Ransomware Protection and Recovery Services Stamford

Ransomware : Your Worst IT Disaster
Ransomware has become a modern cyber pandemic that represents an enterprise-level danger for businesses of all sizes poorly prepared for an assault. Different iterations of crypto-ransomware such as CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been circulating for years and continue to cause destruction. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, along with frequent as yet unnamed malware, not only perform encryption of online files but also infiltrate any available system protection mechanisms. Data replicated to cloud environments can also be ransomed. In a poorly designed data protection solution, this can render automated recovery impossible and effectively sets the network back to square one.

Getting back applications and information after a ransomware attack becomes a sprint against time as the targeted business fights to stop lateral movement, eradicate the crypto-ransomware, and restore enterprise-critical activity. Due to the fact that ransomware needs time to replicate throughout a network, attacks are often sprung on weekends and holidays, when attacks are likely to take longer to detect. This compounds the difficulty of quickly mobilizing and orchestrating a capable response team.

Progent has a variety of help services for securing Stamford organizations from crypto-ransomware events. Among these are team member education to help identify and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat defense to discover and extinguish zero-day modern malware attacks. Progent in addition can provide the services of expert ransomware recovery consultants with the talent and perseverance to rebuild a compromised network as quickly as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will return the keys to decrypt any of your data. Kaspersky Labs estimated that seventeen percent of ransomware victims never recovered their data even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to re-install the mission-critical components of your Information Technology environment. Without the availability of full data backups, this calls for a broad complement of skills, professional project management, and the ability to work 24x7 until the recovery project is completed.

For twenty years, Progent has made available professional IT services for companies throughout the United States and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained high-level industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of expertise affords Progent the skills to efficiently ascertain necessary systems and consolidate the surviving parts of your Information Technology environment following a ransomware penetration and assemble them into a functioning network.

Progent's ransomware team of experts uses top notch project management tools to coordinate the sophisticated recovery process. Progent appreciates the importance of working swiftly and together with a client's management and Information Technology resources to prioritize tasks and to put key systems back on-line as fast as humanly possible.

Customer Story: A Successful Ransomware Penetration Recovery
A business engaged Progent after their organization was crashed by the Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored criminal gangs, possibly adopting techniques exposed from America's National Security Agency. Ryuk targets specific businesses with little or no room for disruption and is among the most profitable instances of ransomware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in Chicago and has around 500 employees. The Ryuk attack had brought down all business operations and manufacturing processes. Most of the client's data protection had been online at the beginning of the attack and were damaged. The client was actively seeking loans for paying the ransom (exceeding $200,000) and praying for good luck, but ultimately made the decision to use Progent.

Progent worked together with the client to rapidly assess and assign priority to the critical systems that needed to be restored in order to resume business functions:

• Active Directory (AD)
• Electronic Messaging
• MRP System

In less than 2 days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then assisted with reinstallations and hard drive recovery on critical systems. All Microsoft Exchange Server schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to locate intact OST files (Microsoft Outlook Off-Line Data Files) on staff PCs to recover mail data. A recent off-line backup of the client's accounting software made them able to return these vital programs back servicing users. Although a lot of work was left to recover completely from the Ryuk attack, core services were restored rapidly:

Throughout the following month key milestones in the restoration project were completed in close collaboration between Progent consultants and the customer:

• In-house web applications were returned to operation with no loss of data.
• The MailStore Server with over four million archived emails was spun up and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were fully recovered.
• A new Palo Alto Networks 850 firewall was installed.
• Most of the desktop computers were fully operational.

Conclusion
A potential business extinction disaster was dodged through the efforts of hard-working professionals, a broad spectrum of knowledge, and close collaboration. Although in retrospect the ransomware virus penetration detailed here could have been identified and prevented with current security systems and recognized best practices, user education, and well designed security procedures for data backup and keeping systems up to date with security patches, the fact is that state-sponsored cybercriminals from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's team of professionals has substantial experience in ransomware virus defense, mitigation, and file restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Stamford
For ransomware system restoration services in the Stamford metro area, call Progent at 800-462-8800 or visit Contact Progent.