24x7 Akron Critical Crypto
Malware Detection and Removal Help

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become an escalating cyber pandemic that poses an extinction-level danger for organizations poorly prepared for an attack. Versions of ransomware like the CrySIS, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for years and still cause havoc. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, as well as additional as yet unnamed newcomers, not only do encryption of online files but also infect many accessible system protection. Information replicated to off-site disaster recovery sites can also be ransomed. In a vulnerable environment, it can render any restore operations useless and basically sets the network back to zero.

Retrieving applications and information after a ransomware attack becomes a race against the clock as the targeted business tries its best to stop the spread, remove the ransomware, and resume business-critical activity. Because crypto-ransomware takes time to replicate, penetrations are frequently sprung during nights and weekends, when successful penetrations are likely to take longer to identify. This compounds the difficulty of quickly marshalling and orchestrating a capable response team.

Progent has an assortment of help services for securing enterprises from ransomware penetrations. Among these are team member training to help recognize and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of modern security gateways with artificial intelligence technology from SentinelOne to identify and quarantine new cyber attacks intelligently. Progent also provides the services of experienced crypto-ransomware recovery consultants with the talent and perseverance to rebuild a compromised system as soon as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not guarantee that merciless criminals will respond with the needed codes to decrypt any of your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their information after having paid the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The alternative is to setup from scratch the critical parts of your Information Technology environment. Without access to complete system backups, this calls for a broad range of IT skills, top notch team management, and the capability to work 24x7 until the job is complete.

For two decades, Progent has provided professional IT services for companies across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP application software. This breadth of experience provides Progent the ability to quickly identify necessary systems and consolidate the remaining components of your Information Technology environment after a ransomware attack and assemble them into an operational system.

Progent's ransomware team of experts utilizes state-of-the-art project management applications to coordinate the complicated recovery process. Progent knows the urgency of acting quickly and in concert with a customer's management and IT staff to prioritize tasks and to get key applications back online as soon as humanly possible.

Customer Case Study: A Successful Ransomware Virus Response
A client sought out Progent after their network system was attacked by the Ryuk ransomware virus. Ryuk is believed to have been developed by North Korean state sponsored cybercriminals, possibly using algorithms leaked from America's National Security Agency. Ryuk goes after specific companies with little or no room for operational disruption and is one of the most profitable versions of crypto-ransomware. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company based in Chicago and has around 500 staff members. The Ryuk event had brought down all business operations and manufacturing processes. The majority of the client's data protection had been on-line at the start of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom (in excess of $200,000) and praying for good luck, but ultimately made the decision to use Progent.

Progent worked with the client to rapidly determine and assign priority to the mission critical areas that needed to be restored to make it possible to continue company operations:

• Microsoft Active Directory
• Email
• MRP System

Within two days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then initiated rebuilding and hard drive recovery of essential servers. All Microsoft Exchange Server ties and attributes were intact, which facilitated the rebuild of Exchange. Progent was able to collect local OST data files (Outlook Off-Line Data Files) on user desktop computers and laptops in order to recover mail data. A recent off-line backup of the customer's financials/MRP software made it possible to return these vital services back servicing users. Although major work still had to be done to recover totally from the Ryuk event, essential systems were recovered quickly:

Over the following month important milestones in the restoration process were achieved through close collaboration between Progent engineers and the customer:

• In-house web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than 4 million archived messages was restored to operations and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/AR/Inventory Control functions were fully recovered.
• A new Palo Alto Networks 850 firewall was brought online.
• Most of the user desktops and notebooks were being used by staff.

Conclusion
A likely enterprise-killing disaster was evaded through the efforts of top-tier professionals, a wide range of IT skills, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware attack described here could have been identified and prevented with up-to-date cyber security technology solutions and ISO/IEC 27001 best practices, team education, and well thought out incident response procedures for data backup and keeping systems up to date with security patches, the fact is that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's roster of professionals has extensive experience in ransomware virus blocking, removal, and data restoration.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Akron a variety of remote monitoring and security evaluation services to help you to reduce your vulnerability to ransomware. These services include next-generation AI capability to detect zero-day strains of crypto-ransomware that can get past legacy signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management techniques to help keep your IT system operating at peak levels by tracking the health of vital assets that power your business network. When ProSight LAN Watch uncovers a problem, an alarm is transmitted automatically to your designated IT management personnel and your Progent engineering consultant so that all potential problems can be resolved before they have a chance to disrupt productivity. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for managing your client-server infrastructure by providing tools for streamlining common time-consuming tasks. These include health checking, patch management, automated remediation, endpoint deployment, backup and recovery, anti-virus defense, secure remote access, built-in and custom scripts, asset inventory, endpoint profile reports, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alert to your designated IT management staff and your assigned Progent technical consultant so potential issues can be fixed before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for smaller organizations to map out, track, reconfigure and debug their connectivity appliances such as routers and switches, firewalls, and load balancers plus servers, client computers and other networked devices. Incorporating state-of-the-art RMM technology, WAN Watch makes sure that network diagrams are kept current, captures and manages the configuration information of virtually all devices connected to your network, tracks performance, and sends alerts when problems are discovered. By automating complex network management processes, WAN Watch can cut hours off ordinary tasks such as network mapping, expanding your network, finding appliances that need critical software patches, or isolating performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of real-time and in-depth reporting plug-ins designed to work with the leading ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize critical issues such as inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has worked with advanced backup technology companies to produce ProSight Data Protection Services, a family of subscription-based offerings that provide backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup operations and allow transparent backup and rapid recovery of vital files, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps you recover from data loss caused by hardware failures, natural disasters, fire, cyber attacks such as ransomware, human error, ill-intentioned employees, or application bugs. Managed services available in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of top information security vendors to deliver web-based management and world-class security for your inbound and outbound email. The hybrid structure of Email Guard managed service combines a Cloud Protection Layer with a local gateway appliance to provide complete protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne malware. The cloud filter acts as a preliminary barricade and blocks the vast majority of threats from making it to your security perimeter. This reduces your vulnerability to external threats and saves system bandwidth and storage space. Email Guard's on-premises security gateway appliance provides a further level of inspection for inbound email. For outbound email, the local gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also help Microsoft Exchange Server to track and safeguard internal email traffic that stays inside your security perimeter. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication services incorporate Cisco's Duo technology to protect against stolen passwords through the use of two-factor authentication (2FA). Duo supports single-tap identity verification on iOS, Google Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a secured online account and enter your password you are requested to confirm who you are via a device that only you have and that uses a different network channel. A broad selection of out-of-band devices can be utilized as this added means of ID validation such as an iPhone or Android or wearable, a hardware token, a landline phone, etc. You can designate multiple validation devices. To learn more about ProSight Duo identity validation services, refer to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Service Center: Support Desk Managed Services
  Progent's Support Center managed services allow your information technology team to outsource Help Desk services to Progent or divide activity for support services seamlessly between your in-house network support group and Progent's nationwide roster of certified IT service engineers and subject matter experts. Progent's Shared Help Desk Service offers a smooth extension of your in-house IT support resources. User access to the Service Desk, delivery of technical assistance, problem escalation, trouble ticket creation and updates, performance metrics, and management of the support database are consistent regardless of whether issues are taken care of by your core support organization, by Progent, or by a combination. Learn more about Progent's outsourced/co-managed Call Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior machine learning tools to defend endpoint devices and servers and VMs against modern malware attacks like ransomware and email phishing, which routinely get by traditional signature-based AV products. Progent ASM services protect on-premises and cloud-based resources and offers a unified platform to manage the entire threat lifecycle including protection, detection, containment, cleanup, and forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, update, retrieve and protect information about your IT infrastructure, processes, business apps, and services. You can quickly find passwords or serial numbers and be alerted about impending expirations of SSL certificates or domains. By cleaning up and managing your IT documentation, you can save up to half of time spent searching for vital information about your IT network. ProSight IT Asset Management features a centralized repository for holding and collaborating on all documents required for managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT information. Whether you're planning enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the data you require the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for patch management offer organizations of any size a flexible and affordable alternative for evaluating, validating, scheduling, applying, and tracking updates to your dynamic IT system. Besides maximizing the security and reliability of your computer environment, Progent's patch management services free up time for your in-house IT staff to focus on line-of-business initiatives and activities that deliver maximum business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual machine host configured and maintained by Progent's network support professionals. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS software, and the apps. Because the system is virtualized, it can be ported easily to an alternate hosting environment without a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoints against modern malware attacks such as ransomware and file-less exploits, which easily escape traditional signature-based anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud resources and offers a unified platform to manage the complete threat lifecycle including filtering, identification, containment, remediation, and post-attack forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services deliver economical in-depth protection for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and responding to security threats from all attack vectors. ProSight ESP offers two-way firewall protection, intrusion alarms, endpoint control, and web filtering through leading-edge technologies incorporated within one agent managed from a single control. Progent's security and virtualization experts can help you to design and implement a ProSight ESP environment that addresses your organization's specific needs and that helps you achieve and demonstrate compliance with government and industry data protection regulations. Progent will assist you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that call for immediate action. Progent can also assist your company to set up and verify a backup and restore solution such as ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange email filtering.