Ransomware : Your Feared IT Catastrophe
Ransomware  Recovery ExpertsRansomware has become a modern cyber pandemic that presents an enterprise-level threat for businesses vulnerable to an assault. Multiple generations of ransomware like the Reveton, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for a long time and continue to inflict damage. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Lockbit or Nephilim, along with daily as yet unnamed newcomers, not only do encryption of on-line data but also infiltrate many available system protection. Information synched to cloud environments can also be ransomed. In a vulnerable data protection solution, it can render automated restoration useless and basically sets the network back to square one.

Restoring services and data after a crypto-ransomware outage becomes a sprint against the clock as the targeted business fights to stop the spread and clear the virus and to restore enterprise-critical activity. Since ransomware requires time to replicate, penetrations are usually sprung on weekends, when penetrations tend to take longer to discover. This multiplies the difficulty of quickly mobilizing and orchestrating a capable mitigation team.

Progent provides an assortment of solutions for protecting enterprises from ransomware attacks. These include user education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of the latest generation security appliances with machine learning capabilities to quickly detect and disable day-zero cyber attacks. Progent also can provide the assistance of veteran crypto-ransomware recovery professionals with the track record and perseverance to restore a compromised system as soon as possible.

Progent's Ransomware Recovery Services
After a ransomware event, sending the ransom demands in Bitcoin cryptocurrency does not ensure that cyber criminals will return the codes to decipher any or all of your data. Kaspersky Labs determined that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is significantly higher than the usual ransomware demands, which ZDNET averages to be in the range of $13,000. The fallback is to re-install the mission-critical elements of your Information Technology environment. Without access to complete system backups, this requires a wide range of IT skills, well-coordinated project management, and the willingness to work non-stop until the recovery project is complete.

For twenty years, Progent has made available professional Information Technology services for businesses in Adelaide and across the US and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have attained high-level certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, and GIAC. (Refer to Progent's certifications). Progent also has expertise in accounting and ERP application software. This breadth of experience affords Progent the ability to rapidly ascertain important systems and organize the remaining pieces of your IT environment following a ransomware event and rebuild them into a functioning system.

Progent's security team utilizes top notch project management systems to orchestrate the complex recovery process. Progent appreciates the urgency of working swiftly and in concert with a client's management and IT resources to assign priority to tasks and to put key services back online as soon as possible.

Business Case Study: A Successful Ransomware Attack Restoration
A business escalated to Progent after their company was crashed by the Ryuk ransomware virus. Ryuk is thought to have been created by Northern Korean government sponsored criminal gangs, possibly using technology exposed from Americaís National Security Agency. Ryuk targets specific organizations with little or no ability to sustain disruption and is among the most profitable versions of crypto-ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in Chicago with about 500 staff members. The Ryuk intrusion had brought down all business operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the beginning of the intrusion and were damaged. The client was evaluating paying the ransom (exceeding $200K) and praying for good luck, but in the end reached out to Progent.


"I cannot speak enough about the expertise Progent gave us during the most stressful time of (our) businesses life. We may have had to pay the cybercriminals if not for the confidence the Progent team afforded us. The fact that you could get our e-mail and production servers back on-line quicker than five days was earth shattering. Every single staff member I talked with or e-mailed at Progent was absolutely committed on getting us working again and was working breakneck pace to bail us out."

Progent worked together with the customer to rapidly assess and assign priority to the key areas that needed to be addressed in order to restart company functions:

  • Active Directory (AD)
  • Exchange Server
  • MRP System
To get going, Progent adhered to Anti-virus incident response industry best practices by isolating and removing active viruses. Progent then began the work of bringing back online Active Directory, the foundation of enterprise systems built upon Microsoft Windows technology. Microsoft Exchange Server messaging will not function without Windows AD, and the businessesí accounting and MRP applications used Microsoft SQL Server, which needs Active Directory for access to the database.

Within two days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then performed rebuilding and hard drive recovery of essential servers. All Microsoft Exchange Server schema and attributes were intact, which greatly helped the restore of Exchange. Progent was also able to assemble non-encrypted OST data files (Microsoft Outlook Off-Line Folder Files) on team workstations in order to recover email data. A not too old offline backup of the customerís accounting software made it possible to return these vital programs back available to users. Although a lot of work still had to be done to recover fully from the Ryuk attack, core services were returned to operations quickly:


"For the most part, the production line operation ran fairly normal throughout and we did not miss any customer orders."

During the next few weeks key milestones in the restoration project were accomplished in close cooperation between Progent team members and the client:

  • Internal web sites were restored with no loss of data.
  • The MailStore Microsoft Exchange Server exceeding 4 million archived emails was spun up and accessible to users.
  • CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control functions were 100% restored.
  • A new Palo Alto 850 security appliance was brought on-line.
  • Nearly all of the user workstations were being used by staff.

"So much of what transpired in the early hours is nearly entirely a fog for me, but we will not forget the urgency all of you put in to give us our business back. Iíve been working together with Progent for the past 10 years, possibly more, and each time Progent has impressed me and delivered. This event was a Herculean accomplishment."

Conclusion
A likely business extinction catastrophe was avoided due to dedicated experts, a broad array of IT skills, and tight collaboration. Although in post mortem the crypto-ransomware penetration detailed here should have been shut down with advanced security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and properly executed security procedures for data backup and keeping systems up to date with security patches, the reality is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware attack, feel confident that Progent's roster of experts has substantial experience in crypto-ransomware virus defense, mitigation, and data restoration.


"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Tony and Chris (along with others that were helping), thanks very much for making it so I could get some sleep after we made it through the most critical parts. All of you did an fabulous effort, and if anyone that helped is visiting the Chicago area, dinner is on me!"

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Adelaide a variety of remote monitoring and security evaluation services to assist you to minimize the threat from ransomware. These services include next-generation artificial intelligence capability to detect new strains of ransomware that can get past legacy signature-based anti-virus solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes cutting edge behavior-based analysis technology to guard physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which easily evade legacy signature-matching anti-virus products. ProSight Active Security Monitoring protects local and cloud-based resources and provides a unified platform to manage the entire malware attack progression including filtering, detection, mitigation, cleanup, and forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

  • ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Filtering
    ProSight Enhanced Security Protection managed services offer economical in-depth security for physical and virtual servers, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and advanced heuristics for round-the-clock monitoring and responding to cyber threats from all attack vectors. ProSight ESP provides firewall protection, penetration alarms, device control, and web filtering through leading-edge tools incorporated within one agent accessible from a single control. Progent's security and virtualization consultants can assist you to design and configure a ProSight ESP environment that addresses your company's unique requirements and that allows you achieve and demonstrate compliance with government and industry information protection regulations. Progent will help you define and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that require immediate action. Progent's consultants can also help your company to install and test a backup and restore system such as ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange email filtering.

  • ProSight Data Protection Services: Managed Backup and Recovery
    ProSight Data Protection Services provide small and mid-sized organizations an affordable end-to-end solution for secure backup/disaster recovery. Available at a low monthly price, ProSight Data Protection Services automates your backup activities and allows fast recovery of vital data, applications and virtual machines that have become lost or corrupted as a result of hardware failures, software bugs, natural disasters, human error, or malware attacks like ransomware. ProSight Data Protection Services can help you back up, recover and restore files, folders, applications, system images, plus Microsoft Hyper-V and VMware virtual machine images. Critical data can be backed up on the cloud, to an on-promises storage device, or to both. Progent's cloud backup specialists can provide advanced support to configure ProSight Data Protection Services to to comply with regulatory requirements such as HIPAA, FIRPA, PCI and Safe Harbor and, whenever needed, can assist you to recover your business-critical information. Learn more about ProSight Data Protection Services Managed Backup and Recovery.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of leading data security companies to deliver web-based management and comprehensive protection for your email traffic. The powerful structure of Email Guard integrates a Cloud Protection Layer with an on-premises security gateway appliance to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The Cloud Protection Layer acts as a preliminary barricade and blocks the vast majority of threats from reaching your network firewall. This reduces your vulnerability to external attacks and saves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a deeper layer of inspection for incoming email. For outgoing email, the local security gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to monitor and protect internal email traffic that originates and ends within your security perimeter. For more information, visit Email Guard spam filtering and data leakage protection.

  • ProSight WAN Watch: Infrastructure Management
    Progentís ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for smaller businesses to map out, track, optimize and debug their networking hardware such as routers, firewalls, and access points as well as servers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology maps are always current, copies and manages the configuration of virtually all devices on your network, tracks performance, and sends notices when problems are discovered. By automating tedious management and troubleshooting activities, WAN Watch can cut hours off ordinary chores such as network mapping, expanding your network, finding devices that require critical updates, or identifying the cause of performance problems. Learn more details about ProSight WAN Watch infrastructure management services.

  • ProSight LAN Watch: Server and Desktop Monitoring
    ProSight LAN Watch is Progentís server and desktop monitoring managed service that incorporates advanced remote monitoring and management technology to keep your network running at peak levels by tracking the state of critical computers that drive your business network. When ProSight LAN Watch uncovers an issue, an alarm is transmitted automatically to your specified IT management staff and your assigned Progent engineering consultant so any potential problems can be addressed before they have a chance to impact productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
    With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host set up and managed by Progent's IT support experts. With the ProSight Virtual Hosting model, the client retains ownership of the data, the OS software, and the apps. Since the environment is virtualized, it can be ported easily to an alternate hosting solution without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not tied one hosting provider. Learn more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, retrieve and safeguard data about your network infrastructure, procedures, business apps, and services. You can quickly locate passwords or serial numbers and be warned automatically about upcoming expirations of SSLs or domains. By updating and managing your network documentation, you can eliminate up to 50% of time wasted searching for vital information about your network. ProSight IT Asset Management includes a centralized location for storing and collaborating on all documents required for managing your network infrastructure like recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether youíre making enhancements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you require the instant you need it. Find out more about Progent's ProSight IT Asset Management service.
For Adelaide 24-Hour Crypto-Ransomware Recovery Consultants, call Progent at 800-993-9400 or go to Contact Progent.