Ransomware : Your Crippling IT Disaster
Ransomware  Remediation ProfessionalsRansomware has become an escalating cyberplague that represents an extinction-level danger for businesses poorly prepared for an assault. Different iterations of crypto-ransomware such as CryptoLocker, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been circulating for many years and still cause destruction. More recent variants of ransomware like Ryuk and Hermes, as well as frequent unnamed malware, not only encrypt online data files but also infect many configured system protection. Files replicated to the cloud can also be rendered useless. In a poorly architected environment, it can render any restore operations useless and basically knocks the entire system back to square one.

Getting back on-line applications and data after a crypto-ransomware attack becomes a sprint against time as the victim tries its best to stop the spread and cleanup the ransomware and to restore enterprise-critical activity. Due to the fact that ransomware requires time to replicate, assaults are often launched during weekends and nights, when successful penetrations may take more time to discover. This multiplies the difficulty of promptly mobilizing and orchestrating a qualified response team.

Progent has a variety of services for protecting businesses from ransomware events. These include team training to help identify and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of modern security solutions with machine learning capabilities to quickly discover and extinguish new cyber attacks. Progent in addition provides the services of expert ransomware recovery engineers with the skills and commitment to restore a compromised system as quickly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Soon after a ransomware attack, sending the ransom in Bitcoin cryptocurrency does not ensure that cyber criminals will provide the keys to unencrypt any of your data. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their files after having paid the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is greatly higher than the average ransomware demands, which ZDNET estimates to be in the range of $13,000. The other path is to re-install the critical elements of your IT environment. Absent access to full system backups, this requires a wide complement of skills, well-coordinated project management, and the ability to work 24x7 until the recovery project is over.

For decades, Progent has offered certified expert Information Technology services for businesses in Wilmington and throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded top certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent in addition has expertise in financial systems and ERP application software. This breadth of experience affords Progent the skills to rapidly ascertain necessary systems and organize the remaining components of your IT environment after a ransomware event and rebuild them into a functioning network.

Progent's security group deploys best of breed project management systems to coordinate the complex recovery process. Progent knows the importance of acting rapidly and in unison with a customerís management and IT staff to assign priority to tasks and to get essential applications back on line as fast as humanly possible.

Client Case Study: A Successful Ransomware Incident Response
A small business sought out Progent after their organization was attacked by the Ryuk ransomware. Ryuk is believed to have been developed by North Korean state sponsored cybercriminals, suspected of adopting technology exposed from the United States NSA organization. Ryuk goes after specific companies with limited tolerance for operational disruption and is among the most profitable versions of crypto-ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in Chicago and has around 500 staff members. The Ryuk penetration had frozen all essential operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the time of the intrusion and were destroyed. The client was taking steps for paying the ransom demand (more than $200,000) and hoping for the best, but in the end called Progent.


"I canít say enough in regards to the help Progent provided us during the most fearful period of (our) businesses existence. We would have paid the cyber criminals if it wasnít for the confidence the Progent experts afforded us. The fact that you were able to get our e-mail and important servers back on-line sooner than a week was amazing. Every single staff member I got help from or e-mailed at Progent was laser focused on getting us working again and was working breakneck pace to bail us out."

Progent worked hand in hand the client to quickly assess and prioritize the essential applications that needed to be restored to make it possible to resume company functions:

  • Microsoft Active Directory
  • Microsoft Exchange Server
  • MRP System
To start, Progent followed Anti-virus event mitigation best practices by halting the spread and removing active viruses. Progent then initiated the task of bringing back online Microsoft Active Directory, the foundation of enterprise systems built on Microsoft Windows Server technology. Microsoft Exchange Server messaging will not operate without AD, and the client's MRP software utilized Microsoft SQL, which depends on Windows AD for security authorization to the information.

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then charged ahead with rebuilding and hard drive recovery on the most important systems. All Microsoft Exchange Server ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to locate local OST data files (Microsoft Outlook Offline Data Files) on user desktop computers and laptops in order to recover email information. A not too old off-line backup of the businesses accounting systems made it possible to recover these vital applications back online. Although a lot of work remained to recover completely from the Ryuk event, essential systems were returned to operations quickly:


"For the most part, the production line operation did not miss a beat and we made all customer orders."

Throughout the next month key milestones in the recovery project were achieved through close cooperation between Progent team members and the client:

  • In-house web applications were returned to operation with no loss of data.
  • The MailStore Microsoft Exchange Server with over four million archived emails was brought online and accessible to users.
  • CRM/Customer Orders/Invoicing/AP/AR/Inventory modules were completely restored.
  • A new Palo Alto Networks 850 firewall was brought online.
  • Nearly all of the user workstations were fully operational.

"So much of what was accomplished those first few days is mostly a blur for me, but my management will not forget the dedication each and every one of you put in to give us our business back. Iíve entrusted Progent for the past ten years, possibly more, and each time Progent has outperformed my expectations and delivered. This situation was no exception but maybe more Herculean."

Conclusion
A potential enterprise-killing disaster was averted due to hard-working professionals, a wide range of knowledge, and tight teamwork. Although in post mortem the ransomware penetration described here would have been identified and prevented with current cyber security solutions and ISO/IEC 27001 best practices, team training, and properly executed incident response procedures for information backup and keeping systems up to date with security patches, the fact remains that state-sponsored cybercriminals from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a ransomware incursion, remember that Progent's roster of experts has extensive experience in crypto-ransomware virus blocking, remediation, and file disaster recovery.


"So, to Darrin, Matt, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others that were helping), thanks very much for making it so I could get some sleep after we made it through the most critical parts. All of you did an incredible effort, and if anyone is around the Chicago area, dinner is my treat!"

To review or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Wilmington a variety of remote monitoring and security evaluation services designed to assist you to reduce your vulnerability to ransomware. These services incorporate next-generation artificial intelligence technology to uncover zero-day strains of ransomware that are able to get past legacy signature-based anti-virus products.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates next generation behavior-based machine learning tools to guard physical and virtual endpoint devices against modern malware assaults like ransomware and email phishing, which easily escape traditional signature-based anti-virus products. ProSight Active Security Monitoring safeguards local and cloud resources and offers a unified platform to manage the complete threat lifecycle including protection, infiltration detection, containment, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

  • ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
    Progent's ProSight Enhanced Security Protection services deliver ultra-affordable in-depth security for physical servers and VMs, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and responding to cyber assaults from all vectors. ProSight ESP provides firewall protection, penetration alerts, endpoint management, and web filtering via leading-edge technologies packaged within one agent managed from a single console. Progent's security and virtualization consultants can help your business to design and implement a ProSight ESP deployment that addresses your organization's unique requirements and that helps you prove compliance with legal and industry data security regulations. Progent will help you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that require urgent action. Progent can also assist you to set up and test a backup and disaster recovery solution like ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange filtering.

  • ProSight Data Protection Services: Managed Backup and Recovery
    ProSight Data Protection Services from Progent offer small and medium-sized organizations an affordable and fully managed service for reliable backup/disaster recovery (BDR). Available at a fixed monthly cost, ProSight Data Protection Services automates and monitors your backup activities and allows rapid restoration of vital data, applications and VMs that have become lost or damaged as a result of hardware failures, software bugs, natural disasters, human mistakes, or malicious attacks like ransomware. ProSight Data Protection Services can help you protect, recover and restore files, folders, applications, system images, plus Microsoft Hyper-V and VMware images/. Critical data can be protected on the cloud, to a local device, or to both. Progent's backup and recovery consultants can provide world-class expertise to set up ProSight Data Protection Services to be compliant with regulatory standards like HIPAA, FINRA, PCI and Safe Harbor and, when needed, can assist you to recover your critical data. Find out more about ProSight Data Protection Services Managed Cloud Backup and Recovery.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of leading data security companies to provide web-based control and comprehensive protection for your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service combines cloud-based filtering with a local security gateway device to provide advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's cloud filter acts as a first line of defense and blocks the vast majority of threats from making it to your network firewall. This decreases your vulnerability to inbound attacks and saves system bandwidth and storage space. Email Guard's on-premises security gateway device provides a deeper level of analysis for incoming email. For outgoing email, the on-premises gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also help Exchange Server to monitor and safeguard internal email that stays inside your corporate firewall. For more details, visit Email Guard spam filtering and data leakage protection.

  • ProSight WAN Watch: Infrastructure Remote Monitoring and Management
    Progentís ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to map out, track, reconfigure and debug their networking appliances such as routers, firewalls, and load balancers as well as servers, client computers and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology maps are kept current, captures and displays the configuration information of virtually all devices on your network, monitors performance, and sends alerts when potential issues are discovered. By automating time-consuming network management activities, WAN Watch can cut hours off ordinary tasks such as network mapping, reconfiguring your network, locating devices that require critical software patches, or resolving performance issues. Find out more details about ProSight WAN Watch network infrastructure management services.

  • ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
    ProSight LAN Watch is Progentís server and desktop monitoring service that uses advanced remote monitoring and management (RMM) technology to help keep your IT system operating efficiently by checking the state of vital assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent immediately to your specified IT management personnel and your assigned Progent engineering consultant so that all looming issues can be addressed before they can impact productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

  • ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
    With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a secure fault tolerant data center on a high-performance virtual host configured and managed by Progent's network support experts. Under Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the OS software, and the applications. Since the environment is virtualized, it can be ported immediately to an alternate hosting environment without a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, retrieve and safeguard information related to your IT infrastructure, procedures, applications, and services. You can instantly find passwords or IP addresses and be alerted about impending expirations of SSLs or domains. By cleaning up and managing your network documentation, you can save as much as 50% of time wasted looking for vital information about your network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents related to managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT information. Whether youíre making enhancements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the information you require when you need it. Find out more about Progent's ProSight IT Asset Management service.
For Wilmington 24-7 Crypto-Ransomware Remediation Help, reach out to Progent at 800-993-9400 or go to Contact Progent.