24/7/365 Bristol Immediate CryptoLocker
Malware Identification and Removal Consultants

Ransomware : Your Worst IT Nightmare
Ransomware has become an escalating cyberplague that poses an extinction-level threat for businesses vulnerable to an assault. Versions of ransomware like the CrySIS, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for many years and still inflict damage. More recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, as well as additional unnamed malware, not only do encryption of on-line critical data but also infect many available system backup. Data synchronized to the cloud can also be held hostage. In a poorly designed system, it can render automated restore operations hopeless and effectively sets the entire system back to square one.

Getting back online services and information following a ransomware intrusion becomes a race against the clock as the victim tries its best to contain, clear the ransomware, and restore enterprise-critical activity. Since ransomware needs time to spread, assaults are frequently launched on weekends and holidays, when penetrations in many cases take more time to uncover. This multiplies the difficulty of rapidly assembling and coordinating a qualified response team.

Progent makes available a range of help services for protecting organizations from ransomware penetrations. Among these are team training to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of modern security appliances with machine learning technology from SentinelOne to discover and disable zero-day cyber attacks intelligently. Progent also provides the services of expert crypto-ransomware recovery consultants with the talent and commitment to reconstruct a breached environment as quickly as possible.

Progent's Crypto-Ransomware Restoration Help
Soon after a ransomware event, sending the ransom in cryptocurrency does not guarantee that merciless criminals will return the keys to decrypt all your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to re-install the essential components of your Information Technology environment. Without access to complete system backups, this requires a wide complement of skill sets, well-coordinated project management, and the ability to work non-stop until the task is completed.

For twenty years, Progent has made available certified expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned top certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial systems and ERP software solutions. This breadth of expertise gives Progent the skills to knowledgably understand important systems and organize the remaining parts of your Information Technology environment following a ransomware penetration and configure them into a functioning system.

Progent's security team deploys top notch project management systems to coordinate the complicated recovery process. Progent appreciates the urgency of acting quickly and in unison with a client's management and IT team members to prioritize tasks and to get critical systems back on line as fast as humanly possible.

Customer Story: A Successful Crypto-Ransomware Attack Response
A customer contacted Progent after their network system was crashed by Ryuk crypto-ransomware. Ryuk is believed to have been created by North Korean government sponsored hackers, possibly adopting approaches leaked from America's NSA organization. Ryuk targets specific companies with little ability to sustain operational disruption and is one of the most profitable versions of ransomware malware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing company located in Chicago and has around 500 workers. The Ryuk penetration had brought down all essential operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the time of the intrusion and were eventually encrypted. The client was evaluating paying the ransom (more than $200,000) and wishfully thinking for the best, but ultimately made the decision to use Progent.

Progent worked together with the customer to quickly assess and assign priority to the key elements that needed to be restored in order to continue company operations:

• Active Directory
• E-Mail
• Financials/MRP

In less than 2 days, Progent was able to rebuild Active Directory to its pre-virus state. Progent then assisted with reinstallations and hard drive recovery on essential applications. All Exchange data and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to collect intact OST data files (Microsoft Outlook Offline Data Files) on user PCs and laptops in order to recover email data. A recent offline backup of the businesses financials/ERP systems made it possible to return these essential services back on-line. Although significant work was left to recover completely from the Ryuk virus, critical systems were returned to operations rapidly:

Throughout the following couple of weeks key milestones in the recovery process were completed in close collaboration between Progent consultants and the client:

• Internal web applications were brought back up without losing any data.
• The MailStore Server exceeding four million archived emails was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory modules were completely recovered.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• Nearly all of the desktop computers were operational.

Conclusion
A probable business disaster was averted due to top-tier experts, a broad range of knowledge, and tight collaboration. Although upon completion of forensics the ransomware penetration detailed here could have been disabled with up-to-date cyber security solutions and security best practices, user training, and properly executed incident response procedures for information protection and applying software patches, the reality is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's team of experts has extensive experience in crypto-ransomware virus defense, remediation, and information systems restoration.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Bristol a range of online monitoring and security evaluation services to help you to reduce the threat from ransomware. These services include next-generation artificial intelligence capability to detect zero-day strains of ransomware that can escape detection by traditional signature-based security solutions.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) technology to keep your IT system operating at peak levels by checking the health of critical assets that drive your business network. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your designated IT staff and your Progent consultant so any looming problems can be resolved before they can disrupt your network. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for monitoring and managing your client-server infrastructure by offering an environment for streamlining common time-consuming jobs. These can include health monitoring, patch management, automated repairs, endpoint configuration, backup and recovery, A/V protection, remote access, standard and custom scripts, resource inventory, endpoint status reporting, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it transmits an alert to your designated IT management staff and your assigned Progent technical consultant so emerging problems can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for smaller organizations to map, track, enhance and troubleshoot their connectivity appliances like switches, firewalls, and access points as well as servers, printers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network diagrams are always current, copies and displays the configuration information of almost all devices on your network, tracks performance, and sends notices when problems are detected. By automating complex management activities, WAN Watch can knock hours off common tasks like network mapping, expanding your network, locating devices that need important updates, or identifying the cause of performance problems. Learn more details about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time management reporting tools designed to integrate with the industry's leading ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues like spotty support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with leading backup technology providers to create ProSight Data Protection Services, a family of management offerings that deliver backup-as-a-service (BaaS). ProSight DPS products manage and monitor your backup operations and allow transparent backup and fast restoration of critical files, applications, system images, and VMs. ProSight DPS helps your business recover from data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks like ransomware, user mistakes, ill-intentioned insiders, or application bugs. Managed backup services available in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to determine which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading data security companies to provide web-based management and comprehensive security for all your email traffic. The powerful architecture of Email Guard managed service integrates cloud-based filtering with an on-premises security gateway device to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-borne threats. The Cloud Protection Layer serves as a preliminary barricade and keeps most unwanted email from reaching your network firewall. This reduces your vulnerability to inbound threats and saves system bandwidth and storage. Email Guard's onsite gateway appliance provides a deeper level of inspection for incoming email. For outbound email, the onsite security gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local gateway can also help Microsoft Exchange Server to monitor and protect internal email traffic that stays inside your corporate firewall. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA managed services utilize Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication. Duo supports one-tap identity confirmation with Apple iOS, Google Android, and other personal devices. With Duo 2FA, when you sign into a protected application and enter your password you are requested to confirm who you are via a unit that only you have and that is accessed using a different ("out-of-band") network channel. A wide range of out-of-band devices can be utilized for this added means of authentication including a smartphone or wearable, a hardware/software token, a landline phone, etc. You may register several validation devices. To find out more about Duo identity validation services, refer to Cisco Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Call Desk: Help Desk Managed Services
  Progent's Call Desk managed services permit your information technology staff to outsource Support Desk services to Progent or divide activity for Help Desk services transparently between your internal support resources and Progent's extensive pool of IT support engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a seamless supplement to your core IT support organization. Client access to the Service Desk, provision of technical assistance, issue escalation, trouble ticket generation and tracking, performance measurement, and maintenance of the service database are cohesive regardless of whether issues are resolved by your in-house IT support organization, by Progent, or a mix of the two. Find out more about Progent's outsourced/shared Help Desk services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates next generation behavior-based analysis tools to defend endpoint devices as well as physical and virtual servers against modern malware assaults such as ransomware and file-less exploits, which routinely escape traditional signature-based AV products. Progent ASM services safeguard local and cloud-based resources and offers a unified platform to manage the complete malware attack progression including protection, infiltration detection, containment, cleanup, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new threats. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, find and protect information related to your IT infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be warned about impending expirations of SSLs or domains. By updating and organizing your IT documentation, you can eliminate as much as half of time spent trying to find critical information about your IT network. ProSight IT Asset Management includes a common location for holding and sharing all documents related to managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and relating IT data. Whether you're planning enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the knowledge you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management offer organizations of all sizes a versatile and cost-effective solution for evaluating, validating, scheduling, applying, and tracking updates to your dynamic information network. Besides maximizing the protection and functionality of your IT network, Progent's patch management services free up time for your in-house IT staff to concentrate on more strategic projects and activities that derive maximum business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and apps hosted in a secure Tier III data center on a fast virtual machine host set up and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the operating system software, and the applications. Since the system is virtualized, it can be moved immediately to a different hosting solution without a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoint devices against modern malware assaults such as ransomware and email phishing, which routinely evade legacy signature-matching AV tools. ProSight ASM protects local and cloud resources and offers a unified platform to address the entire threat progression including blocking, infiltration detection, containment, cleanup, and post-attack forensics. Key features include single-click rollback with Windows VSS and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver affordable in-depth security for physical servers and virtual machines, workstations, smartphones, and Exchange Server. ProSight ESP uses contextual security and modern behavior analysis for continuously monitoring and reacting to security threats from all vectors. ProSight ESP offers firewall protection, penetration alarms, endpoint control, and web filtering via cutting-edge tools packaged within a single agent managed from a unified console. Progent's security and virtualization consultants can assist you to plan and configure a ProSight ESP environment that addresses your company's unique needs and that helps you prove compliance with legal and industry information security regulations. Progent will help you define and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that call for immediate action. Progent can also assist you to install and test a backup and restore system such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange filtering.