Atlanta 24/7/365 Immediate Crypto-Ransomware
Infection Damage Assessment and Remediation Consulting

Crypto-Ransomware : Your Crippling IT Disaster
Ransomware has become an escalating cyberplague that poses an enterprise-level threat for businesses poorly prepared for an attack. Versions of ransomware like the Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been circulating for many years and continue to cause destruction. Recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, as well as more as yet unnamed viruses, not only encrypt online files but also infiltrate most configured system backup. Files replicated to off-site disaster recovery sites can also be ransomed. In a poorly architected system, it can make automated restoration hopeless and effectively sets the entire system back to square one.

Recovering applications and information after a ransomware attack becomes a sprint against the clock as the victim struggles to stop the spread and clear the virus and to resume enterprise-critical operations. Because ransomware needs time to move laterally, penetrations are often sprung during nights and weekends, when successful attacks are likely to take more time to identify. This compounds the difficulty of promptly assembling and coordinating a knowledgeable mitigation team.

Progent has an assortment of support services for securing organizations from ransomware attacks. Among these are user training to help identify and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of modern security gateways with artificial intelligence capabilities from SentinelOne to discover and extinguish zero-day cyber threats intelligently. Progent in addition provides the services of veteran crypto-ransomware recovery engineers with the skills and commitment to re-deploy a compromised network as urgently as possible.

Progent's Ransomware Restoration Help
After a ransomware event, paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will return the codes to decipher any or all of your files. Kaspersky Labs estimated that seventeen percent of ransomware victims never recovered their data after having paid the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is greatly higher than the average crypto-ransomware demands, which ZDNET estimates to be around $13,000. The fallback is to piece back together the vital elements of your Information Technology environment. Absent access to complete system backups, this calls for a wide complement of IT skills, professional team management, and the capability to work continuously until the job is done.

For two decades, Progent has made available professional Information Technology services for companies in Atlanta and across the US and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have been awarded high-level certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, and SANS GIAC. (See Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience provides Progent the ability to quickly identify necessary systems and re-organize the surviving components of your computer network environment after a ransomware event and assemble them into a functioning system.

Progent's security team deploys top notch project management applications to orchestrate the complex restoration process. Progent appreciates the importance of acting quickly and together with a client's management and IT staff to prioritize tasks and to put essential applications back on line as fast as humanly possible.

Client Case Study: A Successful Ransomware Virus Restoration
A business engaged Progent after their company was crashed by Ryuk ransomware virus. Ryuk is thought to have been created by North Korean government sponsored criminal gangs, possibly using technology exposed from the United States NSA organization. Ryuk targets specific businesses with little room for disruption and is one of the most lucrative examples of ransomware viruses. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in the Chicago metro area and has around 500 employees. The Ryuk event had shut down all business operations and manufacturing capabilities. Most of the client's backups had been on-line at the beginning of the intrusion and were damaged. The client considered paying the ransom (more than two hundred thousand dollars) and wishfully thinking for good luck, but in the end engaged Progent.

Progent worked with the customer to quickly identify and prioritize the most important applications that had to be restored in order to restart departmental operations:

• Active Directory
• Exchange Server
• Accounting/MRP

In less than 2 days, Progent was able to re-build Active Directory services to its pre-attack state. Progent then assisted with rebuilding and storage recovery on key servers. All Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to locate non-encrypted OST data files (Outlook Offline Folder Files) on user desktop computers and laptops in order to recover email information. A not too old offline backup of the client's accounting systems made it possible to restore these vital services back online for users. Although major work still had to be done to recover fully from the Ryuk damage, critical systems were returned to operations quickly:

Over the following couple of weeks critical milestones in the restoration project were made through tight collaboration between Progent engineers and the customer:

• Self-hosted web sites were brought back up with no loss of information.
• The MailStore Exchange Server exceeding 4 million archived messages was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/AR/Inventory modules were 100% recovered.
• A new Palo Alto 850 firewall was deployed.
• 90% of the user PCs were being used by staff.

Conclusion
A potential business-killing disaster was averted by hard-working experts, a wide range of subject matter expertise, and tight teamwork. Although in hindsight the ransomware virus penetration described here would have been identified and stopped with current security technology solutions and recognized best practices, user training, and appropriate security procedures for data backup and proper patching controls, the reality remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware virus, remember that Progent's team of professionals has extensive experience in ransomware virus blocking, removal, and file restoration.

To review or download a PDF version of this customer story, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Atlanta a range of online monitoring and security evaluation services to help you to reduce the threat from ransomware. These services utilize modern AI technology to detect new variants of ransomware that can escape detection by traditional signature-based security products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior machine learning technology to guard physical and virtual endpoints against modern malware attacks such as ransomware and file-less exploits, which routinely escape legacy signature-matching AV products. ProSight ASM protects local and cloud resources and offers a unified platform to address the entire malware attack progression including protection, detection, containment, remediation, and post-attack forensics. Top capabilities include one-click rollback with Windows VSS and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer economical in-depth protection for physical and virtual servers, workstations, smartphones, and Exchange email. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and responding to security threats from all attack vectors. ProSight ESP delivers firewall protection, penetration alerts, endpoint management, and web filtering via leading-edge tools incorporated within a single agent accessible from a single control. Progent's data protection and virtualization experts can assist you to plan and configure a ProSight ESP environment that meets your company's unique needs and that helps you achieve and demonstrate compliance with government and industry data protection regulations. Progent will help you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that call for immediate attention. Progent's consultants can also assist you to set up and test a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business quickly from a destructive cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has partnered with advanced backup/restore technology providers to produce ProSight Data Protection Services, a portfolio of management outsourcing plans that provide backup-as-a-service. ProSight DPS services automate and monitor your backup operations and enable transparent backup and fast recovery of important files, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you recover from data loss caused by hardware failures, natural calamities, fire, cyber attacks like ransomware, user mistakes, ill-intentioned insiders, or application bugs. Managed backup services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can assist you to identify which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of top data security vendors to deliver centralized control and world-class security for your email traffic. The hybrid architecture of Email Guard integrates a Cloud Protection Layer with a local security gateway appliance to offer complete defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-borne threats. The cloud filter serves as a first line of defense and blocks the vast majority of unwanted email from reaching your network firewall. This reduces your vulnerability to inbound threats and conserves network bandwidth and storage. Email Guard's onsite security gateway appliance provides a deeper level of inspection for incoming email. For outbound email, the onsite gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local security gateway can also help Exchange Server to track and safeguard internal email traffic that stays inside your corporate firewall. For more information, visit Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for smaller businesses to map, track, optimize and troubleshoot their connectivity hardware such as switches, firewalls, and load balancers plus servers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that infrastructure topology maps are kept current, captures and displays the configuration information of virtually all devices on your network, monitors performance, and generates notices when issues are discovered. By automating tedious management processes, ProSight WAN Watch can knock hours off common chores such as network mapping, reconfiguring your network, locating appliances that need critical software patches, or resolving performance bottlenecks. Learn more about ProSight WAN Watch infrastructure management services.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management technology to help keep your IT system operating at peak levels by tracking the state of vital assets that power your information system. When ProSight LAN Watch detects a problem, an alarm is transmitted immediately to your specified IT staff and your assigned Progent consultant so all looming issues can be resolved before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a secure Tier III data center on a high-performance virtual host set up and maintained by Progent's network support experts. Under the ProSight Virtual Hosting model, the client retains ownership of the data, the OS software, and the applications. Because the environment is virtualized, it can be moved immediately to an alternate hardware environment without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into one hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, retrieve and protect information about your IT infrastructure, processes, applications, and services. You can instantly find passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates ,domains or warranties. By cleaning up and managing your network documentation, you can save up to half of time wasted looking for critical information about your IT network. ProSight IT Asset Management includes a centralized location for holding and sharing all documents related to managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT information. Whether you're planning improvements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you need when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that utilizes cutting edge behavior machine learning tools to guard endpoint devices and servers and VMs against modern malware assaults such as ransomware and file-less exploits, which easily evade traditional signature-matching anti-virus tools. Progent ASM services safeguard local and cloud resources and provides a unified platform to automate the complete malware attack lifecycle including blocking, identification, mitigation, remediation, and post-attack forensics. Top capabilities include one-click rollback using Windows VSS and real-time system-wide immunization against new attacks. Learn more about Progent's ransomware protection and cleanup services.

• Progent's Outsourced/Shared Help Center: Help Desk Managed Services
  Progent's Call Desk services permit your information technology team to outsource Support Desk services to Progent or divide responsibilities for support services seamlessly between your internal support team and Progent's extensive pool of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a transparent extension of your corporate network support team. User access to the Help Desk, delivery of support, problem escalation, trouble ticket creation and tracking, efficiency metrics, and management of the support database are consistent whether issues are resolved by your internal network support resources, by Progent, or both. Find out more about Progent's outsourced/shared Help Desk services.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management offer businesses of any size a flexible and affordable solution for assessing, testing, scheduling, applying, and tracking software and firmware updates to your dynamic information network. In addition to optimizing the security and functionality of your IT network, Progent's patch management services free up time for your in-house IT staff to concentrate on more strategic initiatives and tasks that derive maximum business value from your network. Learn more about Progent's patch management services.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA managed services utilize Cisco's Duo technology to defend against password theft by using two-factor authentication (2FA). Duo supports one-tap identity verification on iOS, Android, and other personal devices. With 2FA, whenever you log into a secured application and enter your password you are requested to verify who you are via a unit that only you have and that uses a different ("out-of-band") network channel. A wide range of out-of-band devices can be utilized for this added form of authentication including an iPhone or Android or wearable, a hardware token, a landline phone, etc. You can designate multiple validation devices. For details about ProSight Duo identity validation services, see Duo MFA two-factor authentication (2FA) services for access security.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time reporting plug-ins created to work with the top ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues such as spotty support follow-through or machines with out-of-date AVs. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.