Anchorage 24x7x365 Emergency Ransomware Infection Damage Assessment and Remediation Support

Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become a too-frequent cyberplague that poses an extinction-level threat for businesses of all sizes poorly prepared for an assault. Different iterations of ransomware such as CryptoLocker, Fusob, Locky, SamSam and MongoLock cryptoworms have been out in the wild for years and still cause damage. More recent versions of ransomware like Ryuk and Hermes, along with additional unnamed newcomers, not only do encryption of on-line critical data but also infect many configured system backup. Information synched to cloud environments can also be ransomed. In a vulnerable system, it can make automatic restoration useless and effectively sets the datacenter back to square one.

Recovering programs and data after a ransomware outage becomes a sprint against time as the victim fights to stop the spread and clear the crypto-ransomware and to restore enterprise-critical activity. Due to the fact that ransomware requires time to move laterally, assaults are usually launched at night, when attacks may take longer to discover. This multiplies the difficulty of quickly assembling and coordinating a knowledgeable mitigation team.

Progent makes available a range of solutions for protecting businesses from ransomware attacks. These include staff training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of the latest generation security appliances with machine learning technology to intelligently detect and extinguish day-zero cyber threats. Progent in addition provides the services of expert crypto-ransomware recovery professionals with the track record and perseverance to rebuild a breached system as quickly as possible.

Progent's Crypto-Ransomware Restoration Help
Following a ransomware penetration, sending the ransom in cryptocurrency does not ensure that merciless criminals will provide the needed keys to decrypt any of your files. Kaspersky determined that 17% of crypto-ransomware victims never recovered their data even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms frequently range from fifteen to forty BTC ($120,000 and $400,000). This is well higher than the usual ransomware demands, which ZDNET averages to be in the range of $13,000. The fallback is to piece back together the vital parts of your IT environment. Absent the availability of complete data backups, this requires a wide range of IT skills, well-coordinated project management, and the capability to work continuously until the task is completed.

For twenty years, Progent has provided professional Information Technology services for companies in Anchorage and across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained high-level industry certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have garnered internationally-recognized industry certifications including CISM, CISSP, CRISC, and GIAC. (Refer to Progent's certifications). Progent in addition has expertise in financial systems and ERP software solutions. This breadth of expertise provides Progent the capability to knowledgably determine important systems and re-organize the surviving components of your Information Technology system after a ransomware penetration and configure them into an operational network.

Progent's ransomware group deploys state-of-the-art project management tools to orchestrate the complicated recovery process. Progent understands the importance of acting quickly and in concert with a client's management and Information Technology staff to assign priority to tasks and to put essential services back online as soon as humanly possible.

Business Case Study: A Successful Ransomware Attack Recovery
A client contacted Progent after their organization was penetrated by the Ryuk ransomware virus. Ryuk is thought to have been launched by Northern Korean government sponsored criminal gangs, possibly using technology leaked from the U.S. National Security Agency. Ryuk attacks specific organizations with little or no room for operational disruption and is one of the most lucrative versions of ransomware viruses. Major organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in the Chicago metro area with around 500 staff members. The Ryuk attack had shut down all company operations and manufacturing processes. Most of the client's backups had been on-line at the beginning of the intrusion and were destroyed. The client was evaluating paying the ransom (exceeding two hundred thousand dollars) and hoping for good luck, but in the end brought in Progent.

Progent worked hand in hand the customer to rapidly understand and prioritize the most important services that had to be addressed to make it possible to resume departmental functions:

• Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then charged ahead with reinstallations and storage recovery of essential systems. All Microsoft Exchange Server schema and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to find intact OST files (Outlook Email Offline Folder Files) on staff PCs in order to recover email data. A not too old off-line backup of the customer’s accounting systems made it possible to restore these essential programs back available to users. Although a lot of work needed to be completed to recover completely from the Ryuk event, critical services were recovered rapidly:

Over the next couple of weeks key milestones in the restoration process were made through tight collaboration between Progent team members and the customer:

• In-house web applications were returned to operation without losing any information.
• The MailStore Server exceeding four million archived emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables/Inventory functions were 100 percent operational.
• A new Palo Alto 850 firewall was installed.
• Nearly all of the user PCs were operational.

Conclusion
A probable business-killing disaster was dodged with top-tier experts, a broad array of subject matter expertise, and close collaboration. Although upon completion of forensics the ransomware incident described here would have been identified and prevented with up-to-date cyber security technology solutions and best practices, staff education, and properly executed security procedures for information protection and keeping systems up to date with security patches, the fact remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware attack, feel confident that Progent's roster of experts has extensive experience in ransomware virus defense, mitigation, and file recovery.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Anchorage a variety of online monitoring and security evaluation services to assist you to reduce the threat from crypto-ransomware. These services utilize modern artificial intelligence capability to uncover new variants of crypto-ransomware that are able to escape detection by legacy signature-based security products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes next generation behavior machine learning tools to defend physical and virtual endpoint devices against modern malware assaults such as ransomware and file-less exploits, which easily evade legacy signature-matching AV tools. ProSight Active Security Monitoring protects local and cloud-based resources and offers a unified platform to manage the complete threat lifecycle including filtering, detection, mitigation, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new attacks. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable multi-layer security for physical servers and VMs, workstations, smartphones, and Microsoft Exchange. ProSight ESP utilizes adaptive security and modern behavior analysis for continuously monitoring and reacting to security threats from all vectors. ProSight ESP delivers firewall protection, penetration alerts, endpoint management, and web filtering through cutting-edge technologies incorporated within one agent managed from a unified control. Progent's data protection and virtualization consultants can help your business to design and implement a ProSight ESP environment that meets your organization's unique needs and that allows you demonstrate compliance with government and industry information protection regulations. Progent will assist you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for immediate attention. Progent's consultants can also help your company to set up and verify a backup and restore solution like ProSight Data Protection Services so you can recover rapidly from a potentially disastrous security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.

• ProSight Data Protection Services: Managed Backup and Recovery
  ProSight Data Protection Services from Progent provide small and medium-sized businesses an affordable and fully managed solution for reliable backup/disaster recovery. Available at a low monthly cost, ProSight DPS automates your backup processes and enables fast recovery of vital data, applications and virtual machines that have become lost or damaged as a result of component breakdowns, software glitches, disasters, human mistakes, or malicious attacks like ransomware. ProSight DPS can help you back up, retrieve and restore files, folders, applications, system images, as well as Microsoft Hyper-V and VMware virtual machine images. Critical data can be backed up on the cloud, to a local device, or to both. Progent's BDR consultants can provide advanced support to configure ProSight Data Protection Services to to comply with government and industry regulatory standards like HIPAA, FINRA, PCI and Safe Harbor and, whenever needed, can assist you to recover your critical information. Find out more about ProSight Data Protection Services Managed Cloud Backup and Recovery.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of leading data security companies to deliver centralized management and comprehensive protection for all your email traffic. The powerful structure of Progent's Email Guard managed service combines cloud-based filtering with a local security gateway appliance to offer advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. Email Guard's cloud filter acts as a preliminary barricade and keeps most threats from making it to your security perimeter. This reduces your exposure to inbound threats and conserves system bandwidth and storage. Email Guard's onsite security gateway device adds a further level of inspection for incoming email. For outgoing email, the local security gateway offers anti-virus and anti-spam protection, DLP, and email encryption. The local security gateway can also assist Microsoft Exchange Server to track and protect internal email traffic that originates and ends inside your security perimeter. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for smaller businesses to map, track, reconfigure and troubleshoot their connectivity appliances like routers and switches, firewalls, and load balancers as well as servers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network diagrams are always updated, captures and displays the configuration information of almost all devices on your network, tracks performance, and generates notices when issues are discovered. By automating complex management processes, ProSight WAN Watch can knock hours off ordinary tasks such as network mapping, expanding your network, locating devices that need important updates, or isolating performance bottlenecks. Learn more details about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent’s server and desktop monitoring service that uses state-of-the-art remote monitoring and management technology to help keep your network operating efficiently by tracking the health of critical computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your specified IT personnel and your Progent engineering consultant so all looming problems can be addressed before they can impact your network. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a protected Tier III data center on a fast virtual host set up and managed by Progent's network support experts. Under Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be ported immediately to an alternate hardware solution without requiring a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, find and safeguard data related to your IT infrastructure, processes, business apps, and services. You can instantly locate passwords or IP addresses and be warned about upcoming expirations of SSLs or domains. By cleaning up and managing your network documentation, you can eliminate as much as half of time spent searching for vital information about your IT network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents related to managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT data. Whether you’re making enhancements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need the instant you need it. Find out more about Progent's ProSight IT Asset Management service.