Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware has become a modern cyberplague that represents an extinction-level danger for businesses of all sizes poorly prepared for an attack. Different iterations of ransomware such as CrySIS, Fusob, Locky, SamSam and MongoLock cryptoworms have been replicating for a long time and still cause destruction. Modern strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as additional as yet unnamed newcomers, not only do encryption of on-line critical data but also infiltrate any available system protection mechanisms. Files synched to off-site disaster recovery sites can also be ransomed. In a poorly architected system, this can render automatic restoration useless and basically sets the datacenter back to square one.
Getting back online programs and data following a crypto-ransomware attack becomes a race against time as the targeted organization fights to stop lateral movement, eradicate the crypto-ransomware, and restore business-critical activity. Due to the fact that crypto-ransomware needs time to move laterally, penetrations are usually sprung at night, when successful penetrations tend to take longer to uncover. This multiplies the difficulty of rapidly assembling and organizing a capable response team.
Progent offers a variety of services for securing organizations from ransomware events. Among these are user education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of modern security solutions with machine learning technology from SentinelOne to identify and suppress day-zero cyber attacks automatically. Progent also can provide the services of experienced crypto-ransomware recovery engineers with the talent and commitment to restore a breached system as quickly as possible.
Progent's Crypto-Ransomware Recovery Support Services
Soon after a ransomware attack, paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will provide the needed keys to decipher all your information. Kaspersky estimated that seventeen percent of ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to setup from scratch the critical elements of your Information Technology environment. Absent the availability of full system backups, this calls for a wide complement of skills, professional project management, and the capability to work 24x7 until the recovery project is completed.
For twenty years, Progent has provided professional Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained advanced certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of experience provides Progent the skills to efficiently determine necessary systems and consolidate the remaining parts of your Information Technology environment after a ransomware penetration and rebuild them into a functioning network.
Progent's ransomware group utilizes powerful project management systems to coordinate the complicated restoration process. Progent appreciates the importance of working swiftly and in concert with a customer's management and IT resources to prioritize tasks and to put critical systems back on line as soon as possible.
Customer Case Study: A Successful Ransomware Intrusion Response
A customer contacted Progent after their network system was attacked by Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean state criminal gangs, suspected of adopting technology exposed from America's NSA organization. Ryuk goes after specific organizations with limited tolerance for disruption and is among the most lucrative examples of ransomware viruses. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company based in the Chicago metro area and has around 500 workers. The Ryuk attack had brought down all essential operations and manufacturing capabilities. The majority of the client's data backups had been directly accessible at the start of the intrusion and were encrypted. The client was evaluating paying the ransom (more than two hundred thousand dollars) and wishfully thinking for the best, but ultimately engaged Progent.
"I cannot thank you enough about the care Progent gave us during the most fearful period of (our) company's existence. We may have had to pay the criminal gangs except for the confidence the Progent team provided us. The fact that you were able to get our messaging and essential applications back online in less than seven days was amazing. Each expert I got help from or messaged at Progent was urgently focused on getting us operational and was working at all hours on our behalf."
Progent worked with the customer to rapidly assess and prioritize the key elements that had to be addressed to make it possible to resume departmental operations:
- Active Directory (AD)
- Microsoft Exchange
- MRP System
To start, Progent followed ransomware penetration response best practices by halting the spread and disinfecting systems. Progent then started the steps of recovering Microsoft Active Directory, the foundation of enterprise systems built upon Microsoft Windows technology. Microsoft Exchange messaging will not operate without AD, and the businesses' accounting and MRP software utilized SQL Server, which needs Active Directory services for security authorization to the database.
Within 2 days, Progent was able to recover Active Directory services to its pre-attack state. Progent then charged ahead with reinstallations and hard drive recovery of essential applications. All Microsoft Exchange Server ties and configuration information were intact, which greatly helped the restore of Exchange. Progent was also able to assemble intact OST files (Outlook Email Off-Line Data Files) on staff workstations in order to recover mail data. A recent offline backup of the businesses accounting/MRP systems made them able to restore these essential services back on-line. Although significant work still had to be done to recover completely from the Ryuk attack, the most important services were restored quickly:
"For the most part, the assembly line operation survived unscathed and we produced all customer deliverables."
Over the next few weeks critical milestones in the recovery process were completed in tight collaboration between Progent consultants and the client:
- In-house web applications were returned to operation with no loss of data.
- The MailStore Microsoft Exchange Server exceeding four million historical messages was brought on-line and accessible to users.
- CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were completely recovered.
- A new Palo Alto 850 security appliance was installed.
- 90% of the user desktops were back into operation.
"A huge amount of what was accomplished those first few days is nearly entirely a haze for me, but I will not forget the countless hours each of your team put in to help get our company back. I've been working with Progent for at least 10 years, possibly more, and every time Progent has shined and delivered. This time was a stunning achievement."
Conclusion
A likely business disaster was avoided with dedicated experts, a broad range of IT skills, and close teamwork. Although upon completion of forensics the ransomware attack described here should have been stopped with modern cyber security solutions and best practices, team education, and well thought out incident response procedures for data protection and applying software patches, the reality remains that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware penetration, remember that Progent's roster of experts has substantial experience in crypto-ransomware virus blocking, cleanup, and file restoration.
"So, to Darrin, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others that were helping), thank you for making it so I could get some sleep after we got over the most critical parts. All of you did an amazing job, and if anyone that helped is visiting the Chicago area, a great meal is on me!"
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide companies in Anchorage a portfolio of online monitoring and security assessment services to help you to minimize the threat from ransomware. These services utilize modern machine learning technology to uncover new strains of crypto-ransomware that are able to escape detection by legacy signature-based security solutions.
- ProSight LAN Watch: Server and Desktop Remote Monitoring
ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management (RMM) technology to help keep your network running at peak levels by tracking the state of critical assets that drive your information system. When ProSight LAN Watch detects an issue, an alert is sent immediately to your designated IT management personnel and your Progent consultant so all potential problems can be addressed before they have a chance to impact productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.
- ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for managing your network, server, and desktop devices by providing an environment for performing common time-consuming jobs. These can include health checking, update management, automated repairs, endpoint setup, backup and restore, A/V protection, secure remote access, standard and custom scripts, resource inventory, endpoint profile reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it transmits an alarm to your designated IT staff and your Progent consultant so emerging problems can be taken care of before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.
- ProSight WAN Watch: Infrastructure Management
Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to map, track, optimize and debug their networking hardware such as routers, firewalls, and load balancers plus servers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that network diagrams are kept updated, captures and manages the configuration of almost all devices on your network, monitors performance, and sends notices when potential issues are discovered. By automating complex network management activities, ProSight WAN Watch can cut hours off common chores such as network mapping, reconfiguring your network, locating devices that need important software patches, or identifying the cause of performance problems. Find out more details about ProSight WAN Watch infrastructure monitoring and management consulting.
- ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
ProSight Reporting is an expanding suite of real-time and in-depth management reporting utilities designed to work with the industry's top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues like spotty support follow-up or endpoints with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.
- ProSight Data Protection Services: Backup and Recovery Services
Progent has worked with advanced backup/restore software providers to create ProSight Data Protection Services (DPS), a portfolio of subscription-based offerings that provide backup-as-a-service. ProSight DPS products manage and monitor your backup processes and allow transparent backup and rapid recovery of vital files/folders, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss caused by equipment failures, natural calamities, fire, malware like ransomware, user mistakes, malicious insiders, or application bugs. Managed backup services in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent service representative can assist you to determine which of these managed backup services are most appropriate for your network.
- ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of leading information security vendors to provide centralized control and world-class security for all your email traffic. The powerful architecture of Email Guard integrates cloud-based filtering with a local gateway appliance to provide complete defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-based threats. Email Guard's Cloud Protection Layer serves as a first line of defense and keeps most threats from making it to your security perimeter. This decreases your exposure to external attacks and conserves system bandwidth and storage space. Email Guard's onsite security gateway appliance adds a further level of analysis for inbound email. For outbound email, the onsite security gateway provides anti-virus and anti-spam filtering, DLP, and email encryption. The on-premises gateway can also help Exchange Server to track and protect internal email traffic that originates and ends inside your corporate firewall. For more details, visit ProSight Email Guard spam filtering and data leakage protection.
- ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on
Progent's Duo MFA managed services utilize Cisco's Duo technology to protect against stolen passwords through the use of two-factor authentication. Duo supports single-tap identity confirmation on iOS, Android, and other out-of-band devices. With 2FA, whenever you log into a protected application and give your password you are requested to verify who you are on a device that only you possess and that uses a separate network channel. A broad selection of out-of-band devices can be used for this second form of ID validation including a smartphone or wearable, a hardware/software token, a landline phone, etc. You can designate multiple validation devices. To find out more about ProSight Duo identity authentication services, refer to Cisco Duo MFA two-factor authentication (2FA) services.
- Outsourced/Co-managed Service Center: Support Desk Managed Services
Progent's Call Desk managed services allow your IT team to offload Help Desk services to Progent or divide activity for Help Desk services seamlessly between your in-house support group and Progent's nationwide pool of IT support engineers and subject matter experts (SMEs). Progent's Shared Service Desk offers a seamless supplement to your in-house IT support staff. Client interaction with the Help Desk, delivery of support services, issue escalation, trouble ticket generation and tracking, performance metrics, and maintenance of the service database are cohesive regardless of whether issues are taken care of by your internal IT support organization, by Progent's team, or both. Learn more about Progent's outsourced/shared Service Center services.
- Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes next generation behavior-based analysis technology to defend endpoints as well as physical and virtual servers against new malware attacks such as ransomware and email phishing, which routinely evade traditional signature-based anti-virus tools. Progent ASM services safeguard on-premises and cloud-based resources and provides a unified platform to manage the complete threat progression including protection, infiltration detection, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered attacks. Find out more about Progent's ransomware defense and recovery services.
- ProSight IT Asset Management: Network Documentation Management
ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, find and safeguard data related to your IT infrastructure, procedures, business apps, and services. You can quickly find passwords or serial numbers and be warned automatically about upcoming expirations of SSL certificates or domains. By cleaning up and organizing your IT documentation, you can eliminate as much as half of time wasted trying to find vital information about your network. ProSight IT Asset Management features a common location for storing and sharing all documents related to managing your network infrastructure such as standard operating procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and relating IT data. Whether you're making improvements, doing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the data you require as soon as you need it. Learn more about ProSight IT Asset Management service.
- Patch Management: Software/Firmware Update Management Services
Progent's support services for patch management offer organizations of any size a flexible and cost-effective alternative for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving IT system. In addition to maximizing the security and reliability of your computer network, Progent's patch management services permit your in-house IT team to focus on more strategic initiatives and activities that derive the highest business value from your network. Find out more about Progent's software/firmware update management support services.
- ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a secure Tier III data center on a high-performance virtual host configured and managed by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the client owns the data, the OS software, and the applications. Since the environment is virtualized, it can be ported immediately to a different hardware solution without requiring a lengthy and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more about ProSight Virtual Hosting services.
- ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior-based machine learning tools to guard physical and virtual endpoint devices against new malware assaults such as ransomware and email phishing, which routinely escape traditional signature-matching anti-virus products. ProSight Active Security Monitoring protects local and cloud-based resources and provides a single platform to manage the complete malware attack progression including filtering, identification, mitigation, remediation, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.
- ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
ProSight Enhanced Security Protection services deliver ultra-affordable multi-layer security for physical servers and virtual machines, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced heuristics for round-the-clock monitoring and reacting to cyber assaults from all vectors. ProSight ESP delivers firewall protection, intrusion alarms, device management, and web filtering via cutting-edge technologies packaged within one agent managed from a single control. Progent's data protection and virtualization experts can help your business to plan and configure a ProSight ESP deployment that addresses your company's specific requirements and that helps you achieve and demonstrate compliance with legal and industry information protection regulations. Progent will assist you specify and configure policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that call for urgent action. Progent's consultants can also help you to set up and test a backup and restore system such as ProSight Data Protection Services so you can recover rapidly from a potentially disastrous security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.
For Anchorage 24/7/365 CryptoLocker Removal Consulting, contact Progent at 800-462-8800 or go to Contact Progent.