Crypto-Ransomware : Your Feared IT Nightmare
Ransomware has become an escalating cyberplague that represents an extinction-level danger for businesses of all sizes poorly prepared for an assault. Versions of crypto-ransomware such as Reveton, Fusob, Locky, SamSam and MongoLock cryptoworms have been replicating for years and still cause damage. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, plus frequent as yet unnamed malware, not only do encryption of online critical data but also infect most configured system protection. Files synched to the cloud can also be encrypted. In a poorly designed data protection solution, this can make any restoration impossible and effectively sets the entire system back to square one.
Recovering applications and data after a ransomware event becomes a race against the clock as the targeted organization struggles to contain the damage, cleanup the virus, and restore mission-critical operations. Since crypto-ransomware takes time to move laterally, attacks are usually sprung during weekends and nights, when successful attacks in many cases take more time to recognize. This compounds the difficulty of promptly mobilizing and organizing a knowledgeable response team.
Progent offers an assortment of solutions for securing enterprises from ransomware attacks. These include staff education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of the latest generation security appliances with AI technology from SentinelOne to identify and disable new cyber threats quickly. Progent in addition offers the assistance of veteran ransomware recovery consultants with the track record and commitment to re-deploy a compromised system as quickly as possible.
Progent's Ransomware Restoration Support Services
Soon after a ransomware attack, paying the ransom in cryptocurrency does not ensure that cyber hackers will return the keys to decrypt all your data. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to piece back together the vital elements of your IT environment. Without the availability of essential data backups, this calls for a broad complement of IT skills, top notch project management, and the capability to work 24x7 until the recovery project is done.
For twenty years, Progent has provided certified expert Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned advanced certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial management and ERP application software. This breadth of expertise gives Progent the capability to rapidly understand necessary systems and organize the surviving parts of your Information Technology environment following a ransomware event and assemble them into a functioning system.
Progent's security team deploys state-of-the-art project management tools to coordinate the complex restoration process. Progent knows the importance of acting rapidly and in concert with a customer's management and IT team members to assign priority to tasks and to get critical systems back on line as fast as humanly possible.
Business Case Study: A Successful Ransomware Incident Response
A small business hired Progent after their organization was attacked by the Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state cybercriminals, suspected of using approaches leaked from the U.S. National Security Agency. Ryuk targets specific businesses with little tolerance for disruption and is among the most profitable versions of ransomware malware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturer located in Chicago with about 500 employees. The Ryuk penetration had brought down all essential operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the start of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for the best, but ultimately engaged Progent.
"I cannot tell you enough in regards to the care Progent provided us during the most stressful period of (our) businesses survival. We may have had to pay the criminal gangs except for the confidence the Progent experts afforded us. The fact that you were able to get our messaging and essential applications back online sooner than one week was amazing. Each staff member I spoke to or communicated with at Progent was absolutely committed on getting us working again and was working day and night on our behalf."
Progent worked together with the client to rapidly determine and prioritize the essential elements that had to be restored in order to resume business operations:
- Active Directory (AD)
- Email
- MRP System
To begin, Progent followed Anti-virus event response industry best practices by stopping lateral movement and cleaning systems of viruses. Progent then started the steps of bringing back online Active Directory, the foundation of enterprise networks built upon Microsoft Windows Server technology. Microsoft Exchange email will not work without AD, and the businesses' financials and MRP applications used SQL Server, which requires Active Directory services for access to the databases.
In less than two days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then initiated rebuilding and storage recovery of mission critical applications. All Exchange schema and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to locate local OST files (Microsoft Outlook Offline Folder Files) on staff desktop computers to recover mail information. A recent offline backup of the client's accounting/MRP software made it possible to restore these vital applications back servicing users. Although significant work needed to be completed to recover totally from the Ryuk damage, core services were recovered quickly:
"For the most part, the assembly line operation never missed a beat and we produced all customer sales."
Over the next month key milestones in the recovery project were made through close cooperation between Progent engineers and the client:
- Internal web applications were returned to operation without losing any data.
- The MailStore Server exceeding 4 million historical messages was restored to operations and accessible to users.
- CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control functions were 100% functional.
- A new Palo Alto Networks 850 security appliance was brought online.
- 90% of the desktops and laptops were fully operational.
"So much of what went on in the early hours is nearly entirely a fog for me, but my management will not forget the urgency each of you put in to give us our company back. I have trusted Progent for at least 10 years, possibly more, and every time I needed help Progent has outperformed my expectations and delivered as promised. This event was a stunning achievement."
Conclusion
A possible business-killing disaster was evaded through the efforts of dedicated professionals, a wide array of IT skills, and close collaboration. Although in hindsight the ransomware virus penetration described here should have been disabled with up-to-date cyber security systems and ISO/IEC 27001 best practices, user training, and properly executed incident response procedures for information backup and proper patching controls, the reality remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware virus, remember that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, cleanup, and file recovery.
"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were contributing), thank you for letting me get rested after we made it past the initial push. All of you did an amazing job, and if any of your team is visiting the Chicago area, dinner is on me!"
To read or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)
Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Grand Rapids a variety of remote monitoring and security evaluation services designed to help you to minimize your vulnerability to ransomware. These services incorporate next-generation machine learning capability to uncover zero-day strains of crypto-ransomware that can escape detection by traditional signature-based security products.
- ProSight LAN Watch: Server and Desktop Remote Monitoring
ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management (RMM) techniques to keep your network running efficiently by tracking the state of critical computers that drive your business network. When ProSight LAN Watch uncovers a problem, an alert is transmitted immediately to your specified IT management personnel and your Progent consultant so that all potential issues can be addressed before they have a chance to impact productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.
- ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven solution for managing your client-server infrastructure by providing tools for performing common tedious tasks. These include health monitoring, patch management, automated remediation, endpoint setup, backup and restore, A/V defense, remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your designated IT management personnel and your assigned Progent technical consultant so that emerging problems can be fixed before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.
- ProSight WAN Watch: Network Infrastructure Management
ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for small and mid-sized organizations to map, monitor, reconfigure and debug their connectivity appliances like routers, firewalls, and access points as well as servers, client computers and other devices. Incorporating cutting-edge RMM technology, WAN Watch makes sure that network maps are kept updated, captures and displays the configuration information of virtually all devices on your network, monitors performance, and generates notices when problems are detected. By automating time-consuming network management activities, ProSight WAN Watch can knock hours off common tasks like making network diagrams, reconfiguring your network, finding appliances that need important updates, or resolving performance bottlenecks. Learn more about ProSight WAN Watch network infrastructure management services.
- ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
ProSight Reporting is an expanding suite of in-depth reporting plug-ins created to integrate with the industry's leading ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues like spotty support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.
- ProSight Data Protection Services (DPS): Backup and Recovery Services
Progent has partnered with leading backup software companies to produce ProSight Data Protection Services (DPS), a portfolio of management offerings that provide backup-as-a-service. ProSight DPS services manage and track your data backup processes and allow non-disruptive backup and rapid restoration of critical files, apps, images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you protect against data loss resulting from equipment breakdown, natural calamities, fire, malware like ransomware, user mistakes, malicious insiders, or software bugs. Managed backup services available in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to identify which of these managed services are best suited for your network.
- ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of top information security vendors to deliver centralized management and world-class protection for all your inbound and outbound email. The hybrid architecture of Email Guard integrates a Cloud Protection Layer with an on-premises gateway device to provide complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. The Cloud Protection Layer serves as a preliminary barricade and keeps most unwanted email from making it to your network firewall. This reduces your vulnerability to inbound attacks and conserves network bandwidth and storage. Email Guard's onsite security gateway device provides a deeper level of analysis for inbound email. For outbound email, the on-premises gateway offers anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The on-premises security gateway can also assist Microsoft Exchange Server to track and safeguard internal email traffic that stays within your security perimeter. For more details, visit ProSight Email Guard spam and content filtering.
- ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
Progent's Duo authentication service plans incorporate Cisco's Duo technology to protect against password theft through the use of two-factor authentication (2FA). Duo enables one-tap identity verification on Apple iOS, Android, and other personal devices. With 2FA, when you log into a protected application and give your password you are requested to confirm who you are on a unit that only you have and that uses a separate network channel. A broad range of devices can be used as this added means of authentication including an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You may register several verification devices. To find out more about ProSight Duo two-factor identity validation services, visit Duo MFA two-factor authentication services for access security.
- Outsourced/Co-managed Help Desk: Help Desk Managed Services
Progent's Support Desk managed services enable your IT team to outsource Support Desk services to Progent or split responsibilities for support services seamlessly between your internal support resources and Progent's nationwide pool of IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service provides a transparent supplement to your corporate network support team. Client interaction with the Help Desk, provision of technical assistance, escalation, ticket generation and tracking, performance metrics, and management of the support database are cohesive whether issues are resolved by your corporate IT support organization, by Progent, or a mix of the two. Read more about Progent's outsourced/shared Help Center services.
- Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates next generation behavior-based machine learning tools to guard endpoints and servers and VMs against modern malware attacks such as ransomware and email phishing, which easily get by traditional signature-matching AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and provides a single platform to automate the complete threat progression including filtering, detection, mitigation, remediation, and forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Learn more about Progent's ransomware defense and recovery services.
- ProSight IT Asset Management: Network Documentation Management
ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, retrieve and safeguard information about your IT infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be warned about impending expirations of SSL certificates ,domains or warranties. By cleaning up and organizing your IT documentation, you can save up to 50% of time spent trying to find critical information about your IT network. ProSight IT Asset Management features a centralized repository for holding and sharing all documents required for managing your network infrastructure like standard operating procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT data. Whether you're planning enhancements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you need the instant you need it. Read more about ProSight IT Asset Management service.
- Progent's Patch Management: Patch Management Services
Progent's managed services for software and firmware patch management provide organizations of any size a flexible and affordable solution for evaluating, validating, scheduling, applying, and tracking software and firmware updates to your ever-evolving IT system. In addition to optimizing the security and reliability of your computer environment, Progent's patch management services free up time for your IT team to concentrate on more strategic initiatives and activities that deliver the highest business value from your information network. Read more about Progent's software/firmware update management support services.
- ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
With ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host configured and maintained by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the OS platforms, and the applications. Because the environment is virtualized, it can be moved immediately to an alternate hosting environment without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into one hosting provider. Learn more details about ProSight Virtual Hosting services.
- ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
Progent's ProSight Active Security Monitoring is an endpoint protection service that utilizes SentinelOne's next generation behavior-based analysis technology to defend physical and virtual endpoints against new malware attacks like ransomware and file-less exploits, which easily escape legacy signature-matching anti-virus tools. ProSight ASM safeguards on-premises and cloud-based resources and offers a unified platform to address the entire malware attack lifecycle including blocking, detection, containment, remediation, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.
- ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
Progent's ProSight Enhanced Security Protection services offer ultra-affordable multi-layer protection for physical and virtual servers, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and advanced machine learning for continuously monitoring and responding to security assaults from all vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, device control, and web filtering through cutting-edge tools incorporated within a single agent accessible from a unified control. Progent's data protection and virtualization consultants can help you to design and implement a ProSight ESP deployment that meets your company's unique needs and that allows you demonstrate compliance with legal and industry information protection standards. Progent will assist you define and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that call for immediate action. Progent's consultants can also assist your company to set up and test a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can recover quickly from a destructive cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.
For Grand Rapids 24-Hour Ransomware Removal Support Services, contact Progent at 800-462-8800 or go to Contact Progent.