Ransomware : Your Crippling IT Nightmare
Ransomware  Remediation ProfessionalsRansomware has become a too-frequent cyber pandemic that represents an enterprise-level threat for organizations poorly prepared for an assault. Versions of ransomware such as Reveton, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for years and still cause havoc. Recent strains of ransomware like Ryuk and Hermes, along with frequent as yet unnamed viruses, not only encrypt on-line critical data but also infect many available system protection mechanisms. Information replicated to off-site disaster recovery sites can also be encrypted. In a poorly designed data protection solution, it can render any restore operations useless and basically sets the entire system back to square one.

Getting back online services and information after a crypto-ransomware intrusion becomes a sprint against time as the targeted organization tries its best to stop the spread and eradicate the crypto-ransomware and to resume mission-critical activity. Due to the fact that ransomware needs time to move laterally, assaults are usually sprung during nights and weekends, when attacks are likely to take longer to detect. This compounds the difficulty of rapidly mobilizing and organizing a qualified response team.

Progent makes available an assortment of solutions for protecting businesses from ransomware attacks. These include team training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus installation of next-generation security solutions with artificial intelligence capabilities to automatically detect and suppress zero-day cyber threats. Progent in addition offers the services of seasoned crypto-ransomware recovery professionals with the track record and perseverance to re-deploy a breached environment as soon as possible.

Progent's Ransomware Recovery Services
Soon after a ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will provide the keys to decrypt any or all of your files. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their data even after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is significantly higher than the usual ransomware demands, which ZDNET determined to be approximately $13,000. The fallback is to piece back together the vital parts of your Information Technology environment. Absent the availability of essential system backups, this calls for a broad range of IT skills, professional project management, and the capability to work non-stop until the task is done.

For two decades, Progent has offered professional Information Technology services for businesses in Schaumburg and throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned high-level industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, and SANS GIAC. (Visit Progent's certifications). Progent also has experience in accounting and ERP application software. This breadth of experience affords Progent the capability to efficiently determine necessary systems and consolidate the surviving parts of your network environment after a ransomware attack and assemble them into a functioning system.

Progent's recovery group deploys top notch project management applications to coordinate the complex recovery process. Progent knows the urgency of acting rapidly and together with a customerís management and Information Technology staff to prioritize tasks and to get key applications back on-line as soon as possible.

Customer Case Study: A Successful Ransomware Attack Restoration
A small business contacted Progent after their network was attacked by Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state hackers, possibly using technology leaked from the United States National Security Agency. Ryuk attacks specific businesses with little or no room for disruption and is one of the most lucrative instances of ransomware viruses. Major organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturer based in the Chicago metro area with about 500 workers. The Ryuk attack had brought down all company operations and manufacturing capabilities. The majority of the client's backups had been directly accessible at the start of the attack and were damaged. The client was pursuing financing for paying the ransom demand (in excess of $200K) and hoping for good luck, but in the end called Progent.


"I canít speak enough about the support Progent provided us throughout the most critical time of (our) businesses survival. We would have paid the criminal gangs if it wasnít for the confidence the Progent team gave us. The fact that you were able to get our messaging and important applications back online sooner than 1 week was amazing. Each expert I interacted with or e-mailed at Progent was absolutely committed on getting my company operational and was working 24/7 to bail us out."

Progent worked hand in hand the customer to rapidly get our arms around and prioritize the most important areas that needed to be restored in order to restart company functions:

  • Windows Active Directory
  • Electronic Messaging
  • MRP System
To begin, Progent adhered to ransomware event response industry best practices by stopping lateral movement and cleaning up infected systems. Progent then started the task of recovering Windows Active Directory, the heart of enterprise systems built upon Microsoft Windows Server technology. Exchange messaging will not operate without Windows AD, and the client's MRP software leveraged Microsoft SQL Server, which requires Windows AD for authentication to the databases.

In less than 48 hours, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then completed reinstallations and storage recovery on key systems. All Microsoft Exchange Server ties and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to locate intact OST files (Microsoft Outlook Off-Line Folder Files) on various desktop computers to recover email information. A not too old off-line backup of the client's manufacturing systems made them able to return these vital services back servicing users. Although a large amount of work was left to recover completely from the Ryuk virus, core systems were returned to operations rapidly:


"For the most part, the production manufacturing operation was never shut down and we did not miss any customer shipments."

During the following couple of weeks key milestones in the recovery process were completed through close cooperation between Progent engineers and the customer:

  • Self-hosted web applications were restored with no loss of information.
  • The MailStore Exchange Server containing more than 4 million archived emails was brought on-line and available for users.
  • CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control capabilities were completely restored.
  • A new Palo Alto 850 firewall was brought online.
  • Ninety percent of the desktop computers were being used by staff.

"A lot of what transpired in the initial days is mostly a fog for me, but our team will not soon forget the commitment each and every one of the team put in to help get our business back. I have entrusted Progent for at least 10 years, possibly more, and every time Progent has impressed me and delivered. This event was a Herculean accomplishment."

Conclusion
A probable business extinction catastrophe was averted with hard-working experts, a broad spectrum of knowledge, and tight teamwork. Although in analyzing the event afterwards the crypto-ransomware virus penetration detailed here would have been identified and stopped with modern cyber security technology and recognized best practices, staff training, and well thought out incident response procedures for backup and keeping systems up to date with security patches, the reality is that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, remember that Progent's roster of professionals has substantial experience in ransomware virus blocking, removal, and information systems restoration.


"So, to Darrin, Matt, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were involved), thanks very much for allowing me to get rested after we got past the most critical parts. All of you did an amazing job, and if any of your team is visiting the Chicago area, dinner is the least I can do!"

To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Schaumburg a portfolio of online monitoring and security evaluation services to help you to minimize your vulnerability to crypto-ransomware. These services incorporate next-generation machine learning capability to uncover new strains of ransomware that can get past legacy signature-based security solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring is an endpoint protection solution that utilizes next generation behavior-based machine learning technology to guard physical and virtual endpoint devices against modern malware attacks like ransomware and file-less exploits, which easily evade traditional signature-matching anti-virus tools. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a single platform to automate the entire threat progression including blocking, detection, mitigation, cleanup, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new attacks. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

  • ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
    Progent's ProSight Enhanced Security Protection (ESP) services offer ultra-affordable in-depth protection for physical and virtual servers, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced heuristics for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP provides firewall protection, penetration alarms, device management, and web filtering via leading-edge technologies incorporated within one agent accessible from a unified control. Progent's security and virtualization consultants can assist your business to plan and implement a ProSight ESP environment that meets your company's specific needs and that allows you achieve and demonstrate compliance with government and industry data security regulations. Progent will help you define and implement policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that require urgent attention. Progent's consultants can also assist your company to install and test a backup and restore system like ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange email filtering.

  • ProSight Data Protection Services: Managed Backup and Recovery
    ProSight Data Protection Services provide small and medium-sized organizations an affordable and fully managed service for secure backup/disaster recovery (BDR). For a low monthly price, ProSight Data Protection Services automates your backup processes and enables rapid recovery of critical data, applications and virtual machines that have become unavailable or corrupted due to component breakdowns, software bugs, natural disasters, human error, or malware attacks such as ransomware. ProSight Data Protection Services can help you protect, recover and restore files, folders, apps, system images, as well as Hyper-V and VMware virtual machine images. Important data can be protected on the cloud, to a local device, or to both. Progent's cloud backup consultants can provide advanced support to set up ProSight DPS to to comply with regulatory standards like HIPAA, FIRPA, PCI and Safe Harbor and, when necessary, can assist you to restore your critical data. Learn more about ProSight Data Protection Services Managed Cloud Backup.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of top data security companies to deliver web-based management and comprehensive security for all your email traffic. The hybrid architecture of Email Guard integrates cloud-based filtering with a local security gateway appliance to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The Cloud Protection Layer acts as a preliminary barricade and blocks most threats from making it to your network firewall. This decreases your exposure to external attacks and conserves system bandwidth and storage space. Email Guard's on-premises security gateway appliance adds a further level of analysis for inbound email. For outbound email, the local security gateway provides anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also help Exchange Server to monitor and protect internal email that originates and ends within your corporate firewall. For more information, see ProSight Email Guard spam and content filtering.

  • ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
    ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized organizations to map, track, optimize and debug their networking hardware like switches, firewalls, and wireless controllers plus servers, printers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that network maps are always current, captures and manages the configuration information of virtually all devices on your network, tracks performance, and generates alerts when potential issues are discovered. By automating tedious management and troubleshooting activities, ProSight WAN Watch can knock hours off common tasks like making network diagrams, expanding your network, finding devices that need important software patches, or isolating performance bottlenecks. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

  • ProSight LAN Watch: Server and Desktop Monitoring and Management
    ProSight LAN Watch is Progentís server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to help keep your IT system operating efficiently by checking the health of critical computers that power your business network. When ProSight LAN Watch uncovers a problem, an alert is transmitted automatically to your designated IT staff and your assigned Progent engineering consultant so that any looming problems can be resolved before they have a chance to disrupt your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

  • ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
    With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a protected Tier III data center on a high-performance virtual machine host configured and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting service model, the client owns the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be moved easily to an alternate hardware environment without a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and safeguard information related to your IT infrastructure, processes, applications, and services. You can instantly find passwords or serial numbers and be warned about upcoming expirations of SSLs ,domains or warranties. By cleaning up and organizing your IT documentation, you can eliminate as much as 50% of time wasted searching for critical information about your network. ProSight IT Asset Management features a centralized repository for holding and sharing all documents related to managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and relating IT information. Whether youíre planning enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the information you need when you need it. Find out more about Progent's ProSight IT Asset Management service.
For Schaumburg 24-7 Crypto Cleanup Consultants, call Progent at 800-993-9400 or go to Contact Progent.