Ransomware : Your Feared IT Disaster
Ransomware  Recovery ExpertsCrypto-Ransomware has become a modern cyberplague that poses an existential danger for businesses of all sizes vulnerable to an assault. Different iterations of ransomware like the CrySIS, WannaCry, Locky, SamSam and MongoLock cryptoworms have been replicating for a long time and still inflict harm. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, as well as additional unnamed malware, not only encrypt online data files but also infect all configured system protection mechanisms. Data replicated to the cloud can also be corrupted. In a vulnerable data protection solution, it can render automatic restoration useless and basically knocks the datacenter back to zero.

Retrieving programs and data following a crypto-ransomware intrusion becomes a sprint against time as the victim fights to stop lateral movement and eradicate the virus and to resume mission-critical activity. Since ransomware takes time to replicate, attacks are often launched during nights and weekends, when successful attacks may take longer to notice. This multiplies the difficulty of rapidly mobilizing and organizing a knowledgeable mitigation team.

Progent provides a variety of services for securing enterprises from crypto-ransomware attacks. Among these are team training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of next-generation security gateways with artificial intelligence capabilities from SentinelOne to discover and disable day-zero cyber attacks rapidly. Progent also offers the services of veteran crypto-ransomware recovery engineers with the track record and perseverance to rebuild a breached network as urgently as possible.

Progent's Ransomware Recovery Services
Subsequent to a ransomware attack, paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the codes to unencrypt any or all of your information. Kaspersky estimated that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms commonly range from fifteen to forty BTC ($120,000 and $400,000). This is significantly higher than the usual crypto-ransomware demands, which ZDNET averages to be in the range of $13,000. The alternative is to re-install the essential components of your Information Technology environment. Absent access to essential data backups, this calls for a wide range of skill sets, professional team management, and the willingness to work non-stop until the task is completed.

For two decades, Progent has offered professional Information Technology services for businesses in Phoenix and across the U.S. and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned top industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distros of Linux. Progent's cybersecurity engineers have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, and SANS GIAC. (See Progent's certifications). Progent also has expertise with financial management and ERP application software. This breadth of experience gives Progent the skills to quickly determine important systems and organize the remaining components of your network system following a crypto-ransomware penetration and assemble them into an operational system.

Progent's recovery team uses best of breed project management systems to coordinate the complex recovery process. Progent knows the urgency of acting quickly and together with a customer's management and IT staff to prioritize tasks and to put critical applications back on-line as soon as possible.

Client Story: A Successful Ransomware Penetration Restoration
A business hired Progent after their network system was penetrated by Ryuk ransomware. Ryuk is believed to have been launched by Northern Korean state cybercriminals, suspected of using techniques exposed from the United States National Security Agency. Ryuk seeks specific businesses with limited ability to sustain disruption and is among the most profitable versions of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in Chicago with around 500 employees. The Ryuk event had shut down all business operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the beginning of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (more than $200,000) and praying for good luck, but ultimately utilized Progent.


"I cannot thank you enough about the expertise Progent provided us during the most stressful period of (our) businesses survival. We most likely would have paid the criminal gangs if not for the confidence the Progent team gave us. That you were able to get our messaging and key servers back in less than a week was beyond my wildest dreams. Every single expert I spoke to or communicated with at Progent was amazingly focused on getting us operational and was working 24 by 7 to bail us out."

Progent worked with the customer to rapidly assess and assign priority to the critical services that needed to be recovered in order to resume company functions:

  • Microsoft Active Directory
  • Microsoft Exchange Server
  • Accounting and Manufacturing Software
To start, Progent adhered to Anti-virus event response best practices by isolating and removing active viruses. Progent then began the work of rebuilding Windows Active Directory, the foundation of enterprise networks built upon Microsoft Windows technology. Microsoft Exchange email will not work without Active Directory, and the businesses' MRP applications utilized SQL Server, which depends on Windows AD for security authorization to the data.

In less than two days, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then completed reinstallations and storage recovery of needed applications. All Exchange data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to collect non-encrypted OST files (Microsoft Outlook Offline Folder Files) on user PCs in order to recover mail messages. A recent off-line backup of the client's accounting/MRP systems made it possible to restore these essential applications back on-line. Although a lot of work still had to be done to recover totally from the Ryuk event, the most important services were returned to operations rapidly:


"For the most part, the manufacturing operation was never shut down and we produced all customer shipments."

Over the next couple of weeks important milestones in the recovery process were accomplished in tight collaboration between Progent consultants and the client:

  • In-house web applications were restored with no loss of information.
  • The MailStore Exchange Server with over four million archived emails was brought online and available for users.
  • CRM/Customer Orders/Invoices/Accounts Payable/AR/Inventory Control modules were 100 percent restored.
  • A new Palo Alto 850 firewall was installed.
  • Ninety percent of the user workstations were back into operation.

"A huge amount of what was accomplished those first few days is mostly a blur for me, but we will not forget the countless hours each and every one of your team put in to give us our company back. I have entrusted Progent for at least 10 years, maybe more, and each time Progent has come through and delivered as promised. This event was the most impressive ever."

Conclusion
A possible enterprise-killing disaster was dodged with results-oriented professionals, a wide array of IT skills, and close teamwork. Although in post mortem the ransomware virus incident described here should have been identified and blocked with advanced cyber security technology and recognized best practices, staff education, and appropriate security procedures for data backup and proper patching controls, the fact remains that state-sponsored hackers from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of experts has a proven track record in ransomware virus blocking, removal, and information systems recovery.


"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (and any others who were contributing), I'm grateful for letting me get rested after we made it through the initial fire. All of you did an incredible effort, and if anyone is visiting the Chicago area, a great meal is my treat!"

To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Phoenix a portfolio of online monitoring and security assessment services to assist you to minimize the threat from ransomware. These services incorporate next-generation AI technology to detect zero-day strains of ransomware that can get past traditional signature-based anti-virus solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring is an endpoint protection service that utilizes SentinelOne's cutting edge behavior machine learning tools to defend physical and virtual endpoint devices against modern malware attacks like ransomware and file-less exploits, which routinely escape legacy signature-based anti-virus tools. ProSight ASM safeguards on-premises and cloud-based resources and provides a unified platform to automate the complete malware attack lifecycle including blocking, detection, containment, cleanup, and forensics. Key capabilities include one-click rollback using Windows VSS and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

  • ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
    ProSight Enhanced Security Protection (ESP) services deliver economical multi-layer security for physical and virtual servers, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and modern behavior analysis for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP offers firewall protection, intrusion alarms, endpoint management, and web filtering via cutting-edge technologies incorporated within a single agent accessible from a unified console. Progent's security and virtualization experts can assist you to design and implement a ProSight ESP environment that addresses your company's specific needs and that helps you demonstrate compliance with government and industry data protection standards. Progent will help you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that require urgent action. Progent can also assist you to set up and verify a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange filtering.

  • ProSight Data Protection Services (DPS): Backup and Recovery Services
    Progent has worked with leading backup software companies to produce ProSight Data Protection Services, a selection of subscription-based offerings that provide backup-as-a-service (BaaS). ProSight DPS products automate and monitor your backup processes and enable non-disruptive backup and fast recovery of important files, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets you recover from data loss caused by hardware failures, natural disasters, fire, malware like ransomware, human mistakes, malicious insiders, or software glitches. Managed services in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent consultant can assist you to identify which of these fully managed services are most appropriate for your network.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of top data security vendors to deliver centralized management and world-class protection for all your inbound and outbound email. The hybrid architecture of Email Guard integrates cloud-based filtering with a local security gateway appliance to offer advanced defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's Cloud Protection Layer acts as a preliminary barricade and blocks the vast majority of unwanted email from reaching your security perimeter. This decreases your vulnerability to external attacks and conserves network bandwidth and storage. Email Guard's on-premises security gateway device provides a deeper level of analysis for inbound email. For outbound email, the onsite security gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also help Exchange Server to track and protect internal email that originates and ends within your corporate firewall. For more details, visit ProSight Email Guard spam and content filtering.

  • ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
    Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for smaller organizations to diagram, monitor, enhance and troubleshoot their connectivity hardware like routers, firewalls, and load balancers as well as servers, endpoints and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that network maps are kept updated, copies and manages the configuration of virtually all devices connected to your network, monitors performance, and generates notices when issues are discovered. By automating time-consuming management processes, ProSight WAN Watch can cut hours off ordinary chores such as making network diagrams, expanding your network, finding devices that require critical updates, or isolating performance bottlenecks. Learn more about ProSight WAN Watch network infrastructure monitoring and management consulting.

  • ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
    ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management technology to help keep your network operating efficiently by checking the state of critical assets that power your business network. When ProSight LAN Watch detects a problem, an alarm is sent immediately to your designated IT staff and your Progent consultant so all looming issues can be addressed before they can impact your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
    With ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected fault tolerant data center on a high-performance virtual host configured and managed by Progent's IT support experts. With the ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the apps. Because the system is virtualized, it can be moved easily to a different hardware solution without a time-consuming and difficult configuration process. With ProSight Virtual Hosting, your business is not tied one hosting service. Learn more details about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, update, retrieve and protect information about your IT infrastructure, procedures, applications, and services. You can quickly find passwords or serial numbers and be warned automatically about impending expirations of SSL certificates ,domains or warranties. By cleaning up and managing your IT infrastructure documentation, you can eliminate as much as half of time spent trying to find vital information about your IT network. ProSight IT Asset Management features a common repository for holding and sharing all documents related to managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT information. Whether you're making enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the information you need when you need it. Find out more about ProSight IT Asset Management service.

  • Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
    Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes cutting edge behavior-based analysis technology to guard endpoints and physical and virtual servers against modern malware attacks such as ransomware and file-less exploits, which routinely get by legacy signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and offers a single platform to automate the entire threat progression including protection, identification, containment, cleanup, and post-attack forensics. Key capabilities include single-click rollback with Windows VSS and automatic system-wide immunization against newly discovered attacks. Learn more about Progent's ransomware protection and recovery services.

  • Progent's Outsourced/Shared Call Desk: Call Center Managed Services
    Progent's Help Center services permit your IT team to outsource Help Desk services to Progent or divide activity for Service Desk support transparently between your internal network support team and Progent's nationwide roster of IT support engineers and subject matter experts. Progent's Shared Help Desk Service provides a seamless extension of your core support team. User interaction with the Help Desk, delivery of technical assistance, escalation, trouble ticket generation and tracking, efficiency metrics, and maintenance of the service database are consistent whether incidents are resolved by your internal network support group, by Progent's team, or by a combination. Learn more about Progent's outsourced/co-managed Help Desk services.

  • Progent's Patch Management: Software/Firmware Update Management Services
    Progent's managed services for software and firmware patch management offer businesses of any size a flexible and cost-effective alternative for assessing, testing, scheduling, implementing, and tracking software and firmware updates to your ever-evolving information network. Besides optimizing the protection and reliability of your IT environment, Progent's software/firmware update management services allow your IT staff to focus on more strategic initiatives and tasks that deliver the highest business value from your information network. Learn more about Progent's software/firmware update management services.

  • ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on (SSO)
    Progent's Duo MFA managed services utilize Cisco's Duo technology to defend against stolen passwords by using two-factor authentication (2FA). Duo enables one-tap identity verification on iOS, Google Android, and other personal devices. Using 2FA, when you sign into a secured application and give your password you are asked to verify your identity via a device that only you have and that is accessed using a different network channel. A broad range of out-of-band devices can be used for this added form of ID validation including an iPhone or Android or wearable, a hardware token, a landline phone, etc. You can register several verification devices. For details about ProSight Duo two-factor identity validation services, see Duo MFA two-factor authentication services for access security.

  • ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
    ProSight Reporting is a growing suite of in-depth management reporting plug-ins designed to integrate with the industry's top ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as spotty support follow-through or endpoints with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.
For Phoenix 24/7 Ransomware Cleanup Consultants, contact Progent at 800-462-8800 or go to Contact Progent.