24/7 Lima Urgent Crypto-Ransomware
Computer Malware Detection and Restoration Consulting

Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that represents an extinction-level danger for businesses of all sizes vulnerable to an attack. Different iterations of ransomware such as Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and continue to cause havoc. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, along with frequent as yet unnamed viruses, not only do encryption of on-line files but also infiltrate all configured system backup. Data replicated to the cloud can also be ransomed. In a poorly architected system, it can render any recovery impossible and basically sets the entire system back to square one.

Restoring services and information after a ransomware attack becomes a sprint against time as the targeted business fights to stop the spread and cleanup the crypto-ransomware and to resume business-critical operations. Due to the fact that ransomware takes time to move laterally, assaults are often launched during weekends and nights, when successful penetrations typically take more time to identify. This compounds the difficulty of quickly marshalling and organizing an experienced response team.

Progent makes available a range of solutions for protecting enterprises from crypto-ransomware attacks. Among these are team education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to deployment of modern security solutions with AI technology from SentinelOne to detect and suppress day-zero cyber threats rapidly. Progent in addition provides the assistance of seasoned ransomware recovery professionals with the talent and perseverance to rebuild a breached system as soon as possible.

Progent's Crypto-Ransomware Recovery Help
After a ransomware attack, sending the ransom in Bitcoin cryptocurrency does not guarantee that distant criminals will return the needed keys to decipher any or all of your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is greatly above the typical ransomware demands, which ZDNET averages to be around $13,000. The fallback is to re-install the key parts of your Information Technology environment. Absent the availability of full data backups, this requires a wide complement of skills, well-coordinated project management, and the willingness to work continuously until the task is done.

For decades, Progent has made available certified expert IT services for companies in Lima and across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned high-level industry certifications in key technologies such as Microsoft, Cisco, VMware, and popular distros of Linux. Progent's security experts have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, and GIAC. (See Progent's certifications). Progent also has experience in financial management and ERP software solutions. This breadth of experience affords Progent the skills to quickly determine critical systems and consolidate the remaining components of your network environment following a ransomware event and configure them into a functioning network.

Progent's security group has state-of-the-art project management applications to orchestrate the sophisticated recovery process. Progent knows the urgency of working rapidly and in concert with a client's management and Information Technology staff to prioritize tasks and to get essential applications back on line as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Penetration Restoration
A small business engaged Progent after their organization was brought down by Ryuk ransomware. Ryuk is believed to have been launched by North Korean state sponsored cybercriminals, possibly adopting algorithms leaked from America's NSA organization. Ryuk attacks specific businesses with little or no ability to sustain operational disruption and is one of the most lucrative versions of crypto-ransomware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in the Chicago metro area with around 500 staff members. The Ryuk attack had shut down all essential operations and manufacturing processes. The majority of the client's information backups had been on-line at the time of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (in excess of $200K) and praying for good luck, but ultimately reached out to Progent.

Progent worked with the client to quickly get our arms around and assign priority to the mission critical elements that needed to be recovered to make it possible to resume business functions:

• Microsoft Active Directory
• Electronic Messaging
• Accounting/MRP

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then helped perform setup and hard drive recovery of mission critical systems. All Exchange ties and attributes were intact, which accelerated the restore of Exchange. Progent was also able to locate non-encrypted OST files (Outlook Email Off-Line Folder Files) on various workstations and laptops in order to recover email messages. A not too old off-line backup of the client's financials/ERP systems made them able to restore these required programs back available to users. Although major work needed to be completed to recover completely from the Ryuk attack, critical systems were restored rapidly:

During the next month critical milestones in the recovery process were accomplished through tight cooperation between Progent engineers and the client:

• In-house web applications were restored with no loss of data.
• The MailStore Exchange Server exceeding four million historical emails was spun up and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were fully functional.
• A new Palo Alto 850 security appliance was set up and programmed.
• 90% of the user PCs were back into operation.

Conclusion
A probable business disaster was dodged with hard-working experts, a broad spectrum of subject matter expertise, and close collaboration. Although in hindsight the ransomware attack detailed here should have been identified and blocked with up-to-date security technology and recognized best practices, team training, and appropriate incident response procedures for information protection and keeping systems up to date with security patches, the reality is that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incident, remember that Progent's team of experts has substantial experience in ransomware virus defense, cleanup, and file disaster recovery.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Lima a range of remote monitoring and security evaluation services designed to help you to reduce the threat from ransomware. These services utilize modern artificial intelligence capability to detect new variants of ransomware that can get past legacy signature-based security products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that incorporates SentinelOne's cutting edge behavior machine learning tools to guard physical and virtual endpoints against new malware attacks like ransomware and email phishing, which routinely escape traditional signature-based AV products. ProSight Active Security Monitoring safeguards on-premises and cloud resources and offers a single platform to address the complete threat lifecycle including blocking, identification, mitigation, cleanup, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver affordable in-depth protection for physical servers and VMs, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced heuristics for continuously monitoring and responding to security threats from all vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, endpoint control, and web filtering through leading-edge tools incorporated within a single agent accessible from a single control. Progent's security and virtualization experts can assist you to plan and implement a ProSight ESP environment that addresses your company's unique needs and that allows you demonstrate compliance with government and industry data protection standards. Progent will help you define and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that call for immediate action. Progent's consultants can also assist you to install and test a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover quickly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange filtering.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup technology companies to produce ProSight Data Protection Services, a family of offerings that provide backup-as-a-service. ProSight DPS products manage and monitor your backup processes and enable transparent backup and rapid restoration of critical files, applications, system images, plus virtual machines. ProSight DPS lets your business recover from data loss caused by hardware breakdown, natural calamities, fire, malware such as ransomware, human mistakes, malicious insiders, or software bugs. Managed backup services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top information security companies to deliver centralized control and world-class protection for your email traffic. The hybrid architecture of Email Guard combines a Cloud Protection Layer with an on-premises security gateway appliance to offer complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The Cloud Protection Layer serves as a preliminary barricade and keeps most unwanted email from making it to your security perimeter. This decreases your exposure to inbound threats and conserves network bandwidth and storage. Email Guard's onsite security gateway device provides a deeper layer of inspection for incoming email. For outbound email, the on-premises security gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to monitor and protect internal email traffic that stays inside your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller organizations to diagram, monitor, reconfigure and troubleshoot their networking hardware such as routers, firewalls, and load balancers as well as servers, printers, client computers and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, WAN Watch ensures that infrastructure topology maps are always current, copies and displays the configuration information of virtually all devices on your network, tracks performance, and sends alerts when issues are detected. By automating complex management activities, WAN Watch can knock hours off common chores such as making network diagrams, reconfiguring your network, finding devices that need important software patches, or resolving performance problems. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management techniques to help keep your network operating efficiently by tracking the state of critical assets that power your business network. When ProSight LAN Watch uncovers an issue, an alert is transmitted automatically to your specified IT staff and your assigned Progent engineering consultant so that all potential problems can be addressed before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual host configured and managed by Progent's IT support experts. With the ProSight Virtual Hosting model, the client owns the data, the operating system software, and the applications. Since the environment is virtualized, it can be ported easily to a different hosting solution without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not tied one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, retrieve and safeguard data about your IT infrastructure, processes, applications, and services. You can quickly find passwords or serial numbers and be warned automatically about upcoming expirations of SSLs or warranties. By updating and organizing your network documentation, you can save up to half of time spent trying to find critical information about your IT network. ProSight IT Asset Management features a centralized repository for holding and collaborating on all documents required for managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and relating IT data. Whether you're making enhancements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the knowledge you require when you need it. Find out more about ProSight IT Asset Management service.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior-based machine learning technology to defend endpoints as well as servers and VMs against new malware assaults such as ransomware and email phishing, which easily evade traditional signature-based anti-virus products. Progent Active Security Monitoring services safeguard local and cloud-based resources and provides a single platform to automate the complete threat progression including protection, detection, mitigation, remediation, and post-attack forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Read more about Progent's ransomware defense and cleanup services.

• Outsourced/Co-managed Call Center: Help Desk Managed Services
  Progent's Support Desk services enable your information technology staff to offload Help Desk services to Progent or split responsibilities for Service Desk support transparently between your in-house support staff and Progent's extensive pool of IT support technicians, engineers and subject matter experts. Progent's Co-managed Service Desk offers a transparent supplement to your corporate network support group. Client interaction with the Help Desk, provision of support, problem escalation, trouble ticket creation and updates, performance metrics, and maintenance of the service database are consistent whether incidents are resolved by your in-house IT support resources, by Progent's team, or by a combination. Read more about Progent's outsourced/shared Call Center services.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a versatile and cost-effective solution for assessing, validating, scheduling, applying, and tracking updates to your ever-evolving information network. Besides optimizing the protection and functionality of your computer network, Progent's patch management services allow your in-house IT staff to focus on more strategic projects and tasks that deliver maximum business value from your information network. Read more about Progent's software/firmware update management services.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans utilize Cisco's Duo technology to defend against compromised passwords by using two-factor authentication. Duo supports one-tap identity verification with Apple iOS, Google Android, and other out-of-band devices. With 2FA, whenever you log into a secured application and give your password you are requested to confirm who you are on a device that only you have and that is accessed using a separate network channel. A broad range of devices can be used as this added means of authentication including an iPhone or Android or watch, a hardware token, a landline phone, etc. You may designate several validation devices. To find out more about ProSight Duo two-factor identity authentication services, refer to Duo MFA two-factor authentication (2FA) services for access security.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of in-depth reporting tools created to work with the industry's leading ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like inconsistent support follow-up or endpoints with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.