Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware  Recovery ExpertsRansomware has become an escalating cyberplague that presents an extinction-level danger for businesses of all sizes vulnerable to an attack. Different iterations of ransomware like the Reveton, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for many years and continue to cause damage. The latest variants of ransomware like Ryuk and Hermes, plus daily as yet unnamed malware, not only do encryption of on-line data files but also infect most configured system protection mechanisms. Files synched to the cloud can also be ransomed. In a poorly architected environment, this can make automated recovery useless and effectively knocks the network back to zero.

Retrieving programs and data after a crypto-ransomware event becomes a sprint against time as the targeted business struggles to stop the spread and clear the crypto-ransomware and to resume business-critical operations. Since ransomware takes time to spread, penetrations are frequently launched on weekends and holidays, when successful penetrations tend to take more time to notice. This compounds the difficulty of promptly assembling and coordinating an experienced mitigation team.

Progent makes available a range of services for protecting enterprises from ransomware events. Among these are staff training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of the latest generation security appliances with AI capabilities to intelligently discover and suppress zero-day threats. Progent also provides the services of seasoned ransomware recovery professionals with the track record and perseverance to reconstruct a breached system as urgently as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a ransomware attack, even paying the ransom demands in Bitcoin cryptocurrency does not ensure that cyber criminals will provide the codes to unencrypt any of your files. Kaspersky Labs estimated that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms frequently range from fifteen to forty BTC ($120,000 and $400,000). This is well higher than the usual crypto-ransomware demands, which ZDNET estimates to be around $13,000. The other path is to setup from scratch the critical components of your Information Technology environment. Without access to complete data backups, this requires a broad complement of skills, well-coordinated team management, and the ability to work continuously until the recovery project is over.

For two decades, Progent has provided expert Information Technology services for businesses in Jersey City and across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP application software. This breadth of experience gives Progent the skills to quickly determine important systems and organize the remaining parts of your Information Technology system following a crypto-ransomware event and configure them into an operational network.

Progent's ransomware team of experts uses best of breed project management tools to coordinate the complicated restoration process. Progent knows the urgency of acting swiftly and in concert with a client's management and Information Technology team members to assign priority to tasks and to get critical services back on-line as fast as possible.

Client Story: A Successful Ransomware Virus Recovery
A client hired Progent after their network system was penetrated by Ryuk ransomware virus. Ryuk is believed to have been created by North Korean state sponsored cybercriminals, suspected of adopting technology leaked from the United States NSA organization. Ryuk targets specific companies with little room for disruption and is among the most profitable iterations of ransomware viruses. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business located in the Chicago metro area and has around 500 employees. The Ryuk penetration had disabled all business operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the beginning of the attack and were destroyed. The client was pursuing financing for paying the ransom (more than $200K) and hoping for good luck, but ultimately brought in Progent.


"I cannot say enough in regards to the support Progent gave us throughout the most fearful time of (our) businesses existence. We may have had to pay the Hackers except for the confidence the Progent team provided us. That you were able to get our e-mail and critical servers back online faster than five days was earth shattering. Each consultant I worked with or texted at Progent was amazingly focused on getting us back online and was working 24 by 7 on our behalf."

Progent worked together with the client to rapidly get our arms around and prioritize the mission critical applications that had to be restored in order to resume company functions:

  • Active Directory (AD)
  • Exchange Server
  • Accounting and Manufacturing Software
To get going, Progent adhered to ransomware event mitigation industry best practices by halting the spread and disinfecting systems. Progent then initiated the task of rebuilding Microsoft AD, the key technology of enterprise environments built upon Microsoft Windows technology. Microsoft Exchange email will not operate without Windows AD, and the client's MRP system leveraged SQL Server, which needs Windows AD for security authorization to the data.

In less than two days, Progent was able to rebuild Active Directory to its pre-virus state. Progent then assisted with setup and storage recovery on mission critical systems. All Exchange Server schema and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to collect intact OST data files (Outlook Email Off-Line Folder Files) on staff desktop computers to recover mail data. A recent off-line backup of the businesses accounting systems made them able to recover these vital applications back online for users. Although major work still had to be done to recover totally from the Ryuk attack, the most important systems were returned to operations rapidly:


"For the most part, the production line operation showed little impact and we produced all customer shipments."

Over the following few weeks important milestones in the recovery project were achieved in close cooperation between Progent consultants and the client:

  • Internal web applications were restored without losing any data.
  • The MailStore Exchange Server exceeding 4 million archived messages was brought on-line and available for users.
  • CRM/Product Ordering/Invoicing/AP/Accounts Receivables (AR)/Inventory Control capabilities were 100 percent functional.
  • A new Palo Alto 850 firewall was set up.
  • Most of the user desktops and notebooks were fully operational.

"A huge amount of what was accomplished those first few days is nearly entirely a fog for me, but we will not forget the countless hours each and every one of your team put in to give us our company back. Iíve been working together with Progent for the past ten years, possibly more, and every time Progent has outperformed my expectations and delivered as promised. This time was a testament to your capabilities."

Conclusion
A potential business extinction catastrophe was averted through the efforts of top-tier professionals, a broad range of technical expertise, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware incident detailed here should have been identified and blocked with current security systems and security best practices, staff training, and appropriate incident response procedures for data backup and applying software patches, the fact remains that state-sponsored cybercriminals from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's team of experts has extensive experience in ransomware virus defense, remediation, and information systems disaster recovery.


"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen and Tony (and any others that were contributing), thank you for letting me get some sleep after we made it over the initial fire. All of you did an fabulous job, and if anyone that helped is in the Chicago area, dinner is on me!"

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Jersey City a portfolio of online monitoring and security evaluation services designed to assist you to minimize your vulnerability to ransomware. These services utilize next-generation artificial intelligence technology to uncover zero-day variants of ransomware that can evade legacy signature-based security products.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring is an endpoint protection solution that incorporates cutting edge behavior-based machine learning technology to guard physical and virtual endpoints against modern malware assaults such as ransomware and file-less exploits, which easily escape traditional signature-matching AV products. ProSight ASM protects on-premises and cloud-based resources and offers a unified platform to address the entire threat lifecycle including filtering, identification, mitigation, remediation, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

  • ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Email Filtering
    Progent's ProSight Enhanced Security Protection managed services offer affordable in-depth security for physical servers and virtual machines, workstations, mobile devices, and Microsoft Exchange. ProSight ESP uses contextual security and modern behavior analysis for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP offers firewall protection, penetration alarms, device management, and web filtering through leading-edge tools packaged within one agent managed from a single control. Progent's data protection and virtualization consultants can help you to plan and implement a ProSight ESP deployment that addresses your organization's specific requirements and that allows you achieve and demonstrate compliance with legal and industry data protection standards. Progent will help you specify and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for immediate action. Progent can also help your company to install and verify a backup and restore solution such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.

  • ProSight Data Protection Services: Managed Backup and Disaster Recovery
    ProSight Data Protection Services offer small and medium-sized businesses an affordable end-to-end solution for reliable backup/disaster recovery. For a low monthly cost, ProSight DPS automates your backup activities and enables rapid restoration of critical files, apps and VMs that have become unavailable or damaged as a result of component breakdowns, software bugs, natural disasters, human mistakes, or malware attacks such as ransomware. ProSight Data Protection Services can help you back up, recover and restore files, folders, applications, system images, as well as Microsoft Hyper-V and VMware virtual machine images. Important data can be protected on the cloud, to an on-promises device, or to both. Progent's BDR specialists can provide world-class support to configure ProSight DPS to be compliant with regulatory requirements like HIPPA, FINRA, PCI and Safe Harbor and, whenever needed, can help you to recover your business-critical data. Learn more about ProSight Data Protection Services Managed Cloud Backup.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of top data security companies to provide centralized management and world-class protection for all your inbound and outbound email. The hybrid architecture of Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway device to provide complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's Cloud Protection Layer acts as a first line of defense and blocks most unwanted email from reaching your network firewall. This reduces your exposure to external attacks and saves system bandwidth and storage. Email Guard's on-premises gateway appliance provides a deeper level of inspection for inbound email. For outgoing email, the on-premises security gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The local gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends inside your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

  • ProSight WAN Watch: Infrastructure Management
    Progentís ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized businesses to map out, monitor, optimize and debug their connectivity appliances such as routers, firewalls, and wireless controllers plus servers, printers, client computers and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that network maps are always updated, copies and manages the configuration information of almost all devices on your network, monitors performance, and sends alerts when issues are detected. By automating tedious management and troubleshooting processes, ProSight WAN Watch can cut hours off common tasks such as network mapping, reconfiguring your network, locating appliances that need critical updates, or identifying the cause of performance bottlenecks. Learn more details about ProSight WAN Watch network infrastructure management services.

  • ProSight LAN Watch: Server and Desktop Monitoring and Management
    ProSight LAN Watch is Progentís server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management technology to keep your network running efficiently by tracking the health of vital assets that drive your information system. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your designated IT personnel and your Progent consultant so any looming problems can be resolved before they have a chance to impact productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
    With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual host set up and managed by Progent's network support experts. With the ProSight Virtual Hosting model, the customer owns the data, the OS platforms, and the apps. Because the environment is virtualized, it can be ported easily to an alternate hardware solution without a lengthy and technically risky configuration process. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, find and protect information related to your network infrastructure, processes, business apps, and services. You can instantly locate passwords or IP addresses and be alerted automatically about impending expirations of SSL certificates ,domains or warranties. By cleaning up and managing your IT documentation, you can eliminate up to half of time spent looking for critical information about your IT network. ProSight IT Asset Management features a common repository for holding and sharing all documents required for managing your network infrastructure such as standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT data. Whether youíre planning improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the data you require as soon as you need it. Read more about ProSight IT Asset Management service.
For Jersey City 24-7 Crypto-Ransomware Repair Experts, reach out to Progent at 800-993-9400 or go to Contact Progent.