If ransomware has hit your business, call OAC Technology at 952-548-5558 now, whether or not you are a client. OAC isolates the affected systems, removes the ransomware and the attacker’s backdoors, restores data from backups where they exist, closes the entry point and works with your insurer and the authorities, reducing recovery from weeks to days.
Ransomware, a form of malware, poses a serious threat to small and medium-sized businesses that often have limited IT resources. It can encrypt your files and cripple your operations. These malicious attacks can lead to loss of revenue and injury to your company’s reputation. At OAC Technology, we understand the importance of ransomware remediation and the intricacy involved in getting you back in business. Our process will help you recover your data quickly to minimize downtime and strengthen your security against the next attack.
When a ransomware attack strikes your business, it encrypts your files and demands payment in exchange for a decryption key. Sometimes the damage is isolated to a few files, but sometimes it permeates all of your systems. As a first step, we isolate affected systems from your network so the ransomware cannot spread any further. Then we assess the damage it has done. Our experts will identify the impact on your network, endpoints, and cloud environments. Whatever ransomware variant has locked up your systems, our team has the experience to handle it efficiently, reducing your recovery time from weeks to days.
Next, our expert technicians will begin the cleanup process. We will identify and remove all malicious .exe files, registry modifications, and scheduled tasks and services. Our technicians will remove any command-and-control instances, along with any installed backdoors for the attacker to regain access. Then we will reset passwords for VPN and cloud accounts, reset access controls for networks, and establish multifactor authentication wherever possible.
Sometimes we can recover data after a ransomware attack, but data recovery is not guaranteed. Restoring backups is often the fastest and most reliable way to get your business operational again. Whether attempting data recovery or restoring backups, OAC Technology can take the steps to restore your systems and minimize downtime.
To secure your environment, we run a vulnerability scan to find places that may be susceptible to attack. We assess how the ransomware was able to get into your IT environment. Then we will lock down your network and systems to reinforce areas of vulnerability. We implement endpoint protection as a vital step toward preventing ransomware from happening again. Another useful security measure is to ensure alerts go to key IT personnel for any ransomware-like behavior. Because of this, we recommend a combination of SentinelOne for endpoint protection and Huntress 24/7 Managed Security for immediate security response. We can also implement offsite backups to secure data in the event of future ransomware events.
Dealing with the aftermath of a cyber attack can be overwhelming, but we can help you navigate the fallout. Between filing reports and claims and getting your business operational again, there is a lot to manage. We can work with your insurance company and the appropriate authorities after your ransomware attack.
If you’ve been the victim of ransomware, don’t delay in reaching out. Talk with our technical experts to start ransomware remediation services today!
After a cleanup, the layers that prevent a repeat are priced on our managed IT cost page: Huntress managed detection and response at $9 per computer or server per month, SentinelOne at $12 per computer or server per month ($8 alongside Huntress), server backups at $100 per server per month, and security awareness training at $2 per user per month.
To prepare before anything happens, use our disaster recovery plan template, our data breach and incident response plan template and the free cyber insurance readiness check. For a single infected computer rather than a ransomware attack, see virus and malware removal.
Disconnect every affected computer and server from the network, by unplugging the cable and turning off Wi-Fi, but leave them powered on: memory holds evidence about the strain and the entry point, and some encryption can be stopped mid-run. Stop using them. Disconnect any backup drive or NAS so the backups stay intact. Then call OAC at 952-548-5558 and your cyber insurer, both within the first hour; most policies require notice within hours and the insurer assigns an incident-response firm and counsel. Do not contact or pay the attackers, and do not wipe or rebuild anything before the assessment. Photograph the ransom note and note the extension on encrypted files; they identify the strain. The full first hour, day and week checklist is in our article on what to do when infected with ransomware.
It depends mostly on whether backups exist that the attacker could not reach and that have been tested. With tested backups and a provider who has done it before, critical systems can be back in a day or two and everything within about a week; a 20-person business with good backups is usually running again within two days. Without backups, or with backups that were also encrypted, recovery is measured in weeks and sometimes does not fully happen. OAC’s process runs in five stages: isolation and assessment, cleanup of the attacker’s files, backdoors and scheduled tasks, data recovery or restoration from backups, hardening of the entry point, and coordination with your insurer and the authorities. Restoring from backups is usually the fastest and most reliable route, which is how recovery time comes down from weeks to days; recovering encrypted data without them is not guaranteed.
Not without your insurer and counsel, and preferably not at all. The FBI advises against paying: payment does not guarantee working decryption, stolen data is rarely deleted, and paying a sanctioned group can itself be illegal. Whether or not files are decrypted, the attacker’s backdoors, scheduled tasks and command-and-control footholds still have to be removed and every VPN and cloud credential reset, which is the cleanup stage of OAC’s remediation. Businesses with tested backups and a response plan rarely need to consider paying. If the decision ever comes up, it is made with your insurer and counsel before anyone communicates with the attackers.
Sometimes. Restoring from backups is the fastest and most reliable route, so OAC tries that first. Where backups are missing or were also encrypted, some strains have free public decryptors, published through the No More Ransom project by police and security firms, and OAC sometimes has tools to unlock ransomware and recover encrypted data, but most current strains have no decryptor and recovery is not guaranteed. The ransom note and the extension on encrypted files identify the strain, so keep both.
