Ransomware : Your Feared Information Technology Disaster
Ransomware  Recovery ExpertsRansomware has become a too-frequent cyberplague that represents an existential danger for businesses of all sizes vulnerable to an attack. Different iterations of crypto-ransomware such as Dharma, WannaCry, Locky, SamSam and MongoLock cryptoworms have been around for many years and still cause damage. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, along with additional as yet unnamed viruses, not only do encryption of online data files but also infiltrate most accessible system backups. Data replicated to the cloud can also be encrypted. In a poorly designed environment, it can render automatic restoration useless and basically sets the entire system back to square one.

Recovering programs and data after a ransomware intrusion becomes a race against time as the victim tries its best to stop the spread and clear the crypto-ransomware and to resume business-critical activity. Due to the fact that crypto-ransomware needs time to spread, assaults are frequently sprung during weekends and nights, when successful penetrations are likely to take more time to discover. This multiplies the difficulty of quickly mobilizing and coordinating a knowledgeable response team.

Progent offers a variety of solutions for securing organizations from ransomware events. Among these are staff training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of the latest generation security appliances with artificial intelligence capabilities to quickly identify and extinguish zero-day threats. Progent in addition provides the services of experienced ransomware recovery consultants with the talent and commitment to restore a compromised network as quickly as possible.

Progent's Ransomware Restoration Services
Subsequent to a ransomware attack, paying the ransom in Bitcoin cryptocurrency does not guarantee that cyber criminals will respond with the codes to decrypt any of your information. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is well above the typical ransomware demands, which ZDNET estimates to be approximately $13,000. The other path is to setup from scratch the vital elements of your Information Technology environment. Absent access to complete system backups, this requires a wide range of skills, professional team management, and the capability to work continuously until the task is complete.

For two decades, Progent has made available professional IT services for companies in Atlanta and throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned advanced industry certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent also has expertise in financial systems and ERP application software. This breadth of expertise provides Progent the skills to quickly identify necessary systems and organize the remaining components of your computer network system following a ransomware attack and assemble them into an operational network.

Progent's recovery group utilizes best of breed project management systems to orchestrate the complex restoration process. Progent knows the importance of acting swiftly and in concert with a client's management and IT team members to assign priority to tasks and to get critical services back on-line as fast as possible.

Business Case Study: A Successful Ransomware Virus Response
A small business hired Progent after their network system was brought down by Ryuk ransomware virus. Ryuk is believed to have been deployed by Northern Korean state hackers, possibly using strategies exposed from the United States National Security Agency. Ryuk targets specific businesses with limited tolerance for operational disruption and is among the most profitable versions of ransomware. Major targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in Chicago and has about 500 workers. The Ryuk event had paralyzed all business operations and manufacturing capabilities. Most of the client's data protection had been online at the time of the intrusion and were damaged. The client was evaluating paying the ransom (more than $200,000) and praying for good luck, but in the end utilized Progent.


"I cannot speak enough in regards to the expertise Progent gave us throughout the most stressful period of (our) companyís survival. We had little choice but to pay the Hackers if it wasnít for the confidence the Progent experts afforded us. That you could get our e-mail and important applications back online sooner than seven days was incredible. Every single expert I worked with or messaged at Progent was hell bent on getting my company operational and was working 24/7 on our behalf."

Progent worked with the customer to rapidly get our arms around and assign priority to the essential areas that had to be addressed to make it possible to continue business operations:

  • Windows Active Directory
  • E-Mail
  • MRP System
To begin, Progent followed ransomware incident response best practices by halting the spread and clearing infected systems. Progent then initiated the steps of rebuilding Windows Active Directory, the key technology of enterprise systems built on Microsoft Windows technology. Microsoft Exchange Server email will not function without AD, and the businessesí MRP system utilized SQL Server, which depends on Active Directory for security authorization to the database.

Within 2 days, Progent was able to recover Active Directory to its pre-intrusion state. Progent then performed rebuilding and storage recovery of mission critical systems. All Microsoft Exchange Server data and attributes were usable, which greatly helped the restore of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Email Offline Data Files) on various workstations and laptops to recover email messages. A recent offline backup of the client's financials/MRP software made it possible to return these required applications back online. Although a large amount of work was left to recover completely from the Ryuk event, the most important systems were recovered quickly:


"For the most part, the production manufacturing operation showed little impact and we did not miss any customer sales."

During the following few weeks important milestones in the recovery process were made in close collaboration between Progent consultants and the customer:

  • Self-hosted web applications were restored with no loss of data.
  • The MailStore Server exceeding four million historical messages was brought on-line and accessible to users.
  • CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory functions were completely recovered.
  • A new Palo Alto Networks 850 firewall was brought online.
  • Most of the desktop computers were being used by staff.

"So much of what happened in the initial days is nearly entirely a haze for me, but I will not forget the care all of your team put in to help get our company back. Iíve entrusted Progent for the past 10 years, possibly more, and every time Progent has shined and delivered as promised. This situation was no exception but maybe more Herculean."

Conclusion
A potential business-killing catastrophe was avoided through the efforts of results-oriented experts, a wide spectrum of subject matter expertise, and tight teamwork. Although in post mortem the ransomware virus penetration described here should have been identified and stopped with up-to-date security systems and best practices, team education, and properly executed incident response procedures for data protection and proper patching controls, the reality remains that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware incursion, feel confident that Progent's team of experts has a proven track record in crypto-ransomware virus defense, cleanup, and information systems recovery.


"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen and Tony (and any others that were involved), Iím grateful for allowing me to get rested after we made it through the most critical parts. All of you did an impressive job, and if anyone is around the Chicago area, a great meal is the least I can do!"

To read or download a PDF version of this customer story, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide companies in Atlanta a portfolio of online monitoring and security evaluation services designed to help you to reduce the threat from ransomware. These services include next-generation artificial intelligence technology to uncover new strains of crypto-ransomware that are able to evade legacy signature-based security products.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes cutting edge behavior-based analysis technology to defend physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which easily evade legacy signature-matching AV tools. ProSight ASM protects on-premises and cloud-based resources and provides a single platform to manage the entire malware attack progression including filtering, detection, mitigation, cleanup, and post-attack forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered attacks. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

  • ProSight Enhanced Security Protection (ESP): Endpoint Security and Microsoft Exchange Filtering
    ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable multi-layer security for physical servers and VMs, workstations, smartphones, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and reacting to security assaults from all vectors. ProSight ESP provides firewall protection, penetration alerts, endpoint control, and web filtering through cutting-edge tools incorporated within a single agent accessible from a unified console. Progent's security and virtualization experts can assist you to plan and implement a ProSight ESP environment that meets your company's specific needs and that allows you prove compliance with legal and industry information protection standards. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that call for immediate action. Progent's consultants can also assist you to set up and test a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover rapidly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange email filtering.

  • ProSight Data Protection Services: Managed Backup and Disaster Recovery
    ProSight Data Protection Services offer small and mid-sized businesses a low cost end-to-end solution for reliable backup/disaster recovery (BDR). For a low monthly price, ProSight Data Protection Services automates your backup processes and allows rapid recovery of vital files, applications and virtual machines that have become unavailable or corrupted as a result of component failures, software bugs, disasters, human error, or malware attacks such as ransomware. ProSight DPS can help you protect, retrieve and restore files, folders, applications, system images, as well as Microsoft Hyper-V and VMware virtual machine images. Important data can be protected on the cloud, to a local device, or mirrored to both. Progent's cloud backup specialists can deliver world-class expertise to configure ProSight DPS to be compliant with government and industry regulatory standards like HIPAA, FINRA, PCI and Safe Harbor and, whenever needed, can help you to restore your business-critical data. Find out more about ProSight Data Protection Services Managed Backup and Recovery.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of top data security companies to deliver web-based management and comprehensive protection for all your inbound and outbound email. The hybrid architecture of Email Guard managed service integrates cloud-based filtering with a local gateway appliance to offer advanced defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-based threats. Email Guard's Cloud Protection Layer acts as a preliminary barricade and keeps the vast majority of unwanted email from making it to your network firewall. This reduces your vulnerability to inbound attacks and saves network bandwidth and storage space. Email Guard's on-premises gateway appliance provides a further level of analysis for inbound email. For outbound email, the local gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also assist Exchange Server to monitor and safeguard internal email that stays inside your corporate firewall. For more information, visit ProSight Email Guard spam filtering and data leakage protection.

  • ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
    ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for smaller businesses to map out, track, reconfigure and debug their networking appliances such as routers and switches, firewalls, and load balancers as well as servers, printers, endpoints and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that network diagrams are always current, captures and displays the configuration information of virtually all devices on your network, monitors performance, and generates alerts when issues are discovered. By automating tedious network management activities, ProSight WAN Watch can cut hours off ordinary chores like making network diagrams, expanding your network, locating appliances that need important software patches, or identifying the cause of performance problems. Find out more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

  • ProSight LAN Watch: Server and Desktop Monitoring and Management
    ProSight LAN Watch is Progentís server and desktop remote monitoring service that uses advanced remote monitoring and management (RMM) techniques to keep your IT system running efficiently by checking the health of vital computers that power your information system. When ProSight LAN Watch detects a problem, an alarm is transmitted immediately to your specified IT management staff and your assigned Progent engineering consultant so that any potential issues can be resolved before they can impact your network. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
    With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a secure fault tolerant data center on a high-performance virtual host configured and maintained by Progent's network support professionals. Under the ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system software, and the apps. Since the environment is virtualized, it can be ported easily to an alternate hardware environment without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into one hosting provider. Find out more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, retrieve and protect data related to your network infrastructure, procedures, business apps, and services. You can instantly find passwords or serial numbers and be alerted about impending expirations of SSL certificates or domains. By cleaning up and managing your network documentation, you can save up to half of time wasted looking for critical information about your IT network. ProSight IT Asset Management includes a common location for storing and sharing all documents required for managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT information. Whether youíre planning improvements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you need as soon as you need it. Learn more about ProSight IT Asset Management service.
For 24/7 Atlanta Crypto Recovery Services, reach out to Progent at 800-993-9400 or go to Contact Progent.