Barueri-Alphaville 24x7 Emergency Crypto-Ransomware
Computer Malware Identification and Removal Support

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that represents an enterprise-level danger for organizations vulnerable to an attack. Multiple generations of ransomware like the CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for many years and still inflict destruction. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, along with daily unnamed malware, not only do encryption of on-line data files but also infiltrate many accessible system protection mechanisms. Data synched to off-site disaster recovery sites can also be encrypted. In a vulnerable environment, it can make any restore operations impossible and basically sets the network back to square one.

Getting back on-line services and information following a ransomware intrusion becomes a race against the clock as the targeted business struggles to stop lateral movement and eradicate the virus and to restore enterprise-critical operations. Due to the fact that ransomware needs time to spread, attacks are frequently launched during weekends and nights, when attacks tend to take more time to detect. This compounds the difficulty of quickly marshalling and organizing an experienced mitigation team.

Progent offers a variety of services for protecting businesses from crypto-ransomware events. These include staff education to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of modern security appliances with artificial intelligence capabilities from SentinelOne to discover and extinguish zero-day cyber threats quickly. Progent in addition can provide the assistance of experienced ransomware recovery professionals with the skills and perseverance to re-deploy a breached system as rapidly as possible.

Progent's Ransomware Restoration Support Services
Following a crypto-ransomware attack, sending the ransom demands in Bitcoin cryptocurrency does not ensure that criminal gangs will respond with the needed codes to decrypt all your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is greatly above the usual ransomware demands, which ZDNET averages to be in the range of $13,000. The alternative is to re-install the key components of your IT environment. Absent access to complete system backups, this calls for a wide range of skill sets, top notch team management, and the ability to work non-stop until the task is completed.

For decades, Progent has offered professional Information Technology services for businesses in Barueri-Alphaville and across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned top certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-recognized certifications including CISA, CISSP, CRISC, and SANS GIAC. (See Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of expertise gives Progent the ability to quickly understand critical systems and organize the remaining components of your Information Technology environment after a ransomware penetration and configure them into an operational system.

Progent's ransomware group uses powerful project management tools to coordinate the complicated recovery process. Progent knows the importance of working swiftly and together with a client's management and Information Technology staff to prioritize tasks and to put critical services back online as soon as humanly possible.

Business Case Study: A Successful Ransomware Intrusion Restoration
A small business contacted Progent after their organization was brought down by the Ryuk ransomware. Ryuk is generally considered to have been developed by Northern Korean state criminal gangs, possibly using approaches leaked from America's National Security Agency. Ryuk goes after specific businesses with little or no room for operational disruption and is one of the most profitable instances of ransomware. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company based in Chicago with about 500 workers. The Ryuk penetration had shut down all business operations and manufacturing processes. Most of the client's backups had been on-line at the start of the attack and were damaged. The client considered paying the ransom (exceeding $200K) and hoping for the best, but in the end utilized Progent.

Progent worked hand in hand the customer to quickly assess and prioritize the critical systems that needed to be recovered in order to restart company functions:

• Microsoft Active Directory
• Electronic Messaging
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then charged ahead with setup and hard drive recovery of key servers. All Exchange data and attributes were intact, which accelerated the restore of Exchange. Progent was also able to locate intact OST data files (Outlook Offline Folder Files) on staff desktop computers to recover mail information. A not too old offline backup of the customer's manufacturing software made it possible to recover these essential services back online. Although a lot of work needed to be completed to recover fully from the Ryuk event, core systems were recovered quickly:

Over the following month critical milestones in the recovery project were accomplished through close collaboration between Progent consultants and the customer:

• Self-hosted web sites were restored without losing any data.
• The MailStore Server exceeding four million archived messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory functions were 100% restored.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Most of the desktop computers were functioning as before the incident.

Conclusion
A likely company-ending catastrophe was evaded through the efforts of top-tier experts, a broad array of IT skills, and tight teamwork. Although in hindsight the ransomware virus penetration described here should have been stopped with modern security systems and ISO/IEC 27001 best practices, user training, and well thought out incident response procedures for data backup and applying software patches, the fact is that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware virus, feel confident that Progent's team of professionals has proven experience in ransomware virus defense, cleanup, and data restoration.

To review or download a PDF version of this customer story, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Barueri-Alphaville a range of online monitoring and security evaluation services to help you to reduce your vulnerability to ransomware. These services utilize modern machine learning technology to detect zero-day variants of ransomware that can evade traditional signature-based anti-virus products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's next generation behavior-based machine learning technology to defend physical and virtual endpoint devices against modern malware attacks such as ransomware and file-less exploits, which routinely escape legacy signature-based AV tools. ProSight Active Security Monitoring protects local and cloud-based resources and provides a single platform to manage the complete threat progression including filtering, infiltration detection, containment, remediation, and forensics. Top capabilities include single-click rollback with Windows VSS and automatic system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer affordable in-depth security for physical and virtual servers, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and reacting to security threats from all attack vectors. ProSight ESP provides firewall protection, penetration alerts, endpoint control, and web filtering via cutting-edge technologies packaged within a single agent managed from a single console. Progent's data protection and virtualization consultants can assist you to plan and implement a ProSight ESP environment that addresses your organization's unique requirements and that helps you demonstrate compliance with legal and industry data protection regulations. Progent will assist you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that require urgent attention. Progent's consultants can also help your company to set up and verify a backup and restore system like ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software companies to create ProSight Data Protection Services (DPS), a portfolio of management outsourcing plans that provide backup-as-a-service. ProSight DPS services manage and monitor your data backup operations and allow transparent backup and rapid recovery of critical files/folders, applications, images, plus Hyper-V and VMware virtual machines. ProSight DPS helps you protect against data loss caused by equipment failures, natural disasters, fire, cyber attacks like ransomware, human mistakes, malicious insiders, or software glitches. Managed backup services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can assist you to determine which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of leading information security vendors to provide centralized management and world-class security for your inbound and outbound email. The powerful architecture of Progent's Email Guard combines cloud-based filtering with an on-premises security gateway device to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-borne threats. The cloud filter acts as a preliminary barricade and blocks the vast majority of unwanted email from making it to your security perimeter. This reduces your vulnerability to external threats and saves system bandwidth and storage space. Email Guard's onsite gateway appliance provides a deeper level of inspection for inbound email. For outbound email, the onsite gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The onsite security gateway can also assist Exchange Server to track and safeguard internal email traffic that stays within your corporate firewall. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for smaller organizations to diagram, track, optimize and troubleshoot their networking hardware like switches, firewalls, and load balancers plus servers, client computers and other devices. Using state-of-the-art RMM technology, ProSight WAN Watch ensures that infrastructure topology diagrams are kept current, captures and manages the configuration of almost all devices connected to your network, tracks performance, and sends notices when problems are detected. By automating time-consuming network management activities, WAN Watch can cut hours off common tasks such as making network diagrams, expanding your network, finding appliances that need critical software patches, or identifying the cause of performance problems. Find out more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates state-of-the-art remote monitoring and management techniques to keep your network running at peak levels by checking the health of vital computers that drive your business network. When ProSight LAN Watch detects an issue, an alarm is sent automatically to your designated IT personnel and your Progent engineering consultant so that all potential issues can be addressed before they can impact your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a secure fault tolerant data center on a high-performance virtual host set up and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the client owns the data, the OS software, and the apps. Since the system is virtualized, it can be moved easily to an alternate hardware environment without a lengthy and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, retrieve and safeguard information related to your network infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be alerted automatically about impending expirations of SSLs ,domains or warranties. By updating and organizing your IT documentation, you can save up to half of time thrown away searching for vital information about your IT network. ProSight IT Asset Management includes a centralized location for storing and sharing all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT data. Whether you're making improvements, performing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the data you require the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates cutting edge behavior machine learning tools to defend endpoints as well as servers and VMs against modern malware assaults like ransomware and file-less exploits, which routinely evade traditional signature-matching AV products. Progent ASM services protect on-premises and cloud resources and offers a single platform to address the complete malware attack lifecycle including filtering, detection, containment, cleanup, and post-attack forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• Progent's Outsourced/Shared Call Center: Support Desk Managed Services
  Progent's Help Desk managed services allow your information technology team to outsource Support Desk services to Progent or split responsibilities for Help Desk services seamlessly between your in-house support team and Progent's nationwide pool of IT support engineers and subject matter experts. Progent's Shared Service Desk provides a transparent supplement to your core IT support team. User access to the Help Desk, delivery of support services, escalation, ticket creation and tracking, performance measurement, and management of the support database are cohesive regardless of whether issues are taken care of by your internal network support resources, by Progent, or both. Learn more about Progent's outsourced/shared Service Center services.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of all sizes a flexible and affordable alternative for evaluating, testing, scheduling, applying, and tracking software and firmware updates to your dynamic information system. Besides optimizing the protection and functionality of your IT environment, Progent's software/firmware update management services allow your in-house IT staff to focus on line-of-business initiatives and tasks that deliver maximum business value from your information network. Read more about Progent's patch management services.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA managed services incorporate Cisco's Duo cloud technology to protect against password theft by using two-factor authentication (2FA). Duo supports one-tap identity confirmation with iOS, Android, and other personal devices. Using Duo 2FA, whenever you log into a protected online account and give your password you are requested to verify your identity via a unit that only you have and that uses a different network channel. A broad selection of devices can be used for this second form of authentication such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You can register several validation devices. To learn more about ProSight Duo two-factor identity validation services, go to Cisco Duo MFA two-factor authentication services.