Ransomware : Your Worst Information Technology Catastrophe
Ransomware  Remediation ProfessionalsCrypto-Ransomware has become an escalating cyber pandemic that represents an existential threat for businesses of all sizes poorly prepared for an assault. Different iterations of ransomware like the Dharma, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for many years and still cause harm. More recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, plus daily unnamed newcomers, not only do encryption of on-line files but also infiltrate all configured system protection mechanisms. Information synchronized to off-site disaster recovery sites can also be encrypted. In a poorly architected system, it can make any restore operations useless and basically knocks the entire system back to square one.

Restoring programs and information after a ransomware attack becomes a sprint against time as the victim fights to stop lateral movement and cleanup the virus and to restore enterprise-critical operations. Because crypto-ransomware requires time to replicate, penetrations are usually launched during weekends and nights, when successful attacks in many cases take longer to recognize. This compounds the difficulty of promptly assembling and orchestrating a qualified response team.

Progent provides an assortment of services for securing enterprises from ransomware attacks. Among these are team training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of modern security solutions with artificial intelligence capabilities from SentinelOne to identify and disable day-zero cyber attacks quickly. Progent also can provide the services of seasoned crypto-ransomware recovery consultants with the track record and perseverance to re-deploy a breached network as urgently as possible.

Progent's Ransomware Restoration Services
Following a ransomware penetration, even paying the ransom demands in cryptocurrency does not ensure that merciless criminals will return the codes to decipher any of your files. Kaspersky determined that seventeen percent of crypto-ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is significantly above the average crypto-ransomware demands, which ZDNET averages to be in the range of $13,000. The alternative is to re-install the key components of your IT environment. Without the availability of complete information backups, this requires a wide range of IT skills, professional team management, and the capability to work non-stop until the job is over.

For twenty years, Progent has provided certified expert IT services for businesses in Pasadena and throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have earned advanced industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distros of Linux. Progent's security engineers have earned internationally-recognized certifications including CISM, CISSP, ISACA CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of experience affords Progent the skills to quickly identify critical systems and organize the surviving pieces of your Information Technology system following a ransomware attack and assemble them into a functioning network.

Progent's security team has powerful project management applications to coordinate the sophisticated restoration process. Progent appreciates the urgency of acting quickly and together with a client's management and IT team members to prioritize tasks and to put critical systems back online as fast as possible.

Client Case Study: A Successful Ransomware Incident Response
A small business hired Progent after their organization was attacked by the Ryuk ransomware. Ryuk is thought to have been launched by North Korean state hackers, possibly adopting strategies exposed from the United States NSA organization. Ryuk attacks specific companies with little or no room for operational disruption and is one of the most profitable versions of ransomware viruses. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in Chicago with around 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing processes. Most of the client's information backups had been on-line at the beginning of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom demand (exceeding $200,000) and praying for good luck, but in the end called Progent.


"I cannot say enough about the support Progent gave us throughout the most critical period of (our) businesses existence. We most likely would have paid the cybercriminals if it wasn't for the confidence the Progent experts provided us. That you were able to get our e-mail system and important servers back on-line in less than 1 week was beyond my wildest dreams. Every single expert I worked with or texted at Progent was urgently focused on getting our company operational and was working 24 by 7 on our behalf."

Progent worked hand in hand the client to rapidly understand and prioritize the key systems that needed to be restored to make it possible to continue business operations:

  • Microsoft Active Directory
  • Email
  • MRP System
To get going, Progent followed ransomware incident mitigation industry best practices by isolating and removing active viruses. Progent then initiated the work of bringing back online Microsoft AD, the key technology of enterprise networks built upon Microsoft technology. Microsoft Exchange Server email will not work without Windows AD, and the businesses' financials and MRP applications utilized SQL Server, which requires Active Directory for security authorization to the databases.

Within 2 days, Progent was able to rebuild Active Directory to its pre-virus state. Progent then completed reinstallations and storage recovery of key servers. All Microsoft Exchange Server data and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to find non-encrypted OST files (Microsoft Outlook Off-Line Data Files) on user PCs to recover email messages. A not too old offline backup of the client's accounting software made it possible to recover these required services back servicing users. Although a lot of work needed to be completed to recover completely from the Ryuk attack, critical services were restored quickly:


"For the most part, the manufacturing operation ran fairly normal throughout and we did not miss any customer sales."

Throughout the following month critical milestones in the recovery process were made through close cooperation between Progent consultants and the customer:

  • Self-hosted web sites were brought back up without losing any information.
  • The MailStore Microsoft Exchange Server exceeding four million historical messages was spun up and accessible to users.
  • CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory modules were completely operational.
  • A new Palo Alto Networks 850 security appliance was brought on-line.
  • Nearly all of the user PCs were functioning as before the incident.

"So much of what happened that first week is mostly a fog for me, but my management will not forget the care each and every one of the team put in to give us our company back. I have been working with Progent for at least 10 years, possibly more, and each time I needed help Progent has impressed me and delivered as promised. This situation was a life saver."

Conclusion
A potential company-ending catastrophe was evaded by top-tier experts, a wide array of IT skills, and close collaboration. Although in retrospect the ransomware virus incident described here would have been identified and blocked with advanced security solutions and best practices, user and IT administrator education, and properly executed incident response procedures for data backup and applying software patches, the fact remains that government-sponsored cybercriminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, removal, and data disaster recovery.


"So, to Darrin, Matt, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (and any others who were helping), thanks very much for allowing me to get some sleep after we made it over the initial push. All of you did an amazing effort, and if anyone that helped is in the Chicago area, dinner is the least I can do!"

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Pasadena a portfolio of online monitoring and security evaluation services designed to assist you to minimize your vulnerability to ransomware. These services incorporate modern artificial intelligence technology to detect new variants of ransomware that can get past legacy signature-based security solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoints against new malware assaults such as ransomware and file-less exploits, which routinely evade traditional signature-based AV products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a single platform to address the complete malware attack lifecycle including blocking, identification, containment, remediation, and forensics. Top features include single-click rollback with Windows VSS and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

  • ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
    ProSight Enhanced Security Protection services deliver ultra-affordable in-depth security for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and reacting to cyber threats from all vectors. ProSight ESP provides two-way firewall protection, penetration alarms, device management, and web filtering through leading-edge tools incorporated within one agent managed from a unified control. Progent's security and virtualization experts can help you to design and implement a ProSight ESP environment that meets your organization's specific needs and that allows you demonstrate compliance with legal and industry data security standards. Progent will help you define and implement policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that call for immediate attention. Progent can also help your company to set up and test a backup and disaster recovery system such as ProSight Data Protection Services so you can recover rapidly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange email filtering.

  • ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
    Progent has partnered with leading backup/restore technology companies to produce ProSight Data Protection Services, a selection of offerings that deliver backup-as-a-service (BaaS). ProSight DPS products manage and track your data backup operations and allow non-disruptive backup and fast recovery of vital files, applications, images, and virtual machines. ProSight DPS lets your business protect against data loss caused by equipment failures, natural calamities, fire, cyber attacks like ransomware, user error, malicious employees, or software glitches. Managed services in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can help you to determine which of these fully managed services are most appropriate for your IT environment.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam filtering service that uses the technology of leading data security vendors to provide web-based control and comprehensive protection for all your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with a local gateway appliance to offer complete defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-borne threats. The Cloud Protection Layer serves as a preliminary barricade and blocks the vast majority of threats from reaching your security perimeter. This reduces your vulnerability to external threats and conserves system bandwidth and storage. Email Guard's on-premises security gateway appliance adds a further layer of analysis for incoming email. For outgoing email, the onsite gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local gateway can also help Exchange Server to track and protect internal email traffic that stays within your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

  • ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
    ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller businesses to map, track, enhance and troubleshoot their connectivity appliances such as switches, firewalls, and load balancers as well as servers, printers, endpoints and other devices. Incorporating state-of-the-art RMM technology, ProSight WAN Watch ensures that network diagrams are always updated, copies and manages the configuration information of almost all devices connected to your network, tracks performance, and generates notices when potential issues are detected. By automating complex management processes, ProSight WAN Watch can cut hours off ordinary tasks like making network diagrams, expanding your network, finding appliances that need critical updates, or resolving performance problems. Find out more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

  • ProSight LAN Watch: Server and Desktop Monitoring
    ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to help keep your IT system operating efficiently by checking the state of critical assets that drive your information system. When ProSight LAN Watch detects an issue, an alert is sent immediately to your specified IT management personnel and your Progent consultant so that all potential problems can be addressed before they have a chance to disrupt your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
    With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a secure Tier III data center on a fast virtual machine host set up and maintained by Progent's IT support professionals. With Progent's ProSight Virtual Hosting service model, the customer owns the data, the OS software, and the applications. Since the system is virtualized, it can be moved immediately to a different hosting environment without requiring a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, retrieve and safeguard information related to your IT infrastructure, procedures, applications, and services. You can instantly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates or warranties. By cleaning up and organizing your network documentation, you can eliminate up to half of time thrown away searching for vital information about your network. ProSight IT Asset Management features a common repository for holding and collaborating on all documents required for managing your business network like standard operating procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT data. Whether you're planning improvements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the information you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

  • Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
    Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that incorporates next generation behavior-based machine learning tools to defend endpoints and servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-matching AV products. Progent Active Security Monitoring services safeguard local and cloud resources and offers a single platform to manage the entire malware attack progression including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Top features include single-click rollback with Windows VSS and automatic network-wide immunization against newly discovered attacks. Read more about Progent's ransomware protection and cleanup services.

  • Progent's Outsourced/Shared Help Desk: Help Desk Managed Services
    Progent's Help Desk managed services enable your information technology group to outsource Support Desk services to Progent or divide activity for support services transparently between your internal network support resources and Progent's extensive pool of IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a transparent supplement to your internal network support staff. End user access to the Service Desk, delivery of technical assistance, issue escalation, ticket creation and tracking, efficiency measurement, and maintenance of the service database are cohesive whether issues are resolved by your in-house IT support organization, by Progent, or a mix of the two. Read more about Progent's outsourced/shared Call Desk services.

  • Patch Management: Patch Management Services
    Progent's support services for software and firmware patch management provide organizations of any size a flexible and cost-effective alternative for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving information network. In addition to optimizing the protection and functionality of your IT network, Progent's software/firmware update management services permit your IT team to focus on more strategic projects and tasks that derive maximum business value from your information network. Read more about Progent's software/firmware update management services.

  • ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
    Progent's Duo MFA managed services utilize Cisco's Duo technology to defend against password theft by using two-factor authentication. Duo enables single-tap identity verification on iOS, Google Android, and other out-of-band devices. With 2FA, whenever you log into a secured online account and enter your password you are asked to confirm who you are on a device that only you possess and that uses a separate network channel. A broad selection of out-of-band devices can be utilized for this second form of ID validation such as an iPhone or Android or watch, a hardware token, a landline telephone, etc. You may register multiple verification devices. To learn more about Duo two-factor identity authentication services, see Duo MFA two-factor authentication services.

  • ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
    ProSight Reporting is an expanding suite of real-time and in-depth reporting utilities created to work with the top ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues like spotty support follow-through or machines with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.
For Pasadena 24x7x365 Crypto-Ransomware Repair Services, contact Progent at 800-462-8800 or go to Contact Progent.