Crypto-Ransomware : Your Feared IT Nightmare
Crypto-Ransomware  Remediation ExpertsRansomware has become an escalating cyberplague that presents an existential danger for organizations unprepared for an assault. Multiple generations of crypto-ransomware such as CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for a long time and continue to inflict harm. Recent versions of crypto-ransomware such as Ryuk and Hermes, as well as more as yet unnamed malware, not only encrypt online data but also infiltrate most accessible system restores and backups. Files synchronized to cloud environments can also be rendered useless. In a poorly designed environment, this can render any recovery hopeless and effectively knocks the entire system back to zero.

Getting back online programs and information after a crypto-ransomware event becomes a sprint against the clock as the targeted business struggles to contain and clear the ransomware and to restore enterprise-critical operations. Because ransomware needs time to move laterally, penetrations are usually launched during weekends and nights, when attacks typically take more time to recognize. This compounds the difficulty of quickly marshalling and orchestrating an experienced mitigation team.

Progent has a range of support services for securing enterprises from ransomware events. Among these are staff training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of the latest generation security solutions with artificial intelligence capabilities to intelligently identify and quarantine day-zero threats. Progent in addition offers the assistance of veteran ransomware recovery professionals with the track record and commitment to re-deploy a compromised environment as soon as possible.

Progent's Ransomware Recovery Support Services
Soon after a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that cyber hackers will provide the needed codes to unencrypt any of your data. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms frequently range from fifteen to forty BTC ($120,000 and $400,000). This is well above the average crypto-ransomware demands, which ZDNET determined to be in the range of $13,000. The fallback is to setup from scratch the essential parts of your IT environment. Without access to full system backups, this requires a broad range of IT skills, top notch project management, and the ability to work non-stop until the task is over.

For decades, Progent has made available professional Information Technology services for companies in Aurora and across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned high-level certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned certifications including CISA, CISSP, ISACA CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP applications. This breadth of expertise gives Progent the capability to efficiently ascertain critical systems and consolidate the surviving pieces of your network system following a ransomware event and rebuild them into a functioning network.

Progent's recovery team deploys top notch project management systems to orchestrate the sophisticated restoration process. Progent knows the urgency of acting quickly and together with a client's management and IT resources to assign priority to tasks and to put essential applications back on-line as soon as possible.

Customer Story: A Successful Ransomware Intrusion Restoration
A business contacted Progent after their network system was attacked by the Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state sponsored criminal gangs, possibly adopting algorithms exposed from the United States National Security Agency. Ryuk goes after specific organizations with limited ability to sustain operational disruption and is among the most profitable examples of ransomware malware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company based in the Chicago metro area with around 500 staff members. The Ryuk attack had frozen all business operations and manufacturing processes. The majority of the client's backups had been directly accessible at the start of the attack and were encrypted. The client was actively seeking loans for paying the ransom (exceeding $200,000) and wishfully thinking for good luck, but in the end called Progent.


"I canít say enough in regards to the support Progent provided us during the most stressful period of (our) businesses survival. We may have had to pay the hackers behind this attack if not for the confidence the Progent team provided us. That you were able to get our e-mail system and important applications back on-line quicker than 1 week was beyond my wildest dreams. Every single expert I spoke to or messaged at Progent was laser focused on getting us restored and was working day and night on our behalf."

Progent worked with the customer to quickly identify and prioritize the key applications that needed to be restored in order to restart company functions:

  • Active Directory (AD)
  • Email
  • Accounting/MRP
To get going, Progent followed Anti-virus penetration response best practices by halting lateral movement and cleaning systems of viruses. Progent then initiated the work of rebuilding Microsoft Active Directory, the foundation of enterprise systems built upon Microsoft Windows Server technology. Exchange messaging will not work without Windows AD, and the businessesí financials and MRP system used Microsoft SQL Server, which needs Active Directory for access to the information.

Within 2 days, Progent was able to recover Active Directory to its pre-intrusion state. Progent then helped perform setup and storage recovery on key servers. All Microsoft Exchange Server data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to locate intact OST data files (Microsoft Outlook Off-Line Data Files) on user PCs to recover mail information. A recent offline backup of the businesses manufacturing software made it possible to recover these essential services back servicing users. Although significant work still had to be done to recover fully from the Ryuk virus, critical systems were restored quickly:


"For the most part, the production operation never missed a beat and we did not miss any customer deliverables."

Over the following couple of weeks key milestones in the restoration process were accomplished through tight cooperation between Progent team members and the client:

  • In-house web sites were returned to operation without losing any data.
  • The MailStore Server containing more than four million historical emails was brought on-line and available for users.
  • CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory Control capabilities were completely restored.
  • A new Palo Alto 850 security appliance was set up and programmed.
  • Ninety percent of the user workstations were operational.

"Much of what was accomplished that first week is mostly a blur for me, but my team will not soon forget the care all of your team put in to help get our company back. Iíve utilized Progent for the past ten years, maybe more, and each time Progent has come through and delivered. This situation was a life saver."

Conclusion
A possible business-killing catastrophe was dodged with hard-working professionals, a wide spectrum of subject matter expertise, and tight teamwork. Although in retrospect the crypto-ransomware attack described here could have been identified and stopped with advanced security technology solutions and best practices, staff training, and well designed security procedures for information backup and applying software patches, the fact remains that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's team of professionals has substantial experience in crypto-ransomware virus blocking, mitigation, and data recovery.


"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Tony and Chris (and any others who were involved), Iím grateful for letting me get rested after we made it through the initial push. Everyone did an amazing effort, and if any of your team is around the Chicago area, a great meal is on me!"

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Aurora a portfolio of online monitoring and security evaluation services to help you to minimize the threat from ransomware. These services incorporate modern AI capability to uncover new strains of ransomware that can escape detection by legacy signature-based anti-virus solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes cutting edge behavior analysis tools to defend physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which routinely escape legacy signature-based anti-virus products. ProSight Active Security Monitoring safeguards local and cloud resources and offers a single platform to address the entire threat lifecycle including protection, detection, containment, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

  • ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
    Progent's ProSight Enhanced Security Protection services offer economical in-depth security for physical servers and VMs, workstations, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and responding to security assaults from all vectors. ProSight ESP offers firewall protection, penetration alarms, endpoint management, and web filtering through cutting-edge tools incorporated within one agent managed from a single console. Progent's data protection and virtualization consultants can assist you to plan and configure a ProSight ESP environment that meets your company's specific requirements and that allows you achieve and demonstrate compliance with government and industry data protection standards. Progent will assist you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for urgent attention. Progent can also help your company to install and verify a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange email filtering.

  • ProSight Data Protection Services: Managed Backup and Recovery
    ProSight Data Protection Services from Progent provide small and mid-sized organizations a low cost and fully managed service for secure backup/disaster recovery (BDR). For a low monthly price, ProSight DPS automates your backup activities and allows fast recovery of vital data, applications and VMs that have become unavailable or damaged due to hardware failures, software glitches, disasters, human mistakes, or malware attacks such as ransomware. ProSight Data Protection Services can help you protect, retrieve and restore files, folders, apps, system images, as well as Hyper-V and VMware images/. Critical data can be backed up on the cloud, to an on-promises device, or to both. Progent's backup and recovery consultants can provide world-class expertise to configure ProSight DPS to to comply with government and industry regulatory requirements like HIPAA, FIRPA, PCI and Safe Harbor and, whenever needed, can assist you to recover your critical information. Find out more about ProSight Data Protection Services Managed Backup and Recovery.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of leading data security vendors to deliver web-based management and world-class protection for all your email traffic. The powerful structure of Email Guard combines cloud-based filtering with an on-premises security gateway appliance to offer complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The Cloud Protection Layer acts as a first line of defense and keeps the vast majority of threats from making it to your network firewall. This reduces your exposure to external threats and conserves network bandwidth and storage. Email Guard's onsite gateway appliance provides a further level of analysis for inbound email. For outbound email, the onsite gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also assist Microsoft Exchange Server to track and protect internal email that stays inside your security perimeter. For more details, see Email Guard spam and content filtering.

  • ProSight WAN Watch: Network Infrastructure Management
    Progentís ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller businesses to map, monitor, enhance and troubleshoot their connectivity hardware such as routers and switches, firewalls, and load balancers as well as servers, printers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that network diagrams are kept current, copies and displays the configuration information of virtually all devices on your network, monitors performance, and generates notices when issues are detected. By automating complex management and troubleshooting processes, WAN Watch can knock hours off ordinary tasks like making network diagrams, reconfiguring your network, finding devices that need important updates, or resolving performance bottlenecks. Find out more details about ProSight WAN Watch network infrastructure management consulting.

  • ProSight LAN Watch: Server and Desktop Monitoring and Management
    ProSight LAN Watch is Progentís server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to help keep your IT system running efficiently by checking the health of vital assets that power your business network. When ProSight LAN Watch detects a problem, an alert is transmitted immediately to your specified IT management personnel and your assigned Progent consultant so that any potential issues can be resolved before they can impact your network. Find out more details about ProSight LAN Watch server and desktop monitoring services.

  • ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
    With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a secure Tier III data center on a fast virtual host set up and maintained by Progent's network support professionals. With Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the operating system software, and the applications. Because the system is virtualized, it can be moved immediately to an alternate hosting solution without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and protect data related to your network infrastructure, processes, applications, and services. You can instantly locate passwords or IP addresses and be alerted about impending expirations of SSLs or warranties. By cleaning up and managing your IT infrastructure documentation, you can eliminate as much as half of time wasted trying to find critical information about your IT network. ProSight IT Asset Management includes a common location for storing and sharing all documents required for managing your network infrastructure like recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT information. Whether youíre making improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you require when you need it. Find out more about ProSight IT Asset Management service.
For 24/7 Aurora Ransomware Recovery Support Services, contact Progent at 800-993-9400 or go to Contact Progent.