Ransomware : Your Crippling Information Technology Catastrophe
Ransomware  Remediation ConsultantsRansomware has become a too-frequent cyberplague that presents an existential threat for organizations unprepared for an assault. Multiple generations of ransomware like the CryptoLocker, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for a long time and still cause havoc. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as daily as yet unnamed viruses, not only encrypt online data but also infect many configured system backup. Files synchronized to off-site disaster recovery sites can also be corrupted. In a vulnerable system, it can render automatic recovery hopeless and basically knocks the network back to square one.

Getting back on-line applications and information following a ransomware event becomes a race against time as the targeted business tries its best to stop the spread and clear the virus and to restore enterprise-critical operations. Because ransomware requires time to move laterally, assaults are usually launched on weekends and holidays, when successful attacks in many cases take longer to detect. This compounds the difficulty of promptly marshalling and coordinating a capable mitigation team.

Progent makes available an assortment of support services for securing businesses from ransomware penetrations. Among these are staff training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus installation of the latest generation security solutions with machine learning capabilities from SentinelOne to discover and suppress zero-day cyber threats automatically. Progent in addition provides the assistance of expert crypto-ransomware recovery consultants with the talent and commitment to re-deploy a compromised environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Services
After a ransomware event, sending the ransom demands in Bitcoin cryptocurrency does not provide any assurance that criminal gangs will respond with the needed keys to unencrypt all your files. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never recovered their files even after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is well higher than the average crypto-ransomware demands, which ZDNET estimates to be approximately $13,000. The fallback is to re-install the critical components of your IT environment. Without access to full information backups, this requires a broad range of skill sets, professional team management, and the willingness to work continuously until the job is done.

For two decades, Progent has offered expert IT services for companies in Colorado Springs and throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded high-level certifications in important technologies including Microsoft, Cisco, VMware, and popular distros of Linux. Progent's security specialists have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, and GIAC. (Refer to Progent's certifications). Progent in addition has expertise in accounting and ERP software solutions. This breadth of expertise provides Progent the skills to knowledgably identify necessary systems and organize the surviving pieces of your Information Technology environment after a crypto-ransomware event and configure them into a functioning system.

Progent's recovery group has best of breed project management applications to coordinate the sophisticated restoration process. Progent appreciates the importance of working swiftly and together with a customer's management and Information Technology staff to prioritize tasks and to put essential systems back on-line as fast as possible.

Customer Case Study: A Successful Ransomware Virus Restoration
A business hired Progent after their network system was crashed by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state sponsored cybercriminals, possibly adopting technology exposed from the United States NSA organization. Ryuk goes after specific companies with limited ability to sustain disruption and is one of the most profitable examples of ransomware. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business headquartered in the Chicago metro area and has around 500 staff members. The Ryuk event had frozen all essential operations and manufacturing processes. The majority of the client's backups had been directly accessible at the start of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom demand (more than two hundred thousand dollars) and praying for good luck, but ultimately made the decision to use Progent.


"I cannot say enough in regards to the care Progent gave us during the most critical time of (our) businesses life. We most likely would have paid the hackers behind this attack except for the confidence the Progent team provided us. That you could get our messaging and key servers back on-line sooner than five days was something I thought impossible. Every single consultant I got help from or messaged at Progent was absolutely committed on getting our system up and was working day and night to bail us out."

Progent worked with the client to rapidly assess and prioritize the mission critical elements that needed to be restored to make it possible to resume company operations:

  • Active Directory (AD)
  • Electronic Mail
  • MRP System
To begin, Progent adhered to ransomware incident response industry best practices by halting the spread and cleaning up infected systems. Progent then initiated the process of bringing back online Microsoft AD, the key technology of enterprise systems built on Microsoft technology. Microsoft Exchange Server email will not operate without Windows AD, and the customer's MRP applications used Microsoft SQL Server, which needs Active Directory for access to the databases.

Within 2 days, Progent was able to rebuild Active Directory to its pre-virus state. Progent then accomplished reinstallations and hard drive recovery of key servers. All Microsoft Exchange Server schema and configuration information were intact, which facilitated the rebuild of Exchange. Progent was able to locate intact OST files (Outlook Email Off-Line Data Files) on user workstations and laptops to recover mail data. A not too old off-line backup of the client's financials/ERP systems made it possible to recover these vital programs back on-line. Although a large amount of work needed to be completed to recover fully from the Ryuk virus, core services were returned to operations rapidly:


"For the most part, the production manufacturing operation ran fairly normal throughout and we made all customer sales."

During the next couple of weeks key milestones in the recovery process were completed in tight cooperation between Progent team members and the client:

  • Self-hosted web applications were returned to operation without losing any data.
  • The MailStore Exchange Server exceeding four million archived emails was spun up and accessible to users.
  • CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory capabilities were 100 percent functional.
  • A new Palo Alto Networks 850 firewall was brought on-line.
  • Most of the user workstations were operational.

"A lot of what was accomplished those first few days is nearly entirely a blur for me, but I will not forget the care all of the team put in to give us our business back. I've been working together with Progent for the past ten years, maybe more, and every time I needed help Progent has shined and delivered. This time was the most impressive ever."

Conclusion
A likely business-killing disaster was evaded with dedicated experts, a broad spectrum of IT skills, and tight collaboration. Although in post mortem the crypto-ransomware incident detailed here could have been identified and stopped with advanced cyber security technology and ISO/IEC 27001 best practices, user training, and well designed security procedures for information protection and applying software patches, the fact remains that government-sponsored cybercriminals from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's roster of professionals has proven experience in ransomware virus defense, cleanup, and information systems recovery.


"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (and any others that were involved), I'm grateful for making it so I could get some sleep after we got over the most critical parts. Everyone did an fabulous job, and if any of your guys is around the Chicago area, dinner is my treat!"

To read or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Colorado Springs a portfolio of remote monitoring and security assessment services to assist you to reduce the threat from ransomware. These services include next-generation machine learning technology to uncover new strains of ransomware that can evade traditional signature-based anti-virus solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior-based machine learning tools to defend physical and virtual endpoint devices against new malware attacks like ransomware and file-less exploits, which routinely get by legacy signature-based AV products. ProSight ASM safeguards local and cloud-based resources and offers a unified platform to manage the complete malware attack progression including protection, identification, containment, cleanup, and forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

  • ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
    Progent's ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable in-depth protection for physical and virtual servers, desktops, smartphones, and Exchange Server. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and responding to security assaults from all attack vectors. ProSight ESP offers firewall protection, intrusion alerts, device management, and web filtering through cutting-edge technologies packaged within one agent managed from a single console. Progent's security and virtualization consultants can help your business to design and implement a ProSight ESP deployment that addresses your company's unique needs and that helps you prove compliance with legal and industry data security standards. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that call for urgent attention. Progent can also help your company to install and verify a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can get back in business rapidly from a destructive cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange email filtering.

  • ProSight Data Protection Services: Backup and Disaster Recovery Services
    Progent has worked with advanced backup/restore technology companies to produce ProSight Data Protection Services, a selection of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS services automate and track your backup operations and allow transparent backup and rapid recovery of critical files, apps, images, plus VMs. ProSight DPS lets you recover from data loss resulting from equipment breakdown, natural disasters, fire, cyber attacks like ransomware, human mistakes, ill-intentioned insiders, or software bugs. Managed backup services available in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these managed backup services are best suited for your IT environment.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top data security vendors to deliver web-based management and world-class protection for all your inbound and outbound email. The powerful architecture of Email Guard combines cloud-based filtering with a local security gateway device to offer complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's Cloud Protection Layer acts as a first line of defense and blocks most unwanted email from making it to your security perimeter. This reduces your exposure to inbound threats and conserves network bandwidth and storage space. Email Guard's onsite security gateway appliance adds a further level of analysis for inbound email. For outbound email, the local gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends within your security perimeter. For more details, visit ProSight Email Guard spam and content filtering.

  • ProSight WAN Watch: Infrastructure Remote Monitoring and Management
    Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized organizations to diagram, track, optimize and troubleshoot their networking appliances such as routers and switches, firewalls, and wireless controllers as well as servers, client computers and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network diagrams are kept updated, copies and manages the configuration of almost all devices on your network, monitors performance, and sends notices when problems are discovered. By automating time-consuming management processes, ProSight WAN Watch can cut hours off ordinary chores like network mapping, expanding your network, locating appliances that require critical updates, or resolving performance bottlenecks. Find out more details about ProSight WAN Watch network infrastructure monitoring and management services.

  • ProSight LAN Watch: Server and Desktop Monitoring
    ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management techniques to help keep your network operating efficiently by tracking the health of critical assets that drive your business network. When ProSight LAN Watch uncovers a problem, an alarm is sent immediately to your designated IT management staff and your Progent consultant so that any looming problems can be resolved before they have a chance to impact your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
    With ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual machine host set up and managed by Progent's IT support experts. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the OS platforms, and the apps. Since the system is virtualized, it can be moved immediately to an alternate hardware environment without requiring a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not tied one hosting service. Find out more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, retrieve and protect data related to your IT infrastructure, procedures, applications, and services. You can instantly find passwords or IP addresses and be alerted automatically about upcoming expirations of SSLs ,domains or warranties. By updating and organizing your network documentation, you can save as much as half of time spent looking for critical information about your network. ProSight IT Asset Management includes a common location for storing and sharing all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT information. Whether you're making improvements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the knowledge you require when you need it. Read more about Progent's ProSight IT Asset Management service.

  • Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
    Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates next generation behavior-based analysis technology to guard endpoints as well as servers and VMs against new malware assaults such as ransomware and email phishing, which routinely evade traditional signature-based AV products. Progent Active Security Monitoring services protect local and cloud-based resources and offers a unified platform to address the entire threat progression including protection, identification, mitigation, cleanup, and forensics. Key features include one-click rollback using Windows VSS and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and recovery services.

  • Progent's Outsourced/Shared Help Center: Help Desk Managed Services
    Progent's Support Center managed services permit your IT staff to offload Support Desk services to Progent or divide activity for Service Desk support transparently between your internal support staff and Progent's nationwide pool of certified IT service engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a smooth supplement to your internal IT support staff. End user interaction with the Service Desk, delivery of support services, issue escalation, trouble ticket generation and updates, efficiency measurement, and management of the service database are cohesive whether incidents are taken care of by your corporate network support staff, by Progent's team, or both. Find out more about Progent's outsourced/shared Service Center services.

  • Patch Management: Patch Management Services
    Progent's managed services for patch management offer businesses of any size a flexible and affordable alternative for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your dynamic IT network. In addition to optimizing the protection and functionality of your IT network, Progent's software/firmware update management services free up time for your IT staff to concentrate on more strategic initiatives and activities that derive maximum business value from your information network. Read more about Progent's patch management services.

  • ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on
    Progent's Duo authentication services incorporate Cisco's Duo cloud technology to defend against stolen passwords by using two-factor authentication (2FA). Duo enables single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. Using Duo 2FA, whenever you log into a secured application and give your password you are requested to verify who you are on a device that only you have and that uses a separate network channel. A broad selection of devices can be used as this second means of authentication including an iPhone or Android or wearable, a hardware token, a landline phone, etc. You may register multiple verification devices. To find out more about ProSight Duo identity authentication services, go to Duo MFA two-factor authentication services for access security.

  • ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
    ProSight Reporting is an expanding line of real-time management reporting utilities designed to work with the industry's top ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as spotty support follow-up or machines with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.
For 24-7 Colorado Springs Crypto-Ransomware Repair Services, call Progent at 800-462-8800 or go to Contact Progent.