24/7 Arlington Emergency CryptoLocker
Infection Assessment and Repair Support

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that poses an existential danger for businesses of all sizes vulnerable to an attack. Multiple generations of ransomware such as Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been circulating for years and continue to inflict harm. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Egregor, plus additional unnamed malware, not only do encryption of on-line data but also infiltrate any available system backups. Files replicated to the cloud can also be corrupted. In a vulnerable system, this can render automated restoration hopeless and basically sets the datacenter back to square one.

Recovering services and information following a crypto-ransomware intrusion becomes a sprint against time as the victim tries its best to contain, remove the crypto-ransomware, and resume business-critical operations. Since ransomware requires time to spread, assaults are frequently launched on weekends and holidays, when successful penetrations typically take longer to uncover. This multiplies the difficulty of rapidly marshalling and coordinating a knowledgeable mitigation team.

Progent has a range of support services for securing enterprises from ransomware events. These include staff education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of the latest generation security solutions with machine learning technology from SentinelOne to identify and quarantine new cyber attacks rapidly. Progent also provides the services of expert ransomware recovery consultants with the skills and commitment to re-deploy a breached environment as rapidly as possible.

Progent's Ransomware Restoration Support Services
After a ransomware invasion, even paying the ransom in cryptocurrency does not guarantee that cyber criminals will provide the needed codes to decipher any or all of your information. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to re-install the key parts of your Information Technology environment. Absent the availability of complete data backups, this requires a broad range of skill sets, professional project management, and the willingness to work 24x7 until the recovery project is over.

For decades, Progent has made available certified expert IT services for businesses across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned advanced industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of expertise provides Progent the ability to knowledgably identify critical systems and consolidate the remaining components of your IT environment after a ransomware penetration and rebuild them into a functioning network.

Progent's ransomware group deploys powerful project management systems to orchestrate the sophisticated recovery process. Progent appreciates the importance of working quickly and together with a customer's management and Information Technology resources to assign priority to tasks and to put essential applications back on line as fast as humanly possible.

Client Story: A Successful Crypto-Ransomware Incident Recovery
A client escalated to Progent after their company was penetrated by the Ryuk ransomware. Ryuk is thought to have been deployed by Northern Korean state criminal gangs, possibly adopting algorithms leaked from America's NSA organization. Ryuk targets specific businesses with little tolerance for disruption and is among the most profitable examples of ransomware. Headline targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business headquartered in the Chicago metro area with about 500 workers. The Ryuk attack had paralyzed all company operations and manufacturing processes. Most of the client's information backups had been directly accessible at the start of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but in the end reached out to Progent.

Progent worked with the client to rapidly understand and prioritize the critical areas that needed to be restored to make it possible to continue business functions:

• Microsoft Active Directory
• Electronic Messaging
• Accounting and Manufacturing Software

Within two days, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then charged ahead with rebuilding and storage recovery on critical applications. All Exchange Server data and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to assemble non-encrypted OST data files (Microsoft Outlook Off-Line Folder Files) on various desktop computers in order to recover email information. A recent off-line backup of the businesses accounting/MRP software made them able to recover these required applications back available to users. Although a large amount of work still had to be done to recover fully from the Ryuk damage, the most important services were recovered rapidly:

Throughout the next couple of weeks important milestones in the recovery project were made through close collaboration between Progent engineers and the customer:

• In-house web applications were returned to operation with no loss of data.
• The MailStore Exchange Server with over 4 million archived messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory functions were 100% functional.
• A new Palo Alto 850 firewall was deployed.
• Nearly all of the user PCs were being used by staff.

Conclusion
A likely business-ending catastrophe was averted with hard-working experts, a broad spectrum of subject matter expertise, and tight collaboration. Although in analyzing the event afterwards the crypto-ransomware virus attack detailed here should have been identified and disabled with current cyber security technology solutions and recognized best practices, staff training, and appropriate incident response procedures for backup and proper patching controls, the reality is that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware virus, remember that Progent's roster of experts has proven experience in ransomware virus defense, mitigation, and file disaster recovery.

To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Arlington a range of online monitoring and security assessment services designed to assist you to reduce the threat from ransomware. These services incorporate modern artificial intelligence technology to detect new strains of ransomware that are able to evade legacy signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management (RMM) techniques to help keep your IT system running at peak levels by tracking the health of critical assets that drive your information system. When ProSight LAN Watch detects an issue, an alarm is sent automatically to your specified IT management personnel and your assigned Progent engineering consultant so any potential problems can be resolved before they have a chance to disrupt your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for monitoring and managing your network, server, and desktop devices by providing tools for performing common tedious jobs. These can include health monitoring, patch management, automated repairs, endpoint setup, backup and recovery, anti-virus response, secure remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and debugging support. When ProSight LAN Watch with NinjaOne RMM spots a serious incident, it transmits an alert to your specified IT management staff and your assigned Progent consultant so potential issues can be fixed before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for small and mid-sized organizations to map, monitor, reconfigure and debug their connectivity hardware such as routers and switches, firewalls, and load balancers as well as servers, printers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology diagrams are kept current, captures and displays the configuration information of virtually all devices connected to your network, tracks performance, and generates notices when issues are detected. By automating complex network management activities, WAN Watch can knock hours off common chores such as network mapping, reconfiguring your network, finding devices that need critical software patches, or resolving performance problems. Learn more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time and in-depth reporting utilities designed to integrate with the top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues like spotty support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore technology providers to create ProSight Data Protection Services, a family of subscription-based offerings that deliver backup-as-a-service. ProSight DPS services automate and monitor your backup operations and allow non-disruptive backup and fast restoration of critical files/folders, applications, images, and VMs. ProSight DPS lets your business recover from data loss caused by equipment failures, natural calamities, fire, cyber attacks such as ransomware, human error, malicious employees, or software bugs. Managed backup services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top data security vendors to provide centralized control and comprehensive security for all your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service combines cloud-based filtering with a local gateway appliance to provide complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne threats. The Cloud Protection Layer serves as a first line of defense and blocks most threats from reaching your network firewall. This decreases your vulnerability to inbound threats and conserves network bandwidth and storage. Email Guard's onsite security gateway appliance provides a deeper layer of inspection for inbound email. For outbound email, the onsite gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The on-premises security gateway can also help Exchange Server to track and protect internal email traffic that stays inside your security perimeter. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to protect against compromised passwords by using two-factor authentication. Duo enables single-tap identity verification with Apple iOS, Android, and other personal devices. With 2FA, whenever you sign into a protected online account and enter your password you are requested to verify who you are on a unit that only you have and that is accessed using a different ("out-of-band") network channel. A wide selection of out-of-band devices can be used as this second form of ID validation including a smartphone or watch, a hardware token, a landline telephone, etc. You can register multiple validation devices. For more information about Duo two-factor identity authentication services, go to Cisco Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Call Center: Help Desk Managed Services
  Progent's Call Desk services enable your information technology team to offload Call Center services to Progent or divide responsibilities for Help Desk services seamlessly between your in-house network support resources and Progent's nationwide pool of IT service engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a transparent extension of your core support organization. User access to the Service Desk, delivery of technical assistance, issue escalation, ticket creation and tracking, performance measurement, and maintenance of the support database are consistent whether issues are resolved by your corporate IT support staff, by Progent's team, or a mix of the two. Learn more about Progent's outsourced/shared Call Desk services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that incorporates next generation behavior-based analysis tools to guard endpoint devices and physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which easily evade legacy signature-based anti-virus tools. Progent Active Security Monitoring services protect on-premises and cloud-based resources and offers a unified platform to automate the entire threat lifecycle including blocking, detection, containment, remediation, and post-attack forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, retrieve and protect data about your network infrastructure, procedures, business apps, and services. You can quickly find passwords or serial numbers and be warned automatically about impending expirations of SSL certificates or warranties. By updating and organizing your IT documentation, you can save up to 50% of time spent looking for vital information about your IT network. ProSight IT Asset Management features a centralized repository for holding and sharing all documents related to managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and relating IT data. Whether you're planning enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the data you require the instant you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management offer organizations of all sizes a flexible and affordable solution for assessing, validating, scheduling, implementing, and documenting updates to your dynamic IT system. In addition to maximizing the protection and functionality of your IT environment, Progent's software/firmware update management services permit your in-house IT staff to focus on line-of-business initiatives and activities that derive the highest business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a protected Tier III data center on a fast virtual machine host set up and maintained by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the OS software, and the applications. Because the environment is virtualized, it can be moved easily to a different hosting solution without requiring a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior-based machine learning tools to guard physical and virtual endpoints against new malware assaults such as ransomware and file-less exploits, which easily get by legacy signature-matching AV tools. ProSight ASM protects local and cloud resources and offers a single platform to manage the entire threat lifecycle including protection, detection, containment, remediation, and post-attack forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable multi-layer protection for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP uses contextual security and modern behavior analysis for continuously monitoring and reacting to security threats from all attack vectors. ProSight ESP offers firewall protection, intrusion alerts, endpoint control, and web filtering through leading-edge tools packaged within a single agent accessible from a single control. Progent's security and virtualization experts can help you to plan and configure a ProSight ESP deployment that addresses your company's specific needs and that helps you prove compliance with legal and industry information security regulations. Progent will assist you define and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require immediate attention. Progent's consultants can also assist you to set up and verify a backup and restore system like ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.