Ransomware : Your Feared IT Disaster
Ransomware  Remediation ExpertsRansomware has become a modern cyberplague that represents an enterprise-level threat for businesses of all sizes vulnerable to an assault. Versions of crypto-ransomware like the Dharma, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and still inflict damage. Newer variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, as well as additional as yet unnamed viruses, not only do encryption of on-line files but also infect many configured system restores and backups. Data synchronized to cloud environments can also be encrypted. In a poorly architected environment, it can render automated restore operations impossible and basically knocks the entire system back to square one.

Restoring services and information after a ransomware intrusion becomes a sprint against the clock as the targeted business tries its best to stop lateral movement and clear the ransomware and to restore business-critical activity. Due to the fact that crypto-ransomware takes time to spread, attacks are frequently launched on weekends, when successful attacks tend to take more time to uncover. This compounds the difficulty of rapidly assembling and coordinating an experienced response team.

Progent offers a variety of solutions for securing enterprises from ransomware attacks. These include staff training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of next-generation security solutions with AI technology from SentinelOne to detect and extinguish day-zero threats rapidly. Progent also can provide the assistance of expert ransomware recovery consultants with the skills and commitment to re-deploy a compromised system as quickly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware attack, paying the ransom in Bitcoin cryptocurrency does not guarantee that cyber hackers will respond with the needed codes to decipher any or all of your information. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their data after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is greatly above the average ransomware demands, which ZDNET determined to be around $13,000. The other path is to re-install the vital parts of your IT environment. Absent the availability of full data backups, this calls for a broad complement of skills, professional team management, and the ability to work non-stop until the recovery project is over.

For twenty years, Progent has made available professional Information Technology services for businesses in Midtown Manhattan and across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned high-level certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, and SANS GIAC. (Visit Progent's certifications). Progent also has experience with financial management and ERP software solutions. This breadth of expertise gives Progent the skills to rapidly identify important systems and re-organize the remaining components of your IT environment following a ransomware attack and assemble them into a functioning network.

Progent's ransomware team of experts uses powerful project management systems to coordinate the complex restoration process. Progent understands the urgency of working rapidly and in unison with a client's management and IT resources to prioritize tasks and to put essential applications back on line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Incident Restoration
A client engaged Progent after their network system was penetrated by the Ryuk crypto-ransomware. Ryuk is generally considered to have been deployed by North Korean state cybercriminals, possibly adopting approaches exposed from the U.S. National Security Agency. Ryuk attacks specific organizations with little tolerance for disruption and is among the most profitable examples of ransomware viruses. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company based in Chicago and has around 500 workers. The Ryuk intrusion had disabled all essential operations and manufacturing capabilities. The majority of the client's data backups had been online at the start of the intrusion and were encrypted. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but in the end engaged Progent.


"I can't say enough in regards to the care Progent provided us during the most stressful time of (our) company's life. We would have paid the cybercriminals except for the confidence the Progent experts provided us. That you could get our e-mail system and key servers back into operation quicker than five days was incredible. Each expert I interacted with or messaged at Progent was absolutely committed on getting us back online and was working 24/7 to bail us out."

Progent worked hand in hand the customer to quickly determine and assign priority to the essential areas that needed to be restored in order to resume company functions:

  • Active Directory
  • Exchange Server
  • Accounting and Manufacturing Software
To get going, Progent adhered to ransomware incident mitigation industry best practices by halting lateral movement and removing active viruses. Progent then initiated the task of rebuilding Active Directory, the heart of enterprise networks built on Microsoft technology. Microsoft Exchange Server messaging will not function without Active Directory, and the businesses' accounting and MRP software leveraged Microsoft SQL Server, which needs Active Directory for access to the information.

Within 2 days, Progent was able to re-build Active Directory to its pre-penetration state. Progent then accomplished rebuilding and hard drive recovery on critical systems. All Exchange data and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to assemble intact OST data files (Outlook Email Offline Data Files) on user desktop computers in order to recover email information. A recent off-line backup of the customer's manufacturing software made it possible to return these essential applications back online. Although major work needed to be completed to recover totally from the Ryuk event, essential services were returned to operations rapidly:


"For the most part, the manufacturing operation showed little impact and we produced all customer shipments."

During the following few weeks key milestones in the restoration process were completed through tight collaboration between Progent team members and the customer:

  • Internal web sites were restored without losing any data.
  • The MailStore Microsoft Exchange Server exceeding four million historical emails was brought on-line and accessible to users.
  • CRM/Orders/Invoicing/AP/AR/Inventory functions were completely recovered.
  • A new Palo Alto 850 firewall was set up.
  • Nearly all of the user desktops and notebooks were being used by staff.

"So much of what transpired during the initial response is nearly entirely a blur for me, but I will not forget the commitment all of you put in to give us our company back. I have utilized Progent for at least 10 years, possibly more, and each time I needed help Progent has come through and delivered. This time was a Herculean accomplishment."

Conclusion
A possible business disaster was averted by dedicated experts, a wide spectrum of technical expertise, and close collaboration. Although in retrospect the ransomware virus incident detailed here should have been prevented with up-to-date security technology solutions and security best practices, user and IT administrator training, and properly executed incident response procedures for information backup and keeping systems up to date with security patches, the reality remains that state-sponsored cybercriminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of experts has proven experience in ransomware virus blocking, cleanup, and data disaster recovery.


"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen and Tony (and any others who were involved), thank you for allowing me to get some sleep after we got through the first week. Everyone did an incredible job, and if any of your team is in the Chicago area, a great meal is the least I can do!"

To read or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide companies in Midtown Manhattan a portfolio of online monitoring and security assessment services designed to assist you to minimize your vulnerability to ransomware. These services utilize next-generation artificial intelligence capability to detect zero-day variants of ransomware that can get past traditional signature-based security solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior machine learning technology to guard physical and virtual endpoint devices against modern malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-based AV tools. ProSight Active Security Monitoring protects local and cloud resources and provides a unified platform to automate the entire threat progression including filtering, detection, containment, cleanup, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

  • ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
    ProSight Enhanced Security Protection (ESP) services offer economical in-depth security for physical servers and virtual machines, workstations, smartphones, and Exchange Server. ProSight ESP uses contextual security and advanced machine learning for round-the-clock monitoring and reacting to cyber threats from all vectors. ProSight ESP delivers firewall protection, penetration alarms, endpoint management, and web filtering via cutting-edge technologies packaged within a single agent managed from a single console. Progent's data protection and virtualization experts can help you to design and configure a ProSight ESP deployment that addresses your company's specific requirements and that allows you prove compliance with government and industry information protection standards. Progent will assist you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that call for immediate attention. Progent can also help you to set up and test a backup and disaster recovery solution like ProSight Data Protection Services so you can recover rapidly from a destructive cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange email filtering.

  • ProSight Data Protection Services: Managed Backup and Recovery Services
    Progent has worked with leading backup software companies to produce ProSight Data Protection Services, a selection of subscription-based management offerings that provide backup-as-a-service (BaaS). ProSight DPS products manage and monitor your data backup operations and enable transparent backup and rapid restoration of critical files, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS lets you protect against data loss caused by equipment failures, natural calamities, fire, malware such as ransomware, human error, malicious insiders, or software bugs. Managed services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to determine which of these managed services are best suited for your IT environment.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of top information security companies to provide centralized management and world-class security for your email traffic. The powerful structure of Progent's Email Guard managed service integrates a Cloud Protection Layer with a local security gateway appliance to provide advanced defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-based malware. Email Guard's Cloud Protection Layer serves as a preliminary barricade and keeps most unwanted email from making it to your security perimeter. This reduces your exposure to external threats and conserves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a deeper level of analysis for inbound email. For outgoing email, the on-premises gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to track and protect internal email that stays within your security perimeter. For more details, see Email Guard spam filtering and data leakage protection.

  • ProSight WAN Watch: Infrastructure Remote Monitoring and Management
    ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for small and mid-sized organizations to map out, monitor, optimize and troubleshoot their connectivity hardware such as routers and switches, firewalls, and access points as well as servers, printers, endpoints and other devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network maps are always updated, captures and displays the configuration of virtually all devices on your network, tracks performance, and generates alerts when problems are detected. By automating time-consuming network management activities, ProSight WAN Watch can cut hours off ordinary chores such as network mapping, expanding your network, finding devices that need critical updates, or identifying the cause of performance problems. Learn more about ProSight WAN Watch network infrastructure monitoring and management consulting.

  • ProSight LAN Watch: Server and Desktop Monitoring and Management
    ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management techniques to help keep your IT system running efficiently by checking the state of critical assets that drive your business network. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your specified IT staff and your Progent engineering consultant so that any looming problems can be resolved before they have a chance to impact your network. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

  • ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
    With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected Tier III data center on a fast virtual host configured and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the operating system platforms, and the applications. Because the system is virtualized, it can be ported easily to a different hardware solution without requiring a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, retrieve and safeguard data about your network infrastructure, processes, business apps, and services. You can quickly find passwords or IP addresses and be warned about upcoming expirations of SSLs or domains. By cleaning up and organizing your network documentation, you can save up to half of time spent trying to find vital information about your IT network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents required for managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT data. Whether you're making improvements, doing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the data you require when you need it. Read more about Progent's ProSight IT Asset Management service.

  • Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
    Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior-based analysis technology to guard endpoint devices as well as servers and VMs against modern malware assaults like ransomware and file-less exploits, which routinely escape traditional signature-based AV products. Progent ASM services protect local and cloud resources and provides a single platform to address the complete malware attack progression including filtering, identification, containment, cleanup, and post-attack forensics. Key features include one-click rollback using Windows VSS and automatic network-wide immunization against newly discovered attacks. Learn more about Progent's ransomware protection and recovery services.

  • Outsourced/Co-managed Help Desk: Call Center Managed Services
    Progent's Support Center services permit your IT team to outsource Support Desk services to Progent or split responsibilities for Service Desk support transparently between your internal network support group and Progent's nationwide roster of certified IT service technicians, engineers and subject matter experts. Progent's Shared Help Desk Service offers a smooth supplement to your core support resources. User access to the Service Desk, delivery of support, escalation, ticket creation and updates, performance measurement, and maintenance of the support database are cohesive whether issues are taken care of by your in-house IT support staff, by Progent, or a mix of the two. Find out more about Progent's outsourced/shared Service Desk services.

  • Progent's Patch Management: Patch Management Services
    Progent's support services for patch management provide businesses of any size a flexible and affordable alternative for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving IT network. In addition to optimizing the security and reliability of your IT network, Progent's software/firmware update management services allow your in-house IT staff to concentrate on more strategic projects and activities that derive the highest business value from your information network. Read more about Progent's patch management support services.

  • ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
    Progent's Duo authentication managed services incorporate Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication (2FA). Duo supports single-tap identity confirmation with Apple iOS, Android, and other out-of-band devices. With 2FA, when you sign into a secured online account and give your password you are requested to verify who you are via a unit that only you possess and that uses a separate network channel. A wide range of devices can be utilized for this added form of authentication such as an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You can register several verification devices. For more information about Duo two-factor identity validation services, visit Duo MFA two-factor authentication (2FA) services.

  • ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
    ProSight Reporting is a growing line of in-depth reporting tools designed to work with the industry's top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like inconsistent support follow-through or machines with out-of-date AVs. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.
For Midtown Manhattan 24-Hour Crypto Recovery Consulting, reach out to Progent at 800-462-8800 or go to Contact Progent.