Crypto-Ransomware : Your Feared IT Nightmare
Ransomware  Recovery ConsultantsCrypto-Ransomware has become a modern cyber pandemic that presents an extinction-level danger for businesses vulnerable to an assault. Different iterations of crypto-ransomware like the Reveton, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for many years and still cause harm. The latest variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, along with more as yet unnamed viruses, not only do encryption of on-line information but also infiltrate all available system backups. Files synchronized to cloud environments can also be rendered useless. In a vulnerable environment, this can render automatic restore operations impossible and basically sets the network back to zero.

Getting back on-line services and data after a crypto-ransomware attack becomes a race against the clock as the targeted business struggles to contain the damage and eradicate the ransomware and to resume mission-critical operations. Due to the fact that ransomware requires time to move laterally, penetrations are usually sprung on weekends, when attacks tend to take longer to detect. This multiplies the difficulty of quickly mobilizing and coordinating a knowledgeable response team.

Progent makes available an assortment of support services for protecting enterprises from ransomware events. These include user education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of modern security solutions with AI capabilities from SentinelOne to discover and quarantine day-zero threats automatically. Progent also provides the assistance of veteran ransomware recovery professionals with the track record and commitment to rebuild a compromised network as soon as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware penetration, even paying the ransom demands in Bitcoin cryptocurrency does not provide any assurance that distant criminals will respond with the needed keys to decrypt all your information. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is greatly above the usual ransomware demands, which ZDNET estimates to be approximately $13,000. The other path is to piece back together the mission-critical components of your Information Technology environment. Absent the availability of essential data backups, this requires a wide complement of skills, well-coordinated team management, and the capability to work 24x7 until the task is complete.

For decades, Progent has provided certified expert Information Technology services for companies in Allentown and throughout the United States and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have attained top industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distros of Linux. Progent's security consultants have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, and GIAC. (See Progent's certifications). Progent also has expertise in financial systems and ERP application software. This breadth of expertise gives Progent the skills to rapidly understand critical systems and organize the surviving parts of your network environment after a ransomware penetration and rebuild them into a functioning system.

Progent's security team has top notch project management systems to orchestrate the sophisticated recovery process. Progent understands the urgency of working quickly and in concert with a client's management and IT staff to assign priority to tasks and to get the most important services back on-line as soon as possible.

Client Case Study: A Successful Ransomware Penetration Recovery
A small business escalated to Progent after their organization was penetrated by Ryuk ransomware. Ryuk is believed to have been launched by Northern Korean government sponsored hackers, possibly adopting approaches exposed from the United States NSA organization. Ryuk goes after specific companies with limited ability to sustain operational disruption and is among the most lucrative iterations of ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in the Chicago metro area and has about 500 workers. The Ryuk intrusion had frozen all business operations and manufacturing capabilities. Most of the client's backups had been on-line at the beginning of the attack and were destroyed. The client considered paying the ransom (more than $200,000) and wishfully thinking for good luck, but ultimately made the decision to use Progent.


"I can't tell you enough about the expertise Progent gave us during the most fearful time of (our) company's existence. We may have had to pay the Hackers except for the confidence the Progent team provided us. That you could get our messaging and key servers back on-line in less than 1 week was something I thought impossible. Each expert I talked with or e-mailed at Progent was absolutely committed on getting my company operational and was working all day and night to bail us out."

Progent worked together with the customer to quickly get our arms around and prioritize the mission critical areas that needed to be restored to make it possible to continue company functions:

  • Active Directory
  • Electronic Messaging
  • Accounting and Manufacturing Software
To get going, Progent followed ransomware incident response best practices by stopping the spread and disinfecting systems. Progent then started the process of recovering Active Directory, the foundation of enterprise systems built upon Microsoft Windows technology. Microsoft Exchange messaging will not operate without AD, and the customer's MRP system used Microsoft SQL, which depends on Active Directory services for security authorization to the databases.

Within two days, Progent was able to restore Active Directory services to its pre-penetration state. Progent then charged ahead with setup and storage recovery on needed systems. All Exchange ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to collect local OST files (Outlook Off-Line Data Files) on user PCs and laptops in order to recover mail messages. A not too old off-line backup of the customer's accounting/MRP systems made it possible to recover these required programs back servicing users. Although a lot of work needed to be completed to recover totally from the Ryuk virus, core systems were restored rapidly:


"For the most part, the manufacturing operation ran fairly normal throughout and we delivered all customer orders."

During the next few weeks important milestones in the restoration project were completed in close collaboration between Progent engineers and the client:

  • In-house web sites were restored with no loss of data.
  • The MailStore Exchange Server exceeding four million archived messages was spun up and available for users.
  • CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory functions were fully operational.
  • A new Palo Alto Networks 850 firewall was installed.
  • 90% of the desktops and laptops were functioning as before the incident.

"A huge amount of what was accomplished that first week is nearly entirely a haze for me, but we will not soon forget the commitment each of you accomplished to help get our company back. I've trusted Progent for at least 10 years, possibly more, and every time Progent has come through and delivered as promised. This event was no exception but maybe more Herculean."

Conclusion
A likely enterprise-killing catastrophe was evaded due to results-oriented professionals, a wide range of subject matter expertise, and close collaboration. Although in post mortem the ransomware incident described here should have been identified and disabled with modern cyber security solutions and best practices, user education, and well thought out incident response procedures for information protection and keeping systems up to date with security patches, the reality remains that government-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware virus, feel confident that Progent's team of experts has proven experience in ransomware virus defense, cleanup, and data restoration.


"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen and Tony (along with others who were helping), thanks very much for allowing me to get rested after we got through the initial push. All of you did an amazing effort, and if anyone is visiting the Chicago area, a great meal is my treat!"

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Allentown a range of online monitoring and security assessment services to help you to minimize the threat from crypto-ransomware. These services utilize next-generation AI technology to uncover zero-day strains of ransomware that can get past traditional signature-based anti-virus solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which easily evade traditional signature-matching anti-virus products. ProSight Active Security Monitoring protects local and cloud-based resources and offers a unified platform to address the complete threat progression including blocking, identification, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

  • ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Filtering
    ProSight Enhanced Security Protection managed services offer economical in-depth security for physical servers and virtual machines, desktops, mobile devices, and Exchange Server. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and reacting to cyber threats from all attack vectors. ProSight ESP offers firewall protection, penetration alerts, endpoint control, and web filtering through cutting-edge tools packaged within a single agent managed from a unified control. Progent's security and virtualization experts can assist you to plan and configure a ProSight ESP environment that meets your organization's unique needs and that allows you achieve and demonstrate compliance with legal and industry information security regulations. Progent will assist you define and configure policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that require urgent action. Progent can also assist your company to install and verify a backup and disaster recovery system like ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange email filtering.

  • ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
    Progent has partnered with advanced backup software companies to produce ProSight Data Protection Services, a selection of management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS services automate and track your data backup operations and allow non-disruptive backup and rapid restoration of important files, apps, images, plus VMs. ProSight DPS helps your business avoid data loss resulting from equipment failures, natural calamities, fire, malware such as ransomware, human mistakes, ill-intentioned insiders, or application glitches. Managed backup services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these managed services are most appropriate for your network.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading data security vendors to provide centralized control and comprehensive security for all your inbound and outbound email. The powerful architecture of Email Guard combines cloud-based filtering with an on-premises security gateway device to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The cloud filter acts as a first line of defense and blocks the vast majority of threats from making it to your network firewall. This reduces your exposure to external attacks and conserves system bandwidth and storage. Email Guard's on-premises gateway device provides a further level of inspection for inbound email. For outbound email, the local security gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The local security gateway can also help Microsoft Exchange Server to monitor and protect internal email that stays within your security perimeter. For more details, see Email Guard spam filtering and data leakage protection.

  • ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
    ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to diagram, monitor, enhance and troubleshoot their networking appliances such as routers, firewalls, and access points plus servers, client computers and other devices. Using cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network maps are always updated, captures and displays the configuration of virtually all devices on your network, monitors performance, and sends notices when potential issues are detected. By automating complex management and troubleshooting processes, WAN Watch can knock hours off ordinary tasks such as network mapping, expanding your network, finding appliances that need critical software patches, or identifying the cause of performance problems. Learn more about ProSight WAN Watch network infrastructure management services.

  • ProSight LAN Watch: Server and Desktop Monitoring
    ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to keep your network running efficiently by tracking the health of vital computers that power your information system. When ProSight LAN Watch detects an issue, an alert is sent automatically to your designated IT staff and your assigned Progent consultant so all looming problems can be addressed before they can disrupt productivity. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
    With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host configured and maintained by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the client owns the data, the operating system software, and the apps. Since the system is virtualized, it can be moved easily to a different hosting environment without a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, find and safeguard data related to your network infrastructure, procedures, applications, and services. You can instantly locate passwords or serial numbers and be warned about upcoming expirations of SSLs or warranties. By updating and organizing your network documentation, you can save as much as 50% of time wasted looking for critical information about your IT network. ProSight IT Asset Management features a common location for holding and collaborating on all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT information. Whether you're planning enhancements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the information you need the instant you need it. Find out more about ProSight IT Asset Management service.

  • Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
    Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior-based machine learning tools to guard endpoints and servers and VMs against modern malware attacks such as ransomware and email phishing, which easily evade legacy signature-based AV tools. Progent Active Security Monitoring services safeguard local and cloud resources and provides a single platform to address the complete threat lifecycle including protection, infiltration detection, containment, remediation, and post-attack forensics. Key capabilities include one-click rollback using Windows VSS and automatic network-wide immunization against new attacks. Read more about Progent's ransomware protection and recovery services.

  • Progent's Outsourced/Shared Help Center: Help Desk Managed Services
    Progent's Call Desk services allow your information technology team to outsource Call Center services to Progent or divide activity for support services transparently between your in-house network support group and Progent's nationwide roster of IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a seamless supplement to your in-house IT support resources. Client interaction with the Service Desk, delivery of technical assistance, escalation, trouble ticket generation and updates, performance measurement, and management of the service database are consistent whether incidents are resolved by your internal support group, by Progent, or both. Find out more about Progent's outsourced/shared Call Center services.

  • Patch Management: Patch Management Services
    Progent's managed services for software and firmware patch management offer businesses of any size a versatile and affordable alternative for assessing, validating, scheduling, applying, and tracking updates to your ever-evolving information network. Besides optimizing the protection and reliability of your IT environment, Progent's patch management services permit your in-house IT staff to concentrate on more strategic projects and activities that derive the highest business value from your network. Find out more about Progent's software/firmware update management support services.

  • ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
    Progent's Duo authentication service plans utilize Cisco's Duo cloud technology to protect against password theft by using two-factor authentication. Duo enables one-tap identity verification with Apple iOS, Google Android, and other personal devices. With Duo 2FA, whenever you sign into a protected application and enter your password you are asked to confirm your identity on a device that only you have and that uses a different network channel. A broad range of out-of-band devices can be used as this added means of ID validation such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You can register multiple verification devices. To learn more about Duo identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services.
For Allentown 24-7 Ransomware Recovery Support Services, reach out to Progent at 800-462-8800 or go to Contact Progent.