Ransomware : Your Worst IT Disaster
Crypto-Ransomware  Recovery ProfessionalsRansomware has become a too-frequent cyberplague that represents an enterprise-level danger for businesses vulnerable to an assault. Versions of ransomware like the CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for a long time and continue to inflict havoc. Modern versions of crypto-ransomware such as Ryuk and Hermes, along with additional unnamed malware, not only encrypt on-line information but also infiltrate any configured system restores and backups. Information synchronized to off-site disaster recovery sites can also be ransomed. In a poorly architected system, it can make automated restore operations impossible and effectively knocks the network back to square one.

Restoring programs and data after a crypto-ransomware attack becomes a sprint against the clock as the victim tries its best to stop lateral movement and eradicate the ransomware and to resume mission-critical activity. Because ransomware requires time to spread, attacks are often sprung during nights and weekends, when successful penetrations tend to take more time to notice. This multiplies the difficulty of quickly marshalling and coordinating an experienced mitigation team.

Progent makes available an assortment of services for protecting businesses from ransomware attacks. Among these are team member training to help identify and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of next-generation security appliances with AI capabilities to quickly detect and suppress day-zero cyber threats. Progent also provides the assistance of seasoned ransomware recovery professionals with the skills and commitment to rebuild a breached environment as soon as possible.

Progent's Crypto-Ransomware Recovery Services
After a crypto-ransomware penetration, paying the ransom in cryptocurrency does not ensure that cyber hackers will return the needed keys to decrypt any of your information. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms commonly range from fifteen to forty BTC ($120,000 and $400,000). This is significantly higher than the usual ransomware demands, which ZDNET estimates to be approximately $13,000. The other path is to re-install the vital components of your IT environment. Without access to essential information backups, this calls for a wide range of IT skills, professional project management, and the ability to work 24x7 until the recovery project is over.

For twenty years, Progent has offered expert IT services for businesses in Addison and throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have been awarded advanced industry certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have garnered internationally-renowned industry certifications including CISA, CISSP, CRISC, and SANS GIAC. (See Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of expertise gives Progent the skills to quickly determine critical systems and consolidate the remaining parts of your computer network environment following a ransomware penetration and configure them into an operational network.

Progent's recovery team deploys top notch project management systems to coordinate the complex recovery process. Progent understands the importance of working rapidly and in concert with a customerís management and Information Technology resources to prioritize tasks and to get the most important systems back on line as fast as possible.

Customer Story: A Successful Ransomware Penetration Restoration
A customer escalated to Progent after their network was attacked by Ryuk crypto-ransomware. Ryuk is generally considered to have been created by Northern Korean state sponsored hackers, possibly adopting algorithms exposed from the United States NSA organization. Ryuk goes after specific organizations with little or no room for operational disruption and is one of the most lucrative iterations of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in the Chicago metro area with around 500 employees. The Ryuk penetration had paralyzed all company operations and manufacturing processes. The majority of the client's backups had been online at the beginning of the attack and were damaged. The client was pursuing financing for paying the ransom (more than $200K) and hoping for good luck, but in the end made the decision to use Progent.


"I cannot thank you enough in regards to the care Progent gave us throughout the most stressful period of (our) companyís life. We would have paid the hackers behind this attack except for the confidence the Progent experts provided us. The fact that you were able to get our messaging and essential applications back online quicker than one week was amazing. Each staff member I talked with or messaged at Progent was absolutely committed on getting us restored and was working day and night on our behalf."

Progent worked together with the client to rapidly determine and prioritize the essential areas that had to be addressed in order to continue business operations:

  • Active Directory
  • Email
  • Financials/MRP
To begin, Progent adhered to Anti-virus incident mitigation best practices by stopping lateral movement and clearing infected systems. Progent then began the process of restoring Active Directory, the core of enterprise systems built upon Microsoft Windows Server technology. Exchange messaging will not function without Active Directory, and the businessesí accounting and MRP applications used Microsoft SQL, which requires Active Directory services for authentication to the database.

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-virus state. Progent then accomplished setup and hard drive recovery on the most important servers. All Exchange Server data and configuration information were usable, which accelerated the restore of Exchange. Progent was able to locate local OST data files (Outlook Offline Data Files) on team workstations and laptops in order to recover email messages. A recent off-line backup of the customerís financials/MRP software made them able to return these required programs back online. Although a lot of work still had to be done to recover totally from the Ryuk virus, the most important services were returned to operations quickly:


"For the most part, the production line operation ran fairly normal throughout and we delivered all customer sales."

Throughout the next couple of weeks important milestones in the restoration project were accomplished through close cooperation between Progent team members and the client:

  • In-house web sites were restored with no loss of information.
  • The MailStore Server containing more than four million archived emails was spun up and accessible to users.
  • CRM/Orders/Invoices/AP/AR/Inventory Control capabilities were 100 percent restored.
  • A new Palo Alto 850 firewall was set up.
  • Nearly all of the user PCs were functioning as before the incident.

"So much of what occurred during the initial response is mostly a haze for me, but our team will not soon forget the urgency each and every one of the team put in to give us our business back. I have been working with Progent for at least 10 years, possibly more, and each time Progent has outperformed my expectations and delivered. This event was a stunning achievement."

Conclusion
A possible business-killing catastrophe was avoided through the efforts of dedicated professionals, a wide range of knowledge, and close collaboration. Although in retrospect the ransomware virus incident described here could have been shut down with current cyber security systems and ISO/IEC 27001 best practices, user and IT administrator training, and well designed security procedures for information protection and applying software patches, the reality is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a crypto-ransomware penetration, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, mitigation, and data recovery.


"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were helping), Iím grateful for allowing me to get some sleep after we got past the most critical parts. All of you did an amazing effort, and if any of your guys is around the Chicago area, dinner is the least I can do!"

To read or download a PDF version of this customer story, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Addison a range of remote monitoring and security evaluation services designed to assist you to reduce your vulnerability to crypto-ransomware. These services include modern artificial intelligence technology to detect new variants of crypto-ransomware that can escape detection by traditional signature-based security products.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring is an endpoint protection solution that utilizes next generation behavior analysis technology to guard physical and virtual endpoints against new malware attacks such as ransomware and file-less exploits, which routinely get by traditional signature-based anti-virus products. ProSight ASM safeguards local and cloud-based resources and offers a unified platform to automate the entire threat lifecycle including protection, identification, containment, remediation, and forensics. Top capabilities include single-click rollback using Windows VSS and real-time network-wide immunization against newly discovered threats. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

  • ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
    ProSight Enhanced Security Protection (ESP) managed services deliver affordable in-depth security for physical servers and virtual machines, workstations, smartphones, and Exchange email. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and responding to cyber assaults from all attack vectors. ProSight ESP provides two-way firewall protection, penetration alerts, endpoint control, and web filtering through cutting-edge tools incorporated within one agent managed from a unified control. Progent's data protection and virtualization experts can assist your business to design and configure a ProSight ESP deployment that meets your organization's specific requirements and that helps you achieve and demonstrate compliance with legal and industry data security regulations. Progent will assist you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that call for urgent attention. Progent's consultants can also help you to set up and test a backup and restore solution such as ProSight Data Protection Services (DPS) so you can recover quickly from a destructive cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange filtering.

  • ProSight Data Protection Services: Managed Backup and Recovery
    ProSight Data Protection Services offer small and medium-sized organizations a low cost end-to-end solution for reliable backup/disaster recovery (BDR). Available at a fixed monthly rate, ProSight DPS automates your backup processes and allows fast restoration of vital files, apps and VMs that have become lost or damaged as a result of hardware failures, software glitches, disasters, human error, or malware attacks like ransomware. ProSight DPS can help you protect, retrieve and restore files, folders, apps, system images, as well as Microsoft Hyper-V and VMware images/. Important data can be protected on the cloud, to a local storage device, or to both. Progent's BDR specialists can provide advanced support to configure ProSight Data Protection Services to be compliant with government and industry regulatory requirements like HIPAA, FIRPA, and PCI and, when needed, can help you to recover your business-critical data. Read more about ProSight DPS Managed Cloud Backup.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading information security vendors to provide centralized control and world-class protection for all your email traffic. The powerful structure of Email Guard managed service integrates cloud-based filtering with a local security gateway device to provide advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's Cloud Protection Layer serves as a first line of defense and keeps most unwanted email from reaching your network firewall. This reduces your vulnerability to inbound threats and conserves network bandwidth and storage. Email Guard's onsite gateway appliance provides a deeper layer of inspection for incoming email. For outbound email, the onsite gateway offers AV and anti-spam filtering, DLP, and email encryption. The on-premises security gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email that stays inside your corporate firewall. For more details, visit ProSight Email Guard spam and content filtering.

  • ProSight WAN Watch: Infrastructure Remote Monitoring and Management
    ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for smaller organizations to map, track, enhance and debug their connectivity appliances like routers and switches, firewalls, and load balancers plus servers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network maps are kept current, captures and displays the configuration information of virtually all devices connected to your network, monitors performance, and generates alerts when issues are detected. By automating complex management and troubleshooting activities, WAN Watch can knock hours off common tasks like making network diagrams, reconfiguring your network, locating appliances that need critical software patches, or resolving performance problems. Find out more details about ProSight WAN Watch infrastructure management services.

  • ProSight LAN Watch: Server and Desktop Remote Monitoring
    ProSight LAN Watch is Progentís server and desktop monitoring service that uses advanced remote monitoring and management (RMM) techniques to keep your IT system running at peak levels by checking the health of vital computers that power your business network. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your specified IT personnel and your assigned Progent consultant so that any potential issues can be resolved before they have a chance to impact productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
    With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual host set up and managed by Progent's network support professionals. Under Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the operating system platforms, and the apps. Because the system is virtualized, it can be ported immediately to a different hardware solution without a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, find and protect information about your network infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be alerted about impending expirations of SSLs or domains. By updating and managing your network documentation, you can eliminate up to half of time thrown away trying to find vital information about your IT network. ProSight IT Asset Management includes a common location for storing and sharing all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT information. Whether youíre making enhancements, doing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the information you need the instant you need it. Read more about Progent's ProSight IT Asset Management service.
For 24x7x365 Addison Crypto-Ransomware Recovery Support Services, contact Progent at 800-993-9400 or go to Contact Progent.