Ransomware : Your Crippling IT Catastrophe
Ransomware  Recovery ProfessionalsRansomware has become a too-frequent cyberplague that represents an extinction-level danger for businesses of all sizes poorly prepared for an attack. Different versions of ransomware such as Dharma, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for many years and still inflict damage. More recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, as well as frequent as yet unnamed newcomers, not only encrypt online critical data but also infect most available system restores and backups. Files synchronized to the cloud can also be rendered useless. In a poorly designed system, this can render automated restoration impossible and basically sets the datacenter back to square one.

Retrieving programs and data following a ransomware attack becomes a race against time as the targeted business fights to stop lateral movement and clear the crypto-ransomware and to restore business-critical operations. Because ransomware takes time to replicate, penetrations are frequently launched on weekends and holidays, when successful attacks may take longer to identify. This compounds the difficulty of quickly assembling and coordinating a qualified response team.

Progent offers a variety of support services for protecting businesses from ransomware events. Among these are team education to help identify and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of modern security appliances with artificial intelligence capabilities to intelligently identify and disable day-zero cyber threats. Progent in addition provides the services of expert ransomware recovery professionals with the talent and perseverance to rebuild a compromised system as urgently as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will respond with the keys to decrypt all your files. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is significantly above the average ransomware demands, which ZDNET averages to be around $13,000. The other path is to piece back together the vital parts of your Information Technology environment. Absent access to complete information backups, this requires a broad range of IT skills, top notch team management, and the willingness to work 24x7 until the task is complete.

For twenty years, Progent has offered professional IT services for businesses in Denver and across the United States and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have attained top industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of expertise gives Progent the ability to quickly identify critical systems and consolidate the surviving components of your IT system following a ransomware attack and rebuild them into an operational network.

Progent's security group deploys top notch project management tools to coordinate the complicated recovery process. Progent knows the urgency of acting quickly and in unison with a customerís management and IT resources to assign priority to tasks and to put key systems back online as fast as possible.

Case Study: A Successful Crypto-Ransomware Incident Restoration
A customer sought out Progent after their company was attacked by the Ryuk crypto-ransomware. Ryuk is believed to have been developed by North Korean state sponsored criminal gangs, possibly using approaches exposed from the U.S. NSA organization. Ryuk targets specific companies with limited tolerance for operational disruption and is among the most lucrative versions of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in Chicago with about 500 workers. The Ryuk penetration had disabled all business operations and manufacturing processes. Most of the client's system backups had been directly accessible at the beginning of the attack and were destroyed. The client was evaluating paying the ransom demand (in excess of $200K) and hoping for good luck, but ultimately made the decision to use Progent.


"I canít thank you enough about the support Progent provided us during the most critical time of (our) businesses life. We had little choice but to pay the hackers behind this attack if it wasnít for the confidence the Progent experts provided us. That you were able to get our e-mail and production applications back on-line sooner than 1 week was amazing. Every single expert I interacted with or communicated with at Progent was totally committed on getting us back online and was working 24/7 to bail us out."

Progent worked hand in hand the client to quickly determine and prioritize the essential applications that needed to be restored in order to resume business functions:

  • Windows Active Directory
  • Email
  • MRP System
To get going, Progent followed AV/Malware Processes event response best practices by isolating and performing virus removal steps. Progent then began the steps of recovering Microsoft AD, the key technology of enterprise systems built upon Microsoft Windows technology. Microsoft Exchange email will not work without Active Directory, and the customerís accounting and MRP software leveraged SQL Server, which depends on Active Directory services for access to the databases.

In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then assisted with rebuilding and hard drive recovery on key servers. All Exchange schema and configuration information were usable, which accelerated the restore of Exchange. Progent was able to find non-encrypted OST files (Microsoft Outlook Offline Folder Files) on various desktop computers and laptops to recover mail data. A recent offline backup of the client's financials/MRP systems made them able to recover these vital applications back on-line. Although significant work remained to recover completely from the Ryuk attack, essential systems were recovered quickly:


"For the most part, the production line operation survived unscathed and we delivered all customer sales."

During the next couple of weeks critical milestones in the restoration process were made in close collaboration between Progent consultants and the client:

  • In-house web applications were brought back up without losing any information.
  • The MailStore Microsoft Exchange Server containing more than four million archived messages was brought online and accessible to users.
  • CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control functions were 100 percent functional.
  • A new Palo Alto Networks 850 security appliance was installed and configured.
  • Most of the user PCs were operational.

"A huge amount of what occurred that first week is mostly a blur for me, but we will not soon forget the care each and every one of the team accomplished to give us our business back. I have utilized Progent for the past 10 years, possibly more, and every time I needed help Progent has impressed me and delivered. This time was no exception but maybe more Herculean."

Conclusion
A likely enterprise-killing disaster was evaded with top-tier professionals, a wide spectrum of IT skills, and close collaboration. Although in post mortem the ransomware virus incident described here would have been shut down with current security technology solutions and best practices, team education, and appropriate incident response procedures for data protection and keeping systems up to date with security patches, the fact remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's roster of experts has extensive experience in crypto-ransomware virus defense, remediation, and file disaster recovery.


"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen and Chris (along with others who were involved), thanks very much for allowing me to get some sleep after we made it through the initial push. All of you did an impressive effort, and if anyone that helped is visiting the Chicago area, dinner is on me!"

To read or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Denver a portfolio of online monitoring and security assessment services designed to assist you to minimize the threat from ransomware. These services incorporate modern machine learning technology to uncover zero-day variants of ransomware that are able to get past legacy signature-based security solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates next generation behavior machine learning tools to guard physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which easily evade legacy signature-matching AV tools. ProSight Active Security Monitoring safeguards local and cloud-based resources and provides a unified platform to automate the entire threat lifecycle including blocking, identification, containment, cleanup, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered attacks. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

  • ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Filtering
    ProSight Enhanced Security Protection managed services offer economical multi-layer protection for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and modern behavior analysis for continuously monitoring and reacting to security assaults from all attack vectors. ProSight ESP offers firewall protection, intrusion alarms, endpoint control, and web filtering through cutting-edge technologies packaged within one agent accessible from a unified console. Progent's data protection and virtualization consultants can help your business to design and configure a ProSight ESP environment that meets your company's unique requirements and that helps you demonstrate compliance with legal and industry information security regulations. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that require immediate attention. Progent can also help you to install and verify a backup and restore system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Microsoft Exchange filtering.

  • ProSight Data Protection Services: Managed Backup and Recovery
    ProSight Data Protection Services from Progent offer small and mid-sized organizations a low cost end-to-end service for secure backup/disaster recovery. For a low monthly rate, ProSight DPS automates and monitors your backup processes and allows rapid recovery of vital data, apps and VMs that have become lost or corrupted as a result of hardware failures, software bugs, disasters, human error, or malicious attacks like ransomware. ProSight DPS can help you back up, recover and restore files, folders, applications, system images, plus Microsoft Hyper-V and VMware images/. Important data can be backed up on the cloud, to an on-promises storage device, or mirrored to both. Progent's cloud backup consultants can provide world-class support to configure ProSight Data Protection Services to be compliant with regulatory standards such as HIPAA, FIRPA, and PCI and, whenever needed, can assist you to restore your critical information. Find out more about ProSight DPS Managed Cloud Backup and Recovery.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of leading data security vendors to deliver web-based management and comprehensive security for your email traffic. The powerful architecture of Progent's Email Guard integrates a Cloud Protection Layer with an on-premises security gateway appliance to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's cloud filter acts as a first line of defense and blocks most unwanted email from reaching your network firewall. This decreases your vulnerability to external attacks and conserves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a further level of inspection for incoming email. For outgoing email, the onsite gateway offers AV and anti-spam filtering, protection against data leaks, and email encryption. The local gateway can also help Microsoft Exchange Server to track and protect internal email traffic that stays inside your security perimeter. For more information, see ProSight Email Guard spam and content filtering.

  • ProSight WAN Watch: Infrastructure Remote Monitoring and Management
    Progentís ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for small and mid-sized organizations to diagram, monitor, reconfigure and debug their connectivity appliances like routers, firewalls, and wireless controllers plus servers, client computers and other devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network diagrams are kept updated, captures and displays the configuration of virtually all devices connected to your network, monitors performance, and generates alerts when issues are discovered. By automating complex management activities, WAN Watch can knock hours off common tasks such as making network diagrams, expanding your network, locating devices that need critical software patches, or resolving performance issues. Learn more about ProSight WAN Watch network infrastructure management services.

  • ProSight LAN Watch: Server and Desktop Monitoring
    ProSight LAN Watch is Progentís server and desktop monitoring managed service that uses advanced remote monitoring and management technology to keep your IT system running efficiently by checking the state of vital computers that power your information system. When ProSight LAN Watch uncovers a problem, an alert is sent immediately to your specified IT management staff and your assigned Progent engineering consultant so that all potential problems can be addressed before they can impact productivity. Find out more about ProSight LAN Watch server and desktop monitoring services.

  • ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
    With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual host configured and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be ported easily to an alternate hosting environment without requiring a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Learn more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, find and safeguard data about your network infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be warned about upcoming expirations of SSL certificates or warranties. By cleaning up and managing your network documentation, you can eliminate as much as half of time spent trying to find vital information about your IT network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT data. Whether youíre planning improvements, performing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you need when you need it. Read more about Progent's ProSight IT Asset Management service.
For Denver 24-7 Crypto-Ransomware Cleanup Experts, reach out to Progent at 800-993-9400 or go to Contact Progent.