Oakland 24-Hour Urgent Ransomware
Malware Assessment and Repair Consulting

Ransomware : Your Crippling IT Nightmare
Ransomware has become a too-frequent cyber pandemic that represents an enterprise-level threat for businesses of all sizes vulnerable to an attack. Different iterations of ransomware such as Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for years and continue to cause havoc. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, along with more as yet unnamed viruses, not only encrypt on-line files but also infiltrate all available system backup. Data synched to off-site disaster recovery sites can also be ransomed. In a vulnerable environment, this can make automatic restore operations hopeless and basically sets the entire system back to square one.

Recovering applications and information following a ransomware attack becomes a race against time as the targeted business struggles to stop the spread and cleanup the crypto-ransomware and to restore business-critical activity. Because ransomware needs time to spread, attacks are frequently sprung during weekends and nights, when successful penetrations tend to take longer to identify. This compounds the difficulty of quickly assembling and organizing a capable mitigation team.

Progent makes available an assortment of solutions for protecting organizations from ransomware penetrations. Among these are staff education to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of next-generation security solutions with machine learning capabilities from SentinelOne to identify and disable new cyber threats quickly. Progent also provides the services of experienced crypto-ransomware recovery professionals with the talent and perseverance to re-deploy a breached system as urgently as possible.

Progent's Crypto-Ransomware Restoration Help
After a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that merciless criminals will respond with the keys to decrypt any or all of your information. Kaspersky Labs estimated that seventeen percent of ransomware victims never recovered their information even after having paid the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is significantly above the typical crypto-ransomware demands, which ZDNET averages to be approximately $13,000. The fallback is to re-install the essential elements of your IT environment. Absent the availability of complete data backups, this calls for a wide complement of skill sets, top notch team management, and the capability to work 24x7 until the recovery project is over.

For two decades, Progent has made available expert IT services for businesses in Oakland and throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained top industry certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, and GIAC. (See Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience affords Progent the skills to rapidly ascertain important systems and organize the surviving parts of your computer network environment following a ransomware attack and configure them into an operational system.

Progent's ransomware team of experts utilizes state-of-the-art project management applications to orchestrate the complex restoration process. Progent appreciates the urgency of working swiftly and in unison with a client's management and Information Technology resources to prioritize tasks and to put key applications back online as fast as possible.

Case Study: A Successful Crypto-Ransomware Intrusion Recovery
A client engaged Progent after their company was penetrated by Ryuk crypto-ransomware. Ryuk is believed to have been developed by North Korean state sponsored cybercriminals, suspected of using approaches leaked from the U.S. NSA organization. Ryuk attacks specific organizations with little ability to sustain operational disruption and is among the most lucrative incarnations of ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer located in Chicago with about 500 staff members. The Ryuk attack had frozen all business operations and manufacturing processes. The majority of the client's backups had been directly accessible at the time of the attack and were damaged. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for the best, but ultimately utilized Progent.

Progent worked together with the client to rapidly understand and assign priority to the critical elements that needed to be recovered to make it possible to continue departmental functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• MRP System

In less than 48 hours, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then charged ahead with setup and storage recovery of critical applications. All Microsoft Exchange Server data and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to assemble local OST files (Microsoft Outlook Offline Folder Files) on staff PCs in order to recover email information. A recent off-line backup of the client's accounting/ERP systems made them able to recover these vital services back on-line. Although significant work was left to recover totally from the Ryuk damage, essential services were recovered rapidly:

During the following few weeks key milestones in the restoration project were accomplished through close cooperation between Progent engineers and the client:

• In-house web applications were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server containing more than four million archived messages was brought on-line and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control modules were 100% restored.
• A new Palo Alto Networks 850 firewall was brought on-line.
• 90% of the user desktops were functioning as before the incident.

Conclusion
A likely business-killing disaster was dodged through the efforts of dedicated professionals, a wide array of subject matter expertise, and close collaboration. Although in analyzing the event afterwards the ransomware penetration detailed here could have been identified and blocked with up-to-date cyber security technology solutions and NIST Cybersecurity Framework best practices, team training, and well thought out security procedures for data backup and applying software patches, the fact remains that government-sponsored hackers from Russia, China and elsewhere are relentless and are not going away. If you do get hit by a ransomware incursion, feel confident that Progent's team of experts has proven experience in ransomware virus defense, cleanup, and file restoration.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Oakland a portfolio of online monitoring and security evaluation services designed to assist you to reduce the threat from crypto-ransomware. These services incorporate next-generation artificial intelligence capability to uncover new strains of ransomware that are able to escape detection by traditional signature-based anti-virus solutions.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior analysis technology to guard physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which routinely escape traditional signature-matching AV products. ProSight Active Security Monitoring safeguards local and cloud resources and offers a single platform to address the entire malware attack lifecycle including filtering, identification, mitigation, remediation, and forensics. Top capabilities include single-click rollback using Windows VSS and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection services offer economical multi-layer protection for physical servers and virtual machines, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and advanced heuristics for continuously monitoring and reacting to security threats from all attack vectors. ProSight ESP delivers two-way firewall protection, intrusion alerts, endpoint management, and web filtering through cutting-edge tools packaged within one agent accessible from a unified console. Progent's security and virtualization consultants can help you to plan and configure a ProSight ESP deployment that meets your organization's specific needs and that allows you demonstrate compliance with government and industry information protection standards. Progent will assist you define and implement policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that call for urgent action. Progent's consultants can also assist your company to set up and verify a backup and restore system like ProSight Data Protection Services so you can recover rapidly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange filtering.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup/restore technology providers to create ProSight Data Protection Services (DPS), a selection of offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your backup processes and enable non-disruptive backup and fast recovery of important files/folders, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps you recover from data loss caused by equipment breakdown, natural calamities, fire, malware such as ransomware, user mistakes, malicious employees, or software glitches. Managed backup services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading data security vendors to provide centralized control and comprehensive security for your inbound and outbound email. The powerful architecture of Progent's Email Guard combines a Cloud Protection Layer with an on-premises security gateway appliance to offer advanced defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-based threats. Email Guard's Cloud Protection Layer acts as a preliminary barricade and keeps most unwanted email from making it to your security perimeter. This decreases your exposure to external threats and conserves network bandwidth and storage space. Email Guard's onsite gateway device adds a further level of analysis for incoming email. For outbound email, the local gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The onsite security gateway can also help Microsoft Exchange Server to track and protect internal email traffic that originates and ends within your security perimeter. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized organizations to map out, monitor, enhance and troubleshoot their connectivity appliances like switches, firewalls, and access points plus servers, client computers and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that infrastructure topology diagrams are kept current, copies and displays the configuration information of almost all devices on your network, monitors performance, and sends alerts when issues are detected. By automating time-consuming management activities, WAN Watch can knock hours off common chores such as making network diagrams, expanding your network, locating devices that need important software patches, or resolving performance issues. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management technology to help keep your IT system operating efficiently by tracking the health of vital assets that drive your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your specified IT personnel and your Progent consultant so all looming issues can be addressed before they have a chance to disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a secure fault tolerant data center on a fast virtual host configured and maintained by Progent's network support professionals. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the OS platforms, and the applications. Because the system is virtualized, it can be moved easily to a different hosting solution without requiring a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, retrieve and safeguard information related to your IT infrastructure, procedures, applications, and services. You can quickly locate passwords or IP addresses and be warned about impending expirations of SSLs ,domains or warranties. By updating and organizing your network documentation, you can save up to 50% of time thrown away searching for vital information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and collaborating on all documents related to managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT data. Whether you're making enhancements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the information you need when you need it. Learn more about ProSight IT Asset Management service.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes next generation behavior machine learning tools to defend endpoint devices and servers and VMs against modern malware assaults such as ransomware and file-less exploits, which routinely evade traditional signature-matching AV tools. Progent ASM services safeguard local and cloud resources and offers a unified platform to automate the entire malware attack lifecycle including protection, identification, containment, cleanup, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new threats. Learn more about Progent's ransomware protection and cleanup services.

• Outsourced/Co-managed Service Desk: Help Desk Managed Services
  Progent's Help Desk managed services permit your IT group to offload Support Desk services to Progent or split activity for Service Desk support seamlessly between your internal network support staff and Progent's extensive roster of IT service engineers and subject matter experts (SMEs). Progent's Shared Service Desk offers a smooth supplement to your corporate network support staff. End user interaction with the Help Desk, provision of support services, issue escalation, ticket creation and tracking, performance metrics, and management of the service database are consistent whether incidents are taken care of by your core network support group, by Progent, or a mix of the two. Find out more about Progent's outsourced/co-managed Service Desk services.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer organizations of all sizes a flexible and cost-effective solution for evaluating, validating, scheduling, applying, and documenting updates to your ever-evolving IT system. In addition to optimizing the security and functionality of your IT environment, Progent's patch management services permit your IT staff to focus on line-of-business projects and tasks that deliver maximum business value from your network. Read more about Progent's patch management services.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA services incorporate Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication. Duo supports single-tap identity verification on iOS, Android, and other out-of-band devices. Using 2FA, whenever you log into a secured application and enter your password you are requested to verify your identity via a unit that only you possess and that uses a separate network channel. A broad selection of out-of-band devices can be used for this added form of authentication such as an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You can designate several validation devices. For details about ProSight Duo identity validation services, go to Cisco Duo MFA two-factor authentication services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of in-depth reporting tools created to work with the top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues like spotty support follow-through or machines with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.