24x7x365 Lower Manhattan Urgent Crypto-Ransomware
Malware Identification and Remediation Experts

Crypto-Ransomware : Your Feared IT Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that poses an enterprise-level danger for businesses unprepared for an attack. Multiple generations of crypto-ransomware like the CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for many years and continue to cause havoc. The latest strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, plus additional unnamed malware, not only encrypt on-line information but also infiltrate most configured system protection. Data synchronized to cloud environments can also be rendered useless. In a poorly designed system, it can render any restore operations hopeless and effectively sets the entire system back to square one.

Getting back applications and data after a ransomware outage becomes a sprint against time as the targeted organization tries its best to stop the spread and cleanup the virus and to restore business-critical operations. Since ransomware takes time to move laterally, penetrations are frequently launched on weekends and holidays, when successful attacks tend to take longer to identify. This multiplies the difficulty of quickly marshalling and coordinating a knowledgeable response team.

Progent provides a range of support services for securing businesses from ransomware events. These include user training to help identify and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of modern security solutions with machine learning technology from SentinelOne to discover and quarantine day-zero threats quickly. Progent in addition provides the assistance of seasoned ransomware recovery engineers with the skills and commitment to restore a compromised network as quickly as possible.

Progent's Ransomware Restoration Services
Soon after a crypto-ransomware attack, even paying the ransom demands in Bitcoin cryptocurrency does not provide any assurance that cyber criminals will provide the keys to unencrypt any of your files. Kaspersky estimated that seventeen percent of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is greatly above the usual ransomware demands, which ZDNET determined to be approximately $13,000. The alternative is to setup from scratch the essential elements of your IT environment. Absent access to full data backups, this requires a wide complement of IT skills, top notch project management, and the ability to work continuously until the job is completed.

For twenty years, Progent has made available certified expert IT services for businesses in Lower Manhattan and throughout the US and has achieved Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have earned internationally-renowned certifications including CISA, CISSP, CRISC, and GIAC. (Visit Progent's certifications). Progent also has experience with financial management and ERP software solutions. This breadth of expertise affords Progent the skills to rapidly understand important systems and consolidate the remaining parts of your network system following a ransomware event and rebuild them into an operational system.

Progent's ransomware group deploys powerful project management tools to coordinate the sophisticated recovery process. Progent understands the urgency of working rapidly and together with a customer's management and Information Technology team members to prioritize tasks and to put critical applications back on line as fast as possible.

Business Case Study: A Successful Ransomware Incident Recovery
A client contacted Progent after their network was brought down by Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean government sponsored criminal gangs, suspected of using approaches exposed from America's National Security Agency. Ryuk seeks specific organizations with little ability to sustain disruption and is among the most lucrative incarnations of ransomware viruses. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business headquartered in the Chicago metro area and has around 500 employees. The Ryuk intrusion had frozen all business operations and manufacturing capabilities. Most of the client's data protection had been online at the start of the attack and were eventually encrypted. The client was evaluating paying the ransom (in excess of $200K) and wishfully thinking for the best, but ultimately called Progent.

Progent worked hand in hand the customer to quickly get our arms around and prioritize the key applications that needed to be restored in order to restart company operations:

• Windows Active Directory
• Microsoft Exchange Email
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then performed reinstallations and storage recovery on essential systems. All Exchange Server ties and attributes were intact, which facilitated the restore of Exchange. Progent was able to assemble local OST data files (Outlook Offline Folder Files) on team workstations in order to recover mail information. A not too old off-line backup of the businesses accounting/ERP systems made it possible to restore these required programs back online for users. Although major work was left to recover totally from the Ryuk attack, essential systems were returned to operations rapidly:

Over the following few weeks important milestones in the restoration process were completed in tight cooperation between Progent engineers and the customer:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Exchange Server containing more than 4 million historical emails was restored to operations and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were completely restored.
• A new Palo Alto Networks 850 firewall was installed.
• Ninety percent of the user workstations were functioning as before the incident.

Conclusion
A potential business-killing disaster was evaded by dedicated experts, a broad spectrum of technical expertise, and tight collaboration. Although in retrospect the crypto-ransomware virus incident detailed here could have been disabled with up-to-date cyber security technology and NIST Cybersecurity Framework best practices, user and IT administrator education, and well designed security procedures for backup and keeping systems up to date with security patches, the reality remains that state-sponsored hackers from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has a proven track record in ransomware virus blocking, cleanup, and information systems recovery.

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Lower Manhattan a range of remote monitoring and security assessment services designed to help you to reduce the threat from ransomware. These services incorporate next-generation artificial intelligence capability to uncover zero-day strains of crypto-ransomware that are able to get past legacy signature-based security solutions.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior machine learning tools to guard physical and virtual endpoint devices against modern malware attacks such as ransomware and file-less exploits, which routinely get by legacy signature-based anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a single platform to automate the complete malware attack progression including protection, infiltration detection, mitigation, cleanup, and forensics. Top features include one-click rollback using Windows VSS and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver economical in-depth protection for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and reacting to security assaults from all vectors. ProSight ESP delivers firewall protection, intrusion alerts, device management, and web filtering through leading-edge tools packaged within one agent managed from a unified control. Progent's security and virtualization experts can assist your business to design and configure a ProSight ESP environment that meets your company's specific requirements and that allows you prove compliance with government and industry information security regulations. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that call for urgent attention. Progent can also assist you to install and test a backup and restore system such as ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has partnered with advanced backup/restore technology companies to create ProSight Data Protection Services, a selection of offerings that deliver backup-as-a-service (BaaS). ProSight DPS products manage and monitor your data backup operations and enable transparent backup and fast restoration of vital files/folders, apps, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you protect against data loss caused by hardware failures, natural disasters, fire, cyber attacks like ransomware, human mistakes, malicious insiders, or software bugs. Managed backup services in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to identify which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of top data security vendors to provide web-based management and world-class protection for all your inbound and outbound email. The powerful structure of Progent's Email Guard combines cloud-based filtering with an on-premises security gateway device to offer advanced protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-based malware. Email Guard's Cloud Protection Layer serves as a first line of defense and keeps the vast majority of unwanted email from reaching your security perimeter. This decreases your exposure to inbound attacks and saves system bandwidth and storage space. Email Guard's onsite security gateway device adds a deeper layer of inspection for inbound email. For outbound email, the onsite security gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The local security gateway can also help Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends inside your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for small and mid-sized businesses to map out, monitor, reconfigure and troubleshoot their networking hardware such as routers and switches, firewalls, and access points plus servers, endpoints and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that network maps are kept current, copies and manages the configuration of almost all devices connected to your network, monitors performance, and sends notices when potential issues are discovered. By automating complex management activities, WAN Watch can knock hours off common tasks like making network diagrams, expanding your network, finding appliances that need critical software patches, or isolating performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management technology to keep your IT system running efficiently by checking the health of vital computers that power your business network. When ProSight LAN Watch detects an issue, an alarm is sent automatically to your specified IT management staff and your Progent engineering consultant so that any potential problems can be resolved before they have a chance to disrupt your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual host set up and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the apps. Because the system is virtualized, it can be ported easily to an alternate hardware environment without requiring a lengthy and difficult configuration process. With ProSight Virtual Hosting, you are not locked into one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, find and protect information about your network infrastructure, processes, business apps, and services. You can quickly locate passwords or serial numbers and be warned automatically about impending expirations of SSL certificates ,domains or warranties. By updating and managing your network documentation, you can eliminate as much as 50% of time spent trying to find vital information about your IT network. ProSight IT Asset Management features a common repository for holding and sharing all documents required for managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether you're planning improvements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Learn more about ProSight IT Asset Management service.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates cutting edge behavior-based analysis technology to guard endpoint devices as well as physical and virtual servers against modern malware attacks such as ransomware and email phishing, which routinely get by traditional signature-based AV tools. Progent ASM services protect on-premises and cloud-based resources and provides a single platform to address the complete malware attack progression including protection, detection, mitigation, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new threats. Read more about Progent's ransomware protection and cleanup services.

• Progent's Outsourced/Shared Service Center: Help Desk Managed Services
  Progent's Support Center managed services enable your IT staff to offload Support Desk services to Progent or split activity for Service Desk support transparently between your in-house support team and Progent's nationwide roster of IT service engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a transparent extension of your internal IT support resources. User interaction with the Help Desk, provision of support services, problem escalation, trouble ticket creation and updates, performance metrics, and management of the service database are cohesive whether incidents are resolved by your in-house network support group, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/co-managed Service Desk services.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management offer businesses of all sizes a flexible and affordable alternative for assessing, testing, scheduling, implementing, and documenting software and firmware updates to your ever-evolving IT system. In addition to optimizing the protection and functionality of your computer network, Progent's patch management services permit your IT staff to focus on line-of-business projects and tasks that derive the highest business value from your information network. Learn more about Progent's patch management services.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA services utilize Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity confirmation with Apple iOS, Android, and other out-of-band devices. Using 2FA, whenever you sign into a secured online account and give your password you are asked to confirm who you are via a unit that only you possess and that is accessed using a different network channel. A wide range of out-of-band devices can be utilized as this second means of authentication including an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You may designate several verification devices. For more information about Duo two-factor identity validation services, see Cisco Duo MFA two-factor authentication services for access security.