ability to sustain disruption and is one of the most lucrative iterations of ransomware. Major victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in the Chicago metro area with around 500 staff members. The Ryuk intrusion had paralyzed all essential operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the time of the attack and were eventually encrypted. The client considered paying the ransom demand (more than $200K) and praying for the best, but in the end called Progent.

Progent worked with the customer to quickly identify and prioritize the mission critical systems that had to be recovered in order to restart business operations:

• Active Directory
• E-Mail
• Accounting and Manufacturing Software

Within 2 days, Progent was able to recover Active Directory to its pre-penetration state. Progent then helped perform reinstallations and hard drive recovery of mission critical servers. All Microsoft Exchange Server data and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to assemble intact OST files (Outlook Email Off-Line Folder Files) on staff workstations in order to recover mail data. A not too old offline backup of the customer's manufacturing systems made them able to restore these essential services back available to users. Although a large amount of work was left to recover completely from the Ryuk virus, essential systems were recovered quickly:

During the following couple of weeks important milestones in the recovery project were accomplished in close collaboration between Progent team members and the client:

• Self-hosted web sites were restored with no loss of information.
• The MailStore Server containing more than four million archived emails was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory modules were 100 percent functional.
• A new Palo Alto Networks 850 security appliance was set up.
• 90% of the desktop computers were fully operational.

Conclusion
A possible business extinction catastrophe was evaded by dedicated professionals, a broad spectrum of subject matter expertise, and close collaboration. Although in hindsight the crypto-ransomware attack detailed here would have been identified and stopped with up-to-date cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and appropriate incident response procedures for data protection and applying software patches, the fact is that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware virus, remember that Progent's roster of professionals has a proven track record in ransomware virus blocking, removal, and file disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Spartanburg
For ransomware system recovery services in the Spartanburg metro area, call Progent at 800-462-8800 or see Contact Progent.