Crypto-Ransomware : Your Worst Information Technology Catastrophe
Crypto-Ransomware has become an escalating cyberplague that presents an enterprise-level threat for businesses vulnerable to an assault. Different iterations of crypto-ransomware such as CrySIS, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been running rampant for many years and still cause harm. Recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, plus more as yet unnamed viruses, not only encrypt on-line information but also infect any configured system protection mechanisms. Data replicated to cloud environments can also be encrypted. In a poorly designed system, it can make automatic restoration hopeless and basically sets the entire system back to zero.
Getting back on-line applications and data after a ransomware outage becomes a sprint against the clock as the victim fights to stop the spread, cleanup the virus, and restore enterprise-critical operations. Since ransomware requires time to replicate, penetrations are usually sprung at night, when attacks typically take more time to identify. This multiplies the difficulty of quickly assembling and coordinating a capable response team.
Progent offers an assortment of help services for protecting organizations from ransomware attacks. These include team education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of the latest generation security appliances with artificial intelligence technology from SentinelOne to identify and suppress new threats automatically. Progent also can provide the services of veteran ransomware recovery consultants with the skills and commitment to re-deploy a breached network as rapidly as possible.
Progent's Ransomware Restoration Services
Following a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not guarantee that cyber hackers will respond with the keys to unencrypt all your data. Kaspersky ascertained that seventeen percent of ransomware victims never restored their files after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to setup from scratch the critical elements of your Information Technology environment. Absent the availability of complete information backups, this calls for a wide range of skill sets, top notch project management, and the willingness to work continuously until the recovery project is complete.
For twenty years, Progent has offered expert IT services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned advanced certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of expertise gives Progent the skills to efficiently identify critical systems and re-organize the surviving pieces of your IT system following a ransomware attack and assemble them into a functioning system.
Progent's security group utilizes powerful project management applications to orchestrate the sophisticated recovery process. Progent understands the urgency of acting swiftly and together with a customer's management and IT staff to assign priority to tasks and to get key systems back on-line as fast as humanly possible.
Case Study: A Successful Crypto-Ransomware Penetration Recovery
A business hired Progent after their company was taken over by the Ryuk ransomware. Ryuk is generally considered to have been created by Northern Korean state sponsored criminal gangs, suspected of adopting approaches leaked from America's National Security Agency. Ryuk attacks specific businesses with little ability to sustain operational disruption and is one of the most lucrative iterations of ransomware malware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in the Chicago metro area with around 500 workers. The Ryuk penetration had shut down all company operations and manufacturing processes. Most of the client's data protection had been online at the beginning of the attack and were damaged. The client considered paying the ransom demand (in excess of two hundred thousand dollars) and hoping for good luck, but ultimately utilized Progent.
"I can't speak enough about the care Progent provided us throughout the most critical period of (our) company's life. We most likely would have paid the hackers behind this attack if it wasn't for the confidence the Progent group gave us. The fact that you could get our e-mail and production applications back in less than a week was something I thought impossible. Every single expert I worked with or communicated with at Progent was absolutely committed on getting us back on-line and was working all day and night to bail us out."
Progent worked with the client to rapidly understand and prioritize the essential systems that had to be recovered in order to continue company functions:
- Windows Active Directory
- Electronic Messaging
- MRP System
To get going, Progent adhered to ransomware incident mitigation best practices by isolating and cleaning systems of viruses. Progent then initiated the work of recovering Microsoft AD, the heart of enterprise environments built on Microsoft Windows Server technology. Exchange email will not function without Active Directory, and the customer's MRP software leveraged Microsoft SQL Server, which depends on Active Directory services for access to the data.
Within 48 hours, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then accomplished reinstallations and hard drive recovery on critical systems. All Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was able to locate intact OST files (Outlook Off-Line Folder Files) on team desktop computers to recover email messages. A recent off-line backup of the customer's financials/ERP systems made them able to return these essential services back servicing users. Although significant work needed to be completed to recover totally from the Ryuk virus, essential services were restored rapidly:
"For the most part, the production manufacturing operation ran fairly normal throughout and we produced all customer orders."
During the next month key milestones in the recovery project were accomplished through tight collaboration between Progent consultants and the customer:
- Internal web applications were returned to operation with no loss of data.
- The MailStore Microsoft Exchange Server with over 4 million historical messages was brought online and available for users.
- CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory modules were completely functional.
- A new Palo Alto 850 security appliance was installed and configured.
- Nearly all of the desktops and laptops were back into operation.
"A lot of what went on in the early hours is nearly entirely a haze for me, but my team will not soon forget the dedication each and every one of you put in to give us our company back. I've been working with Progent for the past 10 years, possibly more, and every time I needed help Progent has come through and delivered as promised. This time was a Herculean accomplishment."
Conclusion
A probable business catastrophe was avoided with dedicated professionals, a broad range of knowledge, and close teamwork. Although in retrospect the ransomware penetration detailed here would have been shut down with up-to-date security technology solutions and NIST Cybersecurity Framework best practices, staff education, and well designed security procedures for data backup and applying software patches, the fact remains that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a ransomware incursion, feel confident that Progent's roster of professionals has proven experience in ransomware virus blocking, remediation, and data disaster recovery.
"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were helping), thank you for letting me get rested after we made it over the most critical parts. All of you did an amazing job, and if anyone is visiting the Chicago area, dinner is my treat!"
To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Fremont a variety of remote monitoring and security evaluation services to assist you to reduce your vulnerability to crypto-ransomware. These services utilize next-generation AI technology to uncover new strains of crypto-ransomware that can escape detection by legacy signature-based anti-virus products.
- ProSight LAN Watch: Server and Desktop Remote Monitoring
ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) techniques to keep your IT system operating efficiently by checking the health of vital computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alert is transmitted automatically to your specified IT management personnel and your Progent engineering consultant so any looming problems can be addressed before they have a chance to disrupt your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.
- ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for managing your network, server, and desktop devices by providing an environment for performing common tedious tasks. These include health checking, patch management, automated remediation, endpoint deployment, backup and restore, A/V defense, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alert to your designated IT management staff and your assigned Progent consultant so that emerging problems can be taken care of before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.
- ProSight WAN Watch: Network Infrastructure Management
Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller organizations to map, monitor, enhance and debug their connectivity hardware such as routers, firewalls, and load balancers as well as servers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology diagrams are kept updated, copies and displays the configuration information of almost all devices on your network, monitors performance, and sends notices when potential issues are discovered. By automating time-consuming network management activities, ProSight WAN Watch can knock hours off ordinary chores like making network diagrams, reconfiguring your network, finding devices that require important updates, or identifying the cause of performance bottlenecks. Find out more details about ProSight WAN Watch network infrastructure management services.
- ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
ProSight Reporting is an expanding suite of real-time reporting tools designed to work with the top ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-up or endpoints with out-of-date AVs. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.
- ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
Progent has partnered with leading backup/restore technology providers to produce ProSight Data Protection Services (DPS), a family of subscription-based management offerings that provide backup-as-a-service. ProSight DPS services manage and monitor your backup processes and allow transparent backup and fast recovery of critical files/folders, applications, images, plus Hyper-V and VMware virtual machines. ProSight DPS helps your business protect against data loss resulting from equipment breakdown, natural calamities, fire, malware such as ransomware, user mistakes, malicious insiders, or software bugs. Managed services available in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these fully managed backup services are best suited for your IT environment.
- ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of top information security companies to deliver centralized management and world-class security for your inbound and outbound email. The powerful structure of Progent's Email Guard integrates cloud-based filtering with an on-premises security gateway appliance to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based malware. Email Guard's cloud filter serves as a preliminary barricade and keeps most unwanted email from reaching your network firewall. This reduces your exposure to external attacks and conserves system bandwidth and storage space. Email Guard's on-premises security gateway device adds a deeper layer of inspection for inbound email. For outgoing email, the local security gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The on-premises security gateway can also help Exchange Server to track and protect internal email that stays inside your corporate firewall. For more details, visit ProSight Email Guard spam filtering and data leakage protection.
- ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on
Progent's Duo MFA services utilize Cisco's Duo cloud technology to defend against stolen passwords by using two-factor authentication. Duo enables single-tap identity verification with Apple iOS, Google Android, and other personal devices. Using Duo 2FA, when you sign into a protected online account and give your password you are asked to verify who you are via a unit that only you possess and that is accessed using a different network channel. A broad selection of devices can be used as this added form of ID validation such as a smartphone or watch, a hardware token, a landline telephone, etc. You may register several verification devices. For more information about Duo identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services for access security.
- Outsourced/Co-managed Service Center: Support Desk Managed Services
Progent's Help Center services enable your information technology team to outsource Support Desk services to Progent or divide activity for support services transparently between your in-house network support team and Progent's nationwide pool of certified IT support technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a seamless extension of your in-house support organization. End user access to the Service Desk, delivery of technical assistance, problem escalation, trouble ticket generation and tracking, performance metrics, and maintenance of the service database are consistent whether issues are taken care of by your internal network support staff, by Progent, or both. Read more about Progent's outsourced/shared Service Desk services.
- Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
Progent's Active Protection Against Ransomware is an endpoint protection service that incorporates cutting edge behavior-based machine learning tools to guard endpoints as well as servers and VMs against modern malware attacks like ransomware and file-less exploits, which routinely evade traditional signature-matching anti-virus tools. Progent Active Security Monitoring services protect on-premises and cloud resources and provides a single platform to address the entire malware attack progression including filtering, detection, mitigation, remediation, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and cleanup services.
- ProSight IT Asset Management: Network Documentation Management
Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and protect data about your IT infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be alerted automatically about upcoming expirations of SSLs or domains. By cleaning up and managing your IT documentation, you can save up to half of time spent trying to find critical information about your network. ProSight IT Asset Management features a common repository for storing and sharing all documents related to managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT information. Whether you're making improvements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the data you need the instant you need it. Read more about Progent's ProSight IT Asset Management service.
- Patch Management: Software/Firmware Update Management Services
Progent's support services for software and firmware patch management provide businesses of any size a flexible and affordable alternative for evaluating, testing, scheduling, implementing, and tracking updates to your ever-evolving information system. Besides optimizing the security and functionality of your computer network, Progent's patch management services free up time for your in-house IT team to focus on line-of-business initiatives and tasks that deliver maximum business value from your information network. Find out more about Progent's patch management services.
- ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
With ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected fault tolerant data center on a high-performance virtual host configured and maintained by Progent's IT support professionals. Under the ProSight Virtual Hosting model, the customer owns the data, the OS platforms, and the apps. Because the system is virtualized, it can be moved immediately to an alternate hardware solution without requiring a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, your business is not locked into a single hosting service. Find out more details about ProSight Virtual Hosting services.
- ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's next generation behavior-based analysis technology to defend physical and virtual endpoints against modern malware assaults such as ransomware and file-less exploits, which routinely escape traditional signature-matching anti-virus products. ProSight ASM protects on-premises and cloud resources and provides a single platform to manage the entire malware attack lifecycle including blocking, detection, containment, remediation, and forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.
- ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable in-depth security for physical and virtual servers, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and advanced heuristics for round-the-clock monitoring and reacting to security threats from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, endpoint management, and web filtering via leading-edge technologies incorporated within one agent managed from a single control. Progent's security and virtualization consultants can help your business to design and implement a ProSight ESP deployment that addresses your company's specific requirements and that allows you prove compliance with legal and industry data protection standards. Progent will assist you define and implement policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that call for urgent action. Progent's consultants can also assist your company to set up and test a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a destructive cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange email filtering.
For Fremont 24/7 Crypto-Ransomware Cleanup Support Services, call Progent at 800-462-8800 or go to Contact Progent.