Stamford 24/7/365 Urgent Crypto
Computer Malware Identification and Removal Support

Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that poses an existential danger for organizations unprepared for an attack. Multiple generations of ransomware like the Dharma, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for many years and continue to inflict destruction. More recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, as well as frequent as yet unnamed malware, not only encrypt online files but also infect many available system restores and backups. Information synched to off-site disaster recovery sites can also be ransomed. In a poorly architected system, it can make automated restoration useless and effectively sets the entire system back to zero.

Restoring programs and information following a ransomware attack becomes a race against time as the targeted organization fights to stop lateral movement and remove the ransomware and to resume business-critical operations. Because ransomware needs time to replicate, assaults are usually launched at night, when penetrations are likely to take more time to identify. This multiplies the difficulty of rapidly marshalling and coordinating an experienced response team.

Progent offers a range of help services for protecting organizations from ransomware penetrations. These include user training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of next-generation security gateways with AI capabilities to quickly identify and quarantine day-zero cyber attacks. Progent also can provide the assistance of seasoned ransomware recovery consultants with the skills and perseverance to rebuild a breached system as rapidly as possible.

Progent's Ransomware Recovery Support Services
Soon after a crypto-ransomware event, paying the ransom in Bitcoin cryptocurrency does not guarantee that cyber hackers will provide the needed keys to decrypt any or all of your data. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is greatly above the average ransomware demands, which ZDNET determined to be around $13,000. The fallback is to piece back together the critical parts of your IT environment. Without the availability of essential information backups, this requires a wide range of skill sets, professional team management, and the ability to work 24x7 until the job is over.

For twenty years, Progent has offered certified expert IT services for companies in Stamford and across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have earned advanced industry certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, and GIAC. (See Progent's certifications). Progent also has experience in financial management and ERP applications. This breadth of expertise provides Progent the capability to efficiently understand critical systems and consolidate the remaining parts of your computer network system after a ransomware attack and rebuild them into a functioning system.

Progent's recovery team of experts has state-of-the-art project management applications to orchestrate the sophisticated recovery process. Progent appreciates the urgency of working quickly and together with a customer’s management and Information Technology resources to assign priority to tasks and to get critical systems back on-line as fast as possible.

Customer Story: A Successful Crypto-Ransomware Virus Response
A small business contacted Progent after their company was crashed by the Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean government sponsored cybercriminals, suspected of using techniques leaked from the United States NSA organization. Ryuk attacks specific companies with little or no ability to sustain disruption and is among the most profitable examples of ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturer located in Chicago and has around 500 workers. The Ryuk event had disabled all essential operations and manufacturing processes. Most of the client's information backups had been directly accessible at the time of the attack and were damaged. The client considered paying the ransom demand (more than two hundred thousand dollars) and praying for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the customer to rapidly assess and assign priority to the key areas that had to be addressed in order to restart departmental operations:

• Active Directory (AD)
• Microsoft Exchange Email
• Financials/MRP

In less than 48 hours, Progent was able to re-build Active Directory to its pre-attack state. Progent then assisted with reinstallations and hard drive recovery of needed systems. All Exchange data and configuration information were intact, which greatly helped the restore of Exchange. Progent was also able to collect non-encrypted OST files (Outlook Off-Line Data Files) on user PCs and laptops in order to recover mail data. A recent off-line backup of the customer’s manufacturing systems made them able to restore these essential programs back servicing users. Although a large amount of work still had to be done to recover totally from the Ryuk attack, the most important systems were recovered rapidly:

Throughout the next couple of weeks important milestones in the recovery process were completed through tight collaboration between Progent consultants and the client:

• Internal web applications were returned to operation without losing any data.
• The MailStore Server containing more than four million historical messages was restored to operations and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/AR/Inventory Control modules were fully functional.
• A new Palo Alto 850 firewall was deployed.
• Nearly all of the desktops and laptops were fully operational.

Conclusion
A possible business disaster was averted due to hard-working professionals, a wide range of subject matter expertise, and tight collaboration. Although in retrospect the ransomware incident detailed here should have been disabled with up-to-date security technology solutions and security best practices, staff education, and properly executed incident response procedures for data protection and applying software patches, the reality remains that government-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware attack, remember that Progent's roster of professionals has extensive experience in crypto-ransomware virus defense, removal, and file recovery.

To review or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers companies in Stamford a variety of remote monitoring and security assessment services to assist you to minimize the threat from ransomware. These services include modern artificial intelligence capability to uncover new variants of ransomware that can escape detection by traditional signature-based anti-virus products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates next generation behavior analysis tools to guard physical and virtual endpoint devices against new malware assaults such as ransomware and email phishing, which routinely escape legacy signature-matching AV tools. ProSight Active Security Monitoring protects local and cloud resources and offers a unified platform to automate the complete threat progression including blocking, infiltration detection, mitigation, remediation, and forensics. Top features include single-click rollback with Windows VSS and real-time system-wide immunization against new attacks. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer affordable in-depth security for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP uses contextual security and modern behavior analysis for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, endpoint management, and web filtering through cutting-edge technologies packaged within one agent accessible from a single control. Progent's data protection and virtualization experts can help you to plan and configure a ProSight ESP environment that meets your organization's specific requirements and that allows you achieve and demonstrate compliance with government and industry data security standards. Progent will assist you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that call for immediate attention. Progent's consultants can also help you to install and test a backup and restore solution such as ProSight Data Protection Services so you can get back in business rapidly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange email filtering.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery
  ProSight Data Protection Services from Progent provide small and mid-sized organizations an affordable end-to-end solution for secure backup/disaster recovery. Available at a fixed monthly cost, ProSight DPS automates your backup activities and enables fast restoration of critical files, apps and virtual machines that have become lost or damaged as a result of hardware breakdowns, software bugs, natural disasters, human mistakes, or malware attacks like ransomware. ProSight DPS can help you back up, retrieve and restore files, folders, applications, system images, plus Microsoft Hyper-V and VMware images/. Important data can be backed up on the cloud, to an on-promises storage device, or to both. Progent's cloud backup specialists can provide world-class expertise to set up ProSight DPS to be compliant with regulatory standards such as HIPAA, FIRPA, PCI and Safe Harbor and, when necessary, can help you to restore your critical data. Learn more about ProSight Data Protection Services Managed Backup and Recovery.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of top information security companies to provide centralized control and world-class security for your email traffic. The powerful structure of Progent's Email Guard managed service combines cloud-based filtering with an on-premises gateway appliance to offer complete protection against spam, viruses, Dos Attacks, DHAs, and other email-borne malware. Email Guard's Cloud Protection Layer serves as a first line of defense and keeps the vast majority of unwanted email from reaching your network firewall. This decreases your vulnerability to external threats and conserves network bandwidth and storage space. Email Guard's onsite security gateway appliance provides a further layer of analysis for inbound email. For outbound email, the onsite security gateway offers anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also help Microsoft Exchange Server to track and protect internal email traffic that stays within your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for smaller organizations to map, track, reconfigure and troubleshoot their networking hardware such as routers, firewalls, and load balancers as well as servers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network diagrams are kept updated, copies and displays the configuration information of almost all devices on your network, monitors performance, and generates notices when issues are detected. By automating complex management processes, ProSight WAN Watch can knock hours off ordinary chores such as network mapping, reconfiguring your network, finding appliances that need critical software patches, or identifying the cause of performance issues. Learn more details about ProSight WAN Watch infrastructure management services.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent’s server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to keep your IT system running at peak levels by checking the state of critical assets that drive your information system. When ProSight LAN Watch detects a problem, an alarm is transmitted automatically to your specified IT staff and your Progent engineering consultant so that any potential problems can be addressed before they can disrupt your network. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a protected Tier III data center on a high-performance virtual host set up and managed by Progent's network support experts. Under Progent's ProSight Virtual Hosting model, the client owns the data, the OS software, and the applications. Since the environment is virtualized, it can be moved immediately to a different hosting environment without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, retrieve and safeguard information related to your network infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be warned automatically about impending expirations of SSL certificates ,domains or warranties. By cleaning up and organizing your IT documentation, you can eliminate up to half of time spent trying to find vital information about your IT network. ProSight IT Asset Management includes a common location for storing and collaborating on all documents related to managing your network infrastructure like recommended procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT information. Whether you’re planning enhancements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you require as soon as you need it. Read more about Progent's ProSight IT Asset Management service.