San Diego UCSD 24-Hour Critical Crypto
Infection Identification and Repair Help

Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become an escalating cyberplague that presents an extinction-level threat for businesses poorly prepared for an assault. Versions of ransomware like the CrySIS, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for years and continue to inflict harm. Modern strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, along with frequent unnamed malware, not only do encryption of on-line data files but also infect any configured system backups. Data synchronized to the cloud can also be rendered useless. In a poorly designed data protection solution, this can render automatic restore operations hopeless and effectively knocks the entire system back to zero.

Recovering services and data after a crypto-ransomware outage becomes a race against the clock as the targeted business struggles to stop the spread and clear the ransomware and to restore mission-critical activity. Since ransomware takes time to move laterally, penetrations are often launched during weekends and nights, when successful attacks may take more time to uncover. This multiplies the difficulty of promptly marshalling and organizing a knowledgeable mitigation team.

Progent makes available a variety of solutions for protecting enterprises from ransomware events. These include staff education to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of modern security appliances with artificial intelligence capabilities from SentinelOne to discover and extinguish new threats intelligently. Progent also offers the services of seasoned ransomware recovery consultants with the track record and commitment to re-deploy a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Following a crypto-ransomware attack, sending the ransom in Bitcoin cryptocurrency does not ensure that criminal gangs will provide the needed codes to decrypt all your information. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is significantly higher than the usual ransomware demands, which ZDNET determined to be approximately $13,000. The other path is to re-install the key elements of your IT environment. Without access to essential system backups, this requires a wide range of skills, well-coordinated team management, and the willingness to work non-stop until the recovery project is finished.

For decades, Progent has made available certified expert IT services for businesses in San Diego UCSD and across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have attained high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distros of Linux. Progent's cybersecurity engineers have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP software solutions. This breadth of expertise affords Progent the ability to rapidly identify critical systems and re-organize the surviving parts of your Information Technology system following a ransomware penetration and configure them into an operational system.

Progent's security team of experts utilizes powerful project management systems to orchestrate the complicated restoration process. Progent appreciates the urgency of acting quickly and in unison with a client's management and IT resources to assign priority to tasks and to put critical services back on line as soon as possible.

Customer Case Study: A Successful Ransomware Incident Restoration
A customer engaged Progent after their network was brought down by Ryuk ransomware. Ryuk is believed to have been launched by North Korean state criminal gangs, possibly using techniques leaked from the U.S. NSA organization. Ryuk seeks specific businesses with little or no room for operational disruption and is one of the most lucrative incarnations of ransomware viruses. Major victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in Chicago and has about 500 workers. The Ryuk event had frozen all company operations and manufacturing processes. Most of the client's data protection had been on-line at the time of the attack and were damaged. The client was pursuing financing for paying the ransom (more than $200,000) and hoping for the best, but in the end brought in Progent.

Progent worked together with the client to rapidly assess and prioritize the key systems that needed to be addressed to make it possible to restart company operations:

• Active Directory
• E-Mail
• Financials/MRP

In less than 48 hours, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then assisted with reinstallations and storage recovery of key systems. All Exchange data and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to assemble non-encrypted OST files (Microsoft Outlook Off-Line Folder Files) on various PCs and laptops to recover email messages. A recent offline backup of the businesses financials/ERP software made it possible to recover these essential applications back available to users. Although a large amount of work remained to recover totally from the Ryuk damage, critical systems were returned to operations rapidly:

Throughout the following couple of weeks key milestones in the restoration process were accomplished in close collaboration between Progent engineers and the client:

• In-house web applications were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server exceeding four million historical emails was spun up and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control modules were completely operational.
• A new Palo Alto 850 security appliance was installed and configured.
• Most of the desktops and laptops were back into operation.

Conclusion
A possible business disaster was dodged due to top-tier professionals, a broad spectrum of subject matter expertise, and close collaboration. Although in hindsight the ransomware virus penetration detailed here could have been shut down with modern cyber security technology solutions and recognized best practices, team education, and appropriate security procedures for backup and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware penetration, feel confident that Progent's roster of experts has extensive experience in crypto-ransomware virus defense, remediation, and file recovery.

To review or download a PDF version of this case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in San Diego UCSD a portfolio of remote monitoring and security evaluation services designed to help you to minimize your vulnerability to crypto-ransomware. These services include modern AI technology to detect zero-day strains of ransomware that are able to evade legacy signature-based anti-virus products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which routinely get by legacy signature-matching AV tools. ProSight ASM safeguards local and cloud-based resources and provides a unified platform to manage the entire threat progression including filtering, identification, containment, remediation, and forensics. Key capabilities include one-click rollback with Windows VSS and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection managed services deliver economical multi-layer protection for physical and virtual servers, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and advanced heuristics for round-the-clock monitoring and reacting to security assaults from all vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, endpoint management, and web filtering via cutting-edge tools packaged within a single agent accessible from a unified control. Progent's data protection and virtualization experts can assist you to plan and implement a ProSight ESP environment that meets your company's unique needs and that helps you prove compliance with legal and industry data protection standards. Progent will help you define and configure policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that call for urgent attention. Progent's consultants can also help you to set up and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange filtering.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has worked with advanced backup/restore technology providers to create ProSight Data Protection Services, a family of management offerings that deliver backup-as-a-service. ProSight DPS services manage and track your data backup operations and allow non-disruptive backup and fast recovery of critical files/folders, apps, system images, plus VMs. ProSight DPS helps your business recover from data loss resulting from hardware failures, natural calamities, fire, malware such as ransomware, user error, ill-intentioned employees, or software bugs. Managed services in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent expert can help you to identify which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of top data security companies to provide centralized management and world-class security for all your email traffic. The powerful architecture of Email Guard managed service integrates cloud-based filtering with a local gateway appliance to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The cloud filter serves as a preliminary barricade and blocks most unwanted email from reaching your security perimeter. This decreases your vulnerability to external attacks and conserves network bandwidth and storage space. Email Guard's on-premises security gateway appliance adds a deeper layer of inspection for incoming email. For outbound email, the local security gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also help Exchange Server to track and protect internal email that originates and ends inside your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for smaller businesses to map, track, optimize and troubleshoot their connectivity appliances like switches, firewalls, and access points plus servers, printers, client computers and other devices. Using cutting-edge RMM technology, ProSight WAN Watch makes sure that network diagrams are kept current, copies and manages the configuration of virtually all devices connected to your network, monitors performance, and sends alerts when problems are discovered. By automating tedious management and troubleshooting activities, ProSight WAN Watch can knock hours off ordinary tasks like making network diagrams, expanding your network, finding appliances that require critical updates, or isolating performance problems. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management techniques to keep your network running at peak levels by checking the health of vital computers that power your information system. When ProSight LAN Watch detects a problem, an alarm is sent automatically to your specified IT staff and your assigned Progent engineering consultant so all looming issues can be resolved before they have a chance to disrupt productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual host set up and maintained by Progent's network support experts. Under the ProSight Virtual Hosting model, the client retains ownership of the data, the operating system software, and the apps. Since the environment is virtualized, it can be moved easily to an alternate hardware environment without requiring a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, find and protect data related to your network infrastructure, procedures, applications, and services. You can quickly locate passwords or serial numbers and be warned about impending expirations of SSLs ,domains or warranties. By cleaning up and managing your IT infrastructure documentation, you can eliminate up to half of time wasted searching for vital information about your network. ProSight IT Asset Management features a centralized repository for holding and collaborating on all documents related to managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and relating IT information. Whether you're making improvements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the data you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior-based analysis tools to defend endpoint devices and physical and virtual servers against modern malware assaults like ransomware and file-less exploits, which routinely get by traditional signature-based anti-virus tools. Progent ASM services safeguard on-premises and cloud-based resources and provides a single platform to automate the entire threat lifecycle including blocking, infiltration detection, containment, cleanup, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered attacks. Learn more about Progent's ransomware protection and recovery services.

• Outsourced/Co-managed Call Desk: Call Center Managed Services
  Progent's Support Desk managed services permit your information technology group to offload Help Desk services to Progent or split activity for Help Desk services seamlessly between your internal network support team and Progent's nationwide pool of IT service engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a smooth extension of your core network support organization. User access to the Service Desk, delivery of support, escalation, ticket creation and updates, performance metrics, and management of the support database are consistent whether incidents are resolved by your internal network support group, by Progent, or a mix of the two. Read more about Progent's outsourced/co-managed Help Desk services.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide businesses of all sizes a flexible and affordable alternative for assessing, testing, scheduling, applying, and tracking software and firmware updates to your ever-evolving information network. In addition to optimizing the protection and reliability of your IT network, Progent's software/firmware update management services permit your in-house IT team to focus on line-of-business projects and activities that deliver the highest business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication. Duo supports single-tap identity verification on iOS, Google Android, and other out-of-band devices. Using 2FA, whenever you log into a protected application and enter your password you are asked to confirm who you are on a unit that only you have and that is accessed using a different ("out-of-band") network channel. A broad range of devices can be used as this second form of ID validation including an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You may register several validation devices. To find out more about Duo two-factor identity validation services, see Duo MFA two-factor authentication services for access security.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time management reporting utilities created to work with the industry's top ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues like spotty support follow-through or machines with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.