Ransomware : Your Worst IT Disaster
Ransomware  Remediation ExpertsRansomware has become a too-frequent cyber pandemic that presents an extinction-level danger for businesses unprepared for an attack. Versions of ransomware like the Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been circulating for many years and still cause damage. Modern variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with additional as yet unnamed viruses, not only do encryption of online files but also infiltrate any configured system protection mechanisms. Data replicated to off-site disaster recovery sites can also be ransomed. In a poorly designed data protection solution, it can render automatic restore operations impossible and basically knocks the datacenter back to square one.

Retrieving services and data following a ransomware event becomes a sprint against the clock as the targeted business fights to contain the damage and remove the ransomware and to resume business-critical activity. Since crypto-ransomware needs time to replicate, attacks are often launched at night, when successful penetrations may take longer to recognize. This multiplies the difficulty of rapidly marshalling and orchestrating a knowledgeable mitigation team.

Progent has a range of solutions for protecting organizations from ransomware attacks. These include staff training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of modern security gateways with machine learning capabilities from SentinelOne to detect and extinguish day-zero cyber attacks intelligently. Progent also provides the assistance of expert crypto-ransomware recovery engineers with the skills and commitment to restore a breached system as quickly as possible.

Progent's Ransomware Recovery Help
Following a ransomware penetration, even paying the ransom demands in Bitcoin cryptocurrency does not guarantee that merciless criminals will provide the needed keys to decrypt all your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their information even after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is significantly above the typical ransomware demands, which ZDNET estimates to be around $13,000. The other path is to setup from scratch the critical elements of your Information Technology environment. Without access to essential information backups, this calls for a broad range of skills, professional team management, and the capability to work continuously until the recovery project is done.

For two decades, Progent has provided professional IT services for companies in Detroit and throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned top industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized certifications including CISM, CISSP, ISACA CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of expertise affords Progent the capability to knowledgably ascertain necessary systems and integrate the remaining pieces of your Information Technology system following a crypto-ransomware penetration and assemble them into an operational system.

Progent's security team utilizes powerful project management systems to orchestrate the sophisticated restoration process. Progent appreciates the importance of working rapidly and in concert with a customer's management and Information Technology staff to prioritize tasks and to put the most important systems back on-line as fast as possible.

Case Study: A Successful Ransomware Penetration Restoration
A customer hired Progent after their organization was taken over by Ryuk ransomware. Ryuk is generally considered to have been created by Northern Korean state criminal gangs, possibly adopting strategies exposed from the United States NSA organization. Ryuk attacks specific businesses with little tolerance for disruption and is among the most profitable versions of ransomware. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturer located in Chicago and has about 500 staff members. The Ryuk intrusion had paralyzed all company operations and manufacturing capabilities. The majority of the client's data backups had been directly accessible at the beginning of the attack and were damaged. The client considered paying the ransom demand (more than $200K) and hoping for good luck, but ultimately called Progent.


"I can't say enough about the help Progent provided us during the most critical time of (our) company's survival. We would have paid the cyber criminals if not for the confidence the Progent team gave us. The fact that you could get our messaging and important applications back on-line in less than 1 week was incredible. Every single person I interacted with or texted at Progent was laser focused on getting us operational and was working breakneck pace to bail us out."

Progent worked together with the customer to rapidly assess and assign priority to the most important areas that had to be recovered in order to restart business operations:

  • Microsoft Active Directory
  • E-Mail
  • MRP System
To start, Progent followed Anti-virus incident mitigation industry best practices by halting the spread and clearing infected systems. Progent then started the work of recovering Microsoft AD, the foundation of enterprise networks built upon Microsoft technology. Microsoft Exchange Server messaging will not work without AD, and the client's accounting and MRP software used SQL Server, which requires Windows AD for security authorization to the data.

In less than 2 days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then completed reinstallations and storage recovery of mission critical servers. All Exchange ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to find intact OST files (Outlook Email Offline Data Files) on user PCs to recover email information. A not too old offline backup of the client's manufacturing systems made it possible to restore these required applications back online for users. Although a large amount of work remained to recover completely from the Ryuk damage, critical systems were recovered rapidly:


"For the most part, the production manufacturing operation never missed a beat and we made all customer deliverables."

Over the next month critical milestones in the recovery process were accomplished in close collaboration between Progent engineers and the customer:

  • Self-hosted web sites were brought back up without losing any information.
  • The MailStore Exchange Server exceeding 4 million archived messages was brought on-line and available for users.
  • CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory functions were completely recovered.
  • A new Palo Alto 850 security appliance was deployed.
  • Most of the user workstations were functioning as before the incident.

"So much of what went on those first few days is nearly entirely a fog for me, but I will not soon forget the care all of you put in to give us our business back. I have trusted Progent for the past 10 years, maybe more, and each time Progent has come through and delivered as promised. This event was a life saver."

Conclusion
A probable enterprise-killing catastrophe was evaded through the efforts of dedicated professionals, a wide spectrum of technical expertise, and tight collaboration. Although in retrospect the ransomware virus attack detailed here could have been stopped with up-to-date cyber security solutions and best practices, staff education, and appropriate incident response procedures for backup and applying software patches, the reality is that state-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware attack, remember that Progent's team of experts has a proven track record in ransomware virus blocking, cleanup, and data disaster recovery.


"So, to Darrin, Matt, Aaron, Dan, Jesse, Arnaud, Allen, Tony and Chris (and any others that were contributing), thank you for letting me get rested after we got through the most critical parts. Everyone did an impressive effort, and if anyone that helped is in the Chicago area, a great meal is my treat!"

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Detroit a variety of online monitoring and security evaluation services to assist you to minimize the threat from crypto-ransomware. These services utilize next-generation machine learning technology to uncover new variants of ransomware that are able to get past traditional signature-based security products.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior machine learning technology to guard physical and virtual endpoint devices against new malware assaults like ransomware and file-less exploits, which routinely evade traditional signature-based AV tools. ProSight ASM safeguards on-premises and cloud resources and offers a single platform to address the entire malware attack lifecycle including blocking, identification, mitigation, cleanup, and post-attack forensics. Top features include single-click rollback with Windows VSS and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

  • ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
    Progent's ProSight Enhanced Security Protection services deliver economical multi-layer security for physical servers and VMs, workstations, smartphones, and Exchange Server. ProSight ESP utilizes adaptive security and advanced heuristics for round-the-clock monitoring and responding to security threats from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, endpoint management, and web filtering via leading-edge technologies incorporated within a single agent accessible from a single console. Progent's data protection and virtualization experts can assist your business to design and configure a ProSight ESP environment that meets your company's unique requirements and that allows you demonstrate compliance with legal and industry information security regulations. Progent will help you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for immediate attention. Progent's consultants can also assist your company to install and test a backup and disaster recovery solution such as ProSight Data Protection Services so you can get back in business quickly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange filtering.

  • ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
    Progent has worked with advanced backup/restore software companies to produce ProSight Data Protection Services, a family of management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and monitor your backup processes and allow non-disruptive backup and fast restoration of important files/folders, applications, images, plus VMs. ProSight DPS helps you avoid data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks such as ransomware, human error, malicious employees, or application bugs. Managed backup services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to identify which of these fully managed backup services are most appropriate for your IT environment.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam filtering service that uses the technology of top data security vendors to provide centralized management and comprehensive security for your email traffic. The hybrid architecture of Progent's Email Guard combines a Cloud Protection Layer with a local gateway device to provide complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne threats. The Cloud Protection Layer acts as a preliminary barricade and keeps the vast majority of unwanted email from making it to your network firewall. This decreases your vulnerability to inbound threats and conserves network bandwidth and storage. Email Guard's on-premises gateway appliance adds a further layer of analysis for inbound email. For outbound email, the on-premises gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The on-premises security gateway can also help Exchange Server to monitor and safeguard internal email traffic that stays inside your security perimeter. For more information, see ProSight Email Guard spam and content filtering.

  • ProSight WAN Watch: Infrastructure Remote Monitoring and Management
    Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and affordable for smaller organizations to map out, track, optimize and debug their connectivity appliances like switches, firewalls, and load balancers as well as servers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that infrastructure topology maps are always current, captures and displays the configuration information of virtually all devices connected to your network, monitors performance, and generates notices when issues are discovered. By automating complex management and troubleshooting processes, WAN Watch can knock hours off ordinary chores such as network mapping, reconfiguring your network, locating devices that need critical updates, or identifying the cause of performance issues. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

  • ProSight LAN Watch: Server and Desktop Remote Monitoring
    ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management techniques to help keep your network operating at peak levels by checking the health of critical computers that power your information system. When ProSight LAN Watch detects an issue, an alert is transmitted immediately to your designated IT management personnel and your assigned Progent consultant so all potential problems can be resolved before they have a chance to disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

  • ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
    With Progent's ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a protected Tier III data center on a high-performance virtual machine host configured and managed by Progent's network support professionals. With the ProSight Virtual Hosting model, the client retains ownership of the data, the operating system software, and the applications. Since the environment is virtualized, it can be moved easily to an alternate hardware environment without requiring a lengthy and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, find and safeguard information about your IT infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSL certificates or domains. By cleaning up and managing your network documentation, you can save as much as 50% of time thrown away looking for vital information about your IT network. ProSight IT Asset Management features a centralized location for holding and collaborating on all documents required for managing your network infrastructure like recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT data. Whether you're planning enhancements, doing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the data you require the instant you need it. Learn more about ProSight IT Asset Management service.

  • Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
    Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that utilizes cutting edge behavior-based machine learning tools to defend endpoint devices and servers and VMs against modern malware assaults like ransomware and email phishing, which routinely escape traditional signature-based anti-virus products. Progent ASM services protect local and cloud resources and provides a single platform to manage the entire malware attack lifecycle including blocking, detection, mitigation, remediation, and forensics. Top features include single-click rollback with Windows VSS and automatic system-wide immunization against newly discovered threats. Learn more about Progent's ransomware protection and cleanup services.

  • Outsourced/Co-managed Service Center: Support Desk Managed Services
    Progent's Call Desk services enable your IT staff to outsource Help Desk services to Progent or split activity for Help Desk services transparently between your in-house support resources and Progent's nationwide roster of IT service engineers and subject matter experts. Progent's Co-managed Service Desk provides a transparent supplement to your corporate support team. User interaction with the Service Desk, delivery of technical assistance, problem escalation, trouble ticket generation and tracking, performance measurement, and management of the service database are cohesive whether issues are taken care of by your core network support staff, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Service Desk services.

  • Patch Management: Patch Management Services
    Progent's support services for patch management provide organizations of all sizes a versatile and cost-effective solution for evaluating, validating, scheduling, implementing, and tracking software and firmware updates to your ever-evolving information network. In addition to maximizing the security and functionality of your computer environment, Progent's patch management services free up time for your in-house IT team to concentrate on line-of-business initiatives and tasks that deliver the highest business value from your network. Find out more about Progent's patch management support services.

  • ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
    Progent's Duo authentication managed services incorporate Cisco's Duo cloud technology to defend against compromised passwords through the use of two-factor authentication. Duo supports single-tap identity verification with iOS, Google Android, and other personal devices. Using 2FA, when you log into a protected online account and give your password you are requested to verify who you are via a unit that only you possess and that uses a separate network channel. A broad selection of out-of-band devices can be used as this second form of authentication including a smartphone or wearable, a hardware token, a landline telephone, etc. You may designate multiple verification devices. For details about ProSight Duo identity validation services, see Duo MFA two-factor authentication services for access security.
For 24-Hour Detroit Crypto-Ransomware Remediation Experts, call Progent at 800-462-8800 or go to Contact Progent.