Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware  Recovery ExpertsRansomware has become a too-frequent cyber pandemic that represents an extinction-level threat for businesses of all sizes unprepared for an assault. Versions of ransomware such as Dharma, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for years and still cause destruction. Modern variants of crypto-ransomware like Ryuk and Hermes, plus frequent as yet unnamed newcomers, not only encrypt online information but also infiltrate all configured system protection mechanisms. Information synchronized to cloud environments can also be ransomed. In a poorly architected system, it can render automatic restore operations hopeless and basically sets the entire system back to zero.

Recovering applications and information after a ransomware outage becomes a race against the clock as the victim struggles to contain and clear the ransomware and to resume enterprise-critical activity. Since ransomware needs time to move laterally, assaults are frequently sprung during nights and weekends, when attacks tend to take more time to discover. This compounds the difficulty of promptly marshalling and organizing a capable response team.

Progent has an assortment of services for protecting organizations from ransomware penetrations. Among these are team member education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of next-generation security gateways with artificial intelligence capabilities to intelligently discover and quarantine new threats. Progent also provides the services of experienced crypto-ransomware recovery engineers with the talent and commitment to reconstruct a compromised system as rapidly as possible.

Progent's Ransomware Restoration Help
After a ransomware penetration, paying the ransom demands in cryptocurrency does not ensure that distant criminals will provide the needed keys to decrypt all your files. Kaspersky estimated that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is well higher than the average ransomware demands, which ZDNET determined to be approximately $13,000. The other path is to piece back together the mission-critical components of your Information Technology environment. Without access to essential system backups, this requires a wide complement of skills, top notch project management, and the willingness to work 24x7 until the job is done.

For twenty years, Progent has provided expert Information Technology services for businesses in Edison and throughout the U.S. and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded advanced certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP software solutions. This breadth of experience provides Progent the ability to quickly understand important systems and consolidate the remaining pieces of your Information Technology system after a crypto-ransomware event and rebuild them into an operational system.

Progent's recovery group deploys top notch project management applications to orchestrate the complex recovery process. Progent appreciates the importance of acting quickly and in concert with a client's management and Information Technology resources to prioritize tasks and to get critical services back on line as fast as humanly possible.

Client Story: A Successful Ransomware Intrusion Restoration
A business hired Progent after their company was taken over by Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean state sponsored cybercriminals, suspected of using approaches exposed from the U.S. NSA organization. Ryuk targets specific businesses with little room for disruption and is among the most profitable examples of crypto-ransomware. Major victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturer located in the Chicago metro area with around 500 employees. The Ryuk penetration had brought down all company operations and manufacturing processes. The majority of the client's data backups had been online at the beginning of the intrusion and were encrypted. The client was evaluating paying the ransom demand (exceeding $200K) and hoping for good luck, but in the end utilized Progent.


"I canít say enough about the expertise Progent provided us during the most fearful time of (our) businesses existence. We would have paid the cyber criminals behind the attack except for the confidence the Progent experts provided us. That you were able to get our messaging and critical applications back on-line faster than five days was amazing. Each person I got help from or texted at Progent was totally committed on getting our system up and was working breakneck pace on our behalf."

Progent worked together with the client to rapidly assess and assign priority to the mission critical applications that needed to be addressed in order to resume business functions:

  • Active Directory (AD)
  • Microsoft Exchange Server
  • Accounting/MRP
To begin, Progent followed ransomware penetration mitigation industry best practices by stopping the spread and clearing up compromised systems. Progent then started the work of bringing back online Active Directory, the heart of enterprise networks built on Microsoft Windows Server technology. Exchange email will not work without Windows AD, and the businessesí accounting and MRP system used Microsoft SQL Server, which depends on Active Directory for security authorization to the information.

In less than 2 days, Progent was able to re-build Active Directory to its pre-penetration state. Progent then charged ahead with reinstallations and storage recovery on key systems. All Exchange schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to find local OST data files (Microsoft Outlook Offline Data Files) on staff desktop computers and laptops in order to recover email data. A recent off-line backup of the businesses accounting/MRP systems made it possible to recover these required services back online. Although major work was left to recover completely from the Ryuk attack, core services were restored quickly:


"For the most part, the manufacturing operation showed little impact and we made all customer deliverables."

Over the next couple of weeks key milestones in the recovery process were accomplished in tight collaboration between Progent engineers and the client:

  • Self-hosted web sites were returned to operation with no loss of data.
  • The MailStore Exchange Server containing more than 4 million archived emails was brought on-line and available for users.
  • CRM/Orders/Invoicing/Accounts Payable/AR/Inventory Control functions were fully recovered.
  • A new Palo Alto Networks 850 security appliance was brought on-line.
  • 90% of the desktop computers were functioning as before the incident.

"A huge amount of what occurred during the initial response is mostly a blur for me, but I will not forget the dedication each and every one of the team put in to give us our company back. Iíve utilized Progent for at least 10 years, maybe more, and every time Progent has shined and delivered as promised. This time was a life saver."

Conclusion
A probable business catastrophe was averted through the efforts of hard-working experts, a broad spectrum of knowledge, and close collaboration. Although in post mortem the crypto-ransomware incident detailed here could have been disabled with current cyber security technology and security best practices, user training, and properly executed security procedures for information protection and applying software patches, the fact remains that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware virus, feel confident that Progent's team of experts has extensive experience in crypto-ransomware virus defense, remediation, and information systems recovery.


"So, to Darrin, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were involved), thank you for letting me get some sleep after we made it past the first week. Everyone did an incredible effort, and if anyone that helped is around the Chicago area, a great meal is the least I can do!"

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide companies in Edison a variety of remote monitoring and security assessment services designed to help you to minimize the threat from ransomware. These services incorporate modern AI capability to detect zero-day strains of ransomware that are able to evade traditional signature-based security solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates next generation behavior analysis technology to guard physical and virtual endpoint devices against new malware assaults such as ransomware and email phishing, which easily get by traditional signature-based AV products. ProSight ASM protects local and cloud-based resources and provides a single platform to manage the complete threat progression including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

  • ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Filtering
    Progent's ProSight Enhanced Security Protection services deliver economical in-depth security for physical and virtual servers, workstations, smartphones, and Exchange Server. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and reacting to security assaults from all vectors. ProSight ESP delivers firewall protection, penetration alerts, device management, and web filtering through cutting-edge tools incorporated within a single agent accessible from a unified control. Progent's data protection and virtualization consultants can help your business to design and configure a ProSight ESP environment that addresses your company's specific requirements and that helps you demonstrate compliance with government and industry data protection standards. Progent will help you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that require immediate attention. Progent can also assist you to set up and verify a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange filtering.

  • ProSight Data Protection Services: Managed Backup and Disaster Recovery
    ProSight Data Protection Services from Progent provide small and medium-sized organizations an affordable and fully managed service for reliable backup/disaster recovery. Available at a low monthly cost, ProSight DPS automates your backup processes and allows fast recovery of vital data, applications and virtual machines that have become lost or corrupted as a result of component failures, software glitches, natural disasters, human error, or malicious attacks like ransomware. ProSight Data Protection Services can help you back up, retrieve and restore files, folders, applications, system images, plus Microsoft Hyper-V and VMware images/. Critical data can be protected on the cloud, to an on-promises storage device, or to both. Progent's backup and recovery specialists can provide advanced expertise to configure ProSight Data Protection Services to be compliant with government and industry regulatory requirements like HIPAA, FINRA, PCI and Safe Harbor and, when necessary, can help you to restore your critical information. Read more about ProSight Data Protection Services Managed Cloud Backup.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of top data security vendors to provide centralized management and comprehensive protection for all your email traffic. The powerful architecture of Email Guard managed service integrates cloud-based filtering with a local gateway device to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. The cloud filter serves as a preliminary barricade and blocks the vast majority of threats from reaching your security perimeter. This reduces your vulnerability to external threats and conserves network bandwidth and storage space. Email Guard's onsite gateway appliance provides a deeper level of analysis for incoming email. For outgoing email, the onsite security gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local security gateway can also help Microsoft Exchange Server to monitor and protect internal email that stays within your corporate firewall. For more information, visit Email Guard spam filtering and data leakage protection.

  • ProSight WAN Watch: Network Infrastructure Management
    Progentís ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized organizations to map out, monitor, enhance and debug their connectivity appliances such as switches, firewalls, and wireless controllers as well as servers, printers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that network maps are kept updated, copies and displays the configuration information of almost all devices on your network, tracks performance, and sends alerts when potential issues are discovered. By automating complex management processes, ProSight WAN Watch can knock hours off common chores like making network diagrams, expanding your network, locating appliances that need important updates, or resolving performance bottlenecks. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

  • ProSight LAN Watch: Server and Desktop Monitoring and Management
    ProSight LAN Watch is Progentís server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management technology to keep your IT system running at peak levels by tracking the state of critical assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent automatically to your specified IT management staff and your assigned Progent engineering consultant so that all looming problems can be addressed before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop monitoring services.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
    With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a secure Tier III data center on a high-performance virtual host set up and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the apps. Because the system is virtualized, it can be ported immediately to a different hardware solution without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not tied one hosting service. Find out more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, update, retrieve and safeguard data about your network infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be warned about impending expirations of SSLs ,domains or warranties. By updating and organizing your IT documentation, you can eliminate up to 50% of time thrown away looking for critical information about your IT network. ProSight IT Asset Management includes a common location for holding and collaborating on all documents related to managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether youíre planning improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you need when you need it. Read more about ProSight IT Asset Management service.
For Edison 24-Hour Crypto-Ransomware Recovery Consulting, call Progent at 800-993-9400 or go to Contact Progent.