Ransomware : Your Feared Information Technology Catastrophe
Ransomware  Recovery ExpertsCrypto-Ransomware has become a too-frequent cyberplague that poses an enterprise-level danger for businesses vulnerable to an assault. Versions of ransomware such as CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for years and still inflict damage. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, as well as frequent as yet unnamed malware, not only encrypt on-line critical data but also infiltrate all available system backup. Files synchronized to cloud environments can also be corrupted. In a poorly designed environment, it can render automatic restore operations useless and basically sets the datacenter back to square one.

Recovering applications and data after a ransomware intrusion becomes a sprint against the clock as the targeted organization fights to contain and eradicate the ransomware and to restore business-critical activity. Since crypto-ransomware requires time to move laterally, penetrations are frequently launched on weekends, when attacks are likely to take longer to detect. This multiplies the difficulty of quickly mobilizing and coordinating a knowledgeable response team.

Progent provides a range of support services for protecting enterprises from ransomware penetrations. Among these are staff training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of next-generation security appliances with AI technology to quickly detect and disable day-zero cyber threats. Progent also offers the services of expert crypto-ransomware recovery professionals with the talent and perseverance to rebuild a compromised system as rapidly as possible.

Progent's Crypto-Ransomware Restoration Help
Subsequent to a ransomware penetration, even paying the ransom demands in Bitcoin cryptocurrency does not guarantee that cyber criminals will return the needed codes to unencrypt any of your information. Kaspersky Labs determined that 17% of ransomware victims never restored their files after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms commonly range from fifteen to forty BTC ($120,000 and $400,000). This is greatly higher than the typical crypto-ransomware demands, which ZDNET determined to be around $13,000. The alternative is to re-install the vital components of your Information Technology environment. Absent access to essential data backups, this calls for a wide range of IT skills, top notch project management, and the capability to work continuously until the task is completed.

For two decades, Progent has made available certified expert IT services for companies in San Diego and throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have attained high-level industry certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-recognized certifications including CISM, CISSP, ISACA CRISC, and SANS GIAC. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP applications. This breadth of expertise affords Progent the capability to efficiently determine important systems and consolidate the surviving pieces of your network system following a crypto-ransomware event and configure them into an operational network.

Progent's recovery team deploys best of breed project management tools to coordinate the sophisticated restoration process. Progent understands the urgency of acting quickly and in concert with a customerís management and Information Technology resources to assign priority to tasks and to put key applications back on-line as fast as possible.

Case Study: A Successful Ransomware Virus Recovery
A customer escalated to Progent after their company was brought down by the Ryuk ransomware. Ryuk is thought to have been created by Northern Korean state hackers, suspected of using techniques exposed from the U.S. National Security Agency. Ryuk targets specific companies with little or no room for operational disruption and is among the most profitable iterations of ransomware viruses. Major organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in Chicago with about 500 workers. The Ryuk event had disabled all company operations and manufacturing processes. Most of the client's data protection had been directly accessible at the start of the intrusion and were damaged. The client was evaluating paying the ransom demand (exceeding $200K) and praying for good luck, but in the end made the decision to use Progent.


"I cannot speak enough about the help Progent provided us during the most fearful time of (our) companyís existence. We had little choice but to pay the hackers behind this attack if not for the confidence the Progent experts afforded us. That you were able to get our e-mail system and key applications back into operation quicker than 1 week was earth shattering. Every single expert I talked with or communicated with at Progent was urgently focused on getting my company operational and was working 24/7 to bail us out."

Progent worked with the client to rapidly get our arms around and assign priority to the most important elements that needed to be addressed in order to restart business operations:

  • Active Directory (AD)
  • Email
  • MRP System
To start, Progent adhered to AV/Malware Processes penetration mitigation best practices by stopping the spread and clearing infected systems. Progent then initiated the process of rebuilding Microsoft AD, the key technology of enterprise networks built upon Microsoft Windows Server technology. Microsoft Exchange Server messaging will not operate without Windows AD, and the client's MRP applications utilized Microsoft SQL Server, which needs Active Directory for access to the databases.

Within 48 hours, Progent was able to re-build Active Directory to its pre-virus state. Progent then initiated setup and hard drive recovery of key applications. All Exchange Server schema and configuration information were usable, which greatly helped the restore of Exchange. Progent was also able to collect intact OST data files (Outlook Off-Line Data Files) on staff workstations and laptops in order to recover mail data. A recent offline backup of the client's accounting/ERP systems made them able to recover these essential applications back online. Although a lot of work needed to be completed to recover completely from the Ryuk attack, essential services were recovered rapidly:


"For the most part, the assembly line operation showed little impact and we produced all customer sales."

During the following month critical milestones in the restoration project were accomplished through tight collaboration between Progent team members and the customer:

  • Internal web sites were returned to operation without losing any data.
  • The MailStore Exchange Server with over four million archived messages was brought on-line and available for users.
  • CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory functions were 100 percent restored.
  • A new Palo Alto 850 firewall was installed and configured.
  • Nearly all of the user desktops and notebooks were functioning as before the incident.

"A huge amount of what went on in the initial days is nearly entirely a blur for me, but we will not soon forget the countless hours all of the team put in to help get our business back. I have trusted Progent for the past 10 years, maybe more, and every time I needed help Progent has shined and delivered as promised. This event was no exception but maybe more Herculean."

Conclusion
A possible enterprise-killing catastrophe was avoided due to top-tier professionals, a wide range of technical expertise, and tight collaboration. Although in post mortem the crypto-ransomware incident detailed here could have been identified and stopped with modern cyber security solutions and NIST Cybersecurity Framework best practices, staff education, and properly executed incident response procedures for data protection and applying software patches, the fact remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's roster of professionals has proven experience in ransomware virus defense, removal, and data recovery.


"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen and Tony (and any others that were helping), thank you for making it so I could get some sleep after we made it over the initial fire. Everyone did an incredible effort, and if any of your guys is in the Chicago area, dinner is on me!"

To read or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in San Diego a variety of remote monitoring and security evaluation services designed to assist you to reduce your vulnerability to crypto-ransomware. These services utilize next-generation machine learning capability to detect new strains of ransomware that are able to evade legacy signature-based anti-virus products.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring is an endpoint protection service that incorporates next generation behavior analysis tools to defend physical and virtual endpoints against new malware assaults like ransomware and email phishing, which easily get by traditional signature-based anti-virus products. ProSight ASM safeguards on-premises and cloud resources and provides a unified platform to manage the entire threat lifecycle including filtering, infiltration detection, containment, cleanup, and forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered attacks. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

  • ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
    Progent's ProSight Enhanced Security Protection managed services offer affordable in-depth protection for physical and virtual servers, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP delivers two-way firewall protection, intrusion alerts, device management, and web filtering through cutting-edge technologies incorporated within one agent managed from a unified control. Progent's data protection and virtualization experts can help you to plan and implement a ProSight ESP deployment that addresses your company's unique needs and that allows you demonstrate compliance with government and industry information protection regulations. Progent will assist you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that require immediate attention. Progent can also help your company to install and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange filtering.

  • ProSight Data Protection Services: Managed Backup and Disaster Recovery
    ProSight Data Protection Services provide small and mid-sized businesses an affordable end-to-end solution for secure backup/disaster recovery (BDR). For a fixed monthly cost, ProSight Data Protection Services automates your backup activities and allows rapid recovery of vital files, applications and VMs that have become lost or damaged due to hardware breakdowns, software bugs, natural disasters, human error, or malicious attacks such as ransomware. ProSight DPS can help you protect, recover and restore files, folders, applications, system images, as well as Microsoft Hyper-V and VMware virtual machine images. Important data can be protected on the cloud, to a local device, or mirrored to both. Progent's BDR consultants can provide advanced expertise to set up ProSight Data Protection Services to to comply with government and industry regulatory requirements such as HIPAA, FINRA, and PCI and, when necessary, can help you to restore your critical information. Learn more about ProSight Data Protection Services Managed Backup and Recovery.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of top information security companies to provide web-based control and comprehensive security for your email traffic. The hybrid structure of Email Guard managed service integrates cloud-based filtering with an on-premises gateway appliance to provide advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The Cloud Protection Layer serves as a first line of defense and blocks most threats from making it to your security perimeter. This decreases your vulnerability to inbound threats and saves network bandwidth and storage space. Email Guard's on-premises gateway device provides a deeper layer of analysis for inbound email. For outgoing email, the onsite gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The local security gateway can also help Exchange Server to track and safeguard internal email that originates and ends within your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

  • ProSight WAN Watch: Infrastructure Management
    ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for small and mid-sized businesses to diagram, track, optimize and debug their networking hardware like routers, firewalls, and wireless controllers as well as servers, client computers and other devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that network maps are always updated, copies and manages the configuration of almost all devices on your network, tracks performance, and sends notices when potential issues are detected. By automating tedious management activities, ProSight WAN Watch can cut hours off common chores such as network mapping, reconfiguring your network, locating appliances that need critical updates, or resolving performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management consulting.

  • ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
    ProSight LAN Watch is Progentís server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management techniques to help keep your network operating efficiently by tracking the state of vital assets that drive your business network. When ProSight LAN Watch detects an issue, an alert is sent immediately to your designated IT personnel and your Progent engineering consultant so that any looming issues can be addressed before they can impact your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
    With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a protected fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting service model, the client owns the data, the operating system software, and the applications. Since the system is virtualized, it can be ported easily to a different hosting solution without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, retrieve and safeguard data related to your network infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be alerted automatically about upcoming expirations of SSLs or warranties. By updating and managing your IT documentation, you can eliminate as much as half of time spent searching for vital information about your network. ProSight IT Asset Management includes a centralized repository for storing and collaborating on all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT data. Whether youíre planning improvements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you require as soon as you need it. Read more about ProSight IT Asset Management service.
For 24-Hour San Diego Ransomware Remediation Experts, call Progent at 800-993-9400 or go to Contact Progent.