24-7 Aurora Emergency Crypto
Malware Damage Assessment and Repair Services

Crypto-Ransomware : Your Crippling IT Nightmare
Ransomware has become an escalating cyberplague that poses an extinction-level danger for businesses of all sizes poorly prepared for an assault. Different versions of crypto-ransomware such as Dharma, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and still inflict havoc. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, plus frequent unnamed malware, not only do encryption of on-line information but also infect most configured system backups. Files synchronized to the cloud can also be corrupted. In a poorly architected environment, this can make automated restoration useless and effectively knocks the network back to zero.

Restoring programs and data following a ransomware attack becomes a race against the clock as the victim tries its best to stop lateral movement, remove the virus, and resume mission-critical activity. Because crypto-ransomware requires time to spread, penetrations are frequently launched during weekends and nights, when penetrations tend to take longer to discover. This multiplies the difficulty of quickly marshalling and orchestrating a capable mitigation team.

Progent makes available a range of help services for protecting businesses from ransomware attacks. Among these are team member training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of the latest generation security gateways with machine learning capabilities from SentinelOne to identify and quarantine new threats automatically. Progent also offers the assistance of veteran crypto-ransomware recovery engineers with the talent and perseverance to rebuild a compromised system as soon as possible.

Progent's Ransomware Recovery Help
Subsequent to a crypto-ransomware invasion, even paying the ransom demands in cryptocurrency does not ensure that cyber criminals will respond with the keys to decrypt all your information. Kaspersky ascertained that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to re-install the critical elements of your IT environment. Without access to essential data backups, this requires a broad complement of IT skills, top notch team management, and the capability to work non-stop until the job is over.

For two decades, Progent has made available certified expert IT services for businesses across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial systems and ERP applications. This breadth of experience gives Progent the skills to quickly ascertain necessary systems and integrate the remaining parts of your Information Technology system after a crypto-ransomware attack and configure them into a functioning network.

Progent's security team of experts uses best of breed project management systems to coordinate the sophisticated recovery process. Progent appreciates the urgency of acting quickly and in unison with a customer's management and IT resources to prioritize tasks and to put essential services back online as soon as humanly possible.

Case Study: A Successful Crypto-Ransomware Incident Recovery
A small business engaged Progent after their network system was penetrated by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state sponsored criminal gangs, possibly adopting techniques leaked from the United States NSA organization. Ryuk attacks specific companies with limited room for disruption and is among the most lucrative examples of ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturer based in Chicago with about 500 employees. The Ryuk intrusion had brought down all essential operations and manufacturing capabilities. Most of the client's backups had been directly accessible at the beginning of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and hoping for the best, but ultimately utilized Progent.

Progent worked with the customer to quickly assess and prioritize the critical elements that had to be restored to make it possible to resume departmental functions:

• Microsoft Active Directory
• E-Mail
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then performed setup and hard drive recovery on mission critical servers. All Microsoft Exchange Server data and attributes were intact, which facilitated the rebuild of Exchange. Progent was able to find non-encrypted OST files (Outlook Email Offline Folder Files) on team PCs in order to recover email data. A recent off-line backup of the customer's financials/MRP software made them able to restore these vital programs back servicing users. Although major work was left to recover fully from the Ryuk event, critical services were recovered quickly:

During the next couple of weeks key milestones in the recovery project were completed in tight cooperation between Progent consultants and the customer:

• Self-hosted web applications were brought back up without losing any information.
• The MailStore Server exceeding 4 million archived emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/AP/AR/Inventory Control capabilities were fully operational.
• A new Palo Alto Networks 850 security appliance was installed.
• Most of the user desktops were functioning as before the incident.

Conclusion
A possible business-killing catastrophe was avoided due to results-oriented experts, a broad array of technical expertise, and close collaboration. Although in analyzing the event afterwards the ransomware incident detailed here would have been shut down with current security technology solutions and NIST Cybersecurity Framework best practices, user and IT administrator education, and well designed incident response procedures for information backup and applying software patches, the fact remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has proven experience in ransomware virus defense, removal, and data restoration.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Aurora a variety of remote monitoring and security assessment services designed to assist you to minimize the threat from ransomware. These services incorporate modern machine learning technology to detect new variants of ransomware that are able to evade traditional signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management (RMM) technology to keep your IT system operating efficiently by checking the state of vital computers that drive your information system. When ProSight LAN Watch detects an issue, an alert is transmitted immediately to your designated IT management personnel and your Progent consultant so any potential issues can be addressed before they can disrupt productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for monitoring and managing your client-server infrastructure by offering tools for streamlining common tedious jobs. These can include health checking, update management, automated repairs, endpoint configuration, backup and restore, anti-virus response, secure remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and debugging support. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alert to your designated IT management personnel and your assigned Progent technical consultant so that potential problems can be taken care of before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for smaller businesses to map, monitor, enhance and debug their connectivity hardware such as switches, firewalls, and access points plus servers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are always updated, captures and manages the configuration of almost all devices on your network, monitors performance, and generates alerts when problems are detected. By automating complex management processes, WAN Watch can knock hours off ordinary tasks like network mapping, reconfiguring your network, locating appliances that require critical updates, or identifying the cause of performance issues. Learn more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of in-depth reporting utilities created to work with the industry's leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues like inconsistent support follow-up or machines with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software companies to create ProSight Data Protection Services (DPS), a family of subscription-based offerings that deliver backup-as-a-service. ProSight DPS services manage and track your data backup operations and enable non-disruptive backup and fast recovery of critical files/folders, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss caused by equipment failures, natural calamities, fire, malware like ransomware, human error, malicious insiders, or application glitches. Managed services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can help you to identify which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of top information security companies to deliver web-based control and comprehensive security for all your inbound and outbound email. The powerful structure of Email Guard managed service combines a Cloud Protection Layer with a local gateway appliance to provide advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's Cloud Protection Layer serves as a first line of defense and blocks the vast majority of unwanted email from making it to your security perimeter. This decreases your vulnerability to external attacks and saves system bandwidth and storage. Email Guard's onsite gateway device provides a further layer of analysis for incoming email. For outbound email, the local gateway provides AV and anti-spam protection, protection against data leaks, and email encryption. The on-premises security gateway can also assist Exchange Server to track and protect internal email that stays inside your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA services utilize Cisco's Duo technology to defend against password theft through the use of two-factor authentication (2FA). Duo enables single-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. Using Duo 2FA, when you sign into a protected application and enter your password you are requested to verify your identity via a unit that only you possess and that uses a different ("out-of-band") network channel. A wide selection of out-of-band devices can be used as this second form of authentication including an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can register multiple validation devices. For details about Duo identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Center: Help Desk Managed Services
  Progent's Support Desk managed services allow your IT team to outsource Support Desk services to Progent or divide activity for Help Desk services transparently between your internal network support team and Progent's extensive pool of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a seamless extension of your core IT support group. User interaction with the Help Desk, provision of support services, issue escalation, ticket generation and updates, performance measurement, and management of the support database are cohesive regardless of whether incidents are taken care of by your core network support resources, by Progent's team, or a mix of the two. Learn more about Progent's outsourced/co-managed Call Center services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes next generation behavior machine learning technology to guard endpoints and physical and virtual servers against modern malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard local and cloud-based resources and provides a unified platform to automate the complete malware attack progression including protection, detection, containment, remediation, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, retrieve and safeguard information about your network infrastructure, processes, business apps, and services. You can instantly find passwords or serial numbers and be warned automatically about impending expirations of SSL certificates ,domains or warranties. By cleaning up and organizing your network documentation, you can eliminate as much as 50% of time spent looking for vital information about your network. ProSight IT Asset Management features a common location for holding and collaborating on all documents related to managing your network infrastructure like recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT data. Whether you're planning improvements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you require the instant you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer businesses of any size a flexible and cost-effective alternative for assessing, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving IT system. Besides maximizing the security and reliability of your IT environment, Progent's software/firmware update management services free up time for your IT team to concentrate on more strategic projects and tasks that derive maximum business value from your network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a protected fault tolerant data center on a fast virtual host set up and maintained by Progent's network support experts. With the ProSight Virtual Hosting model, the customer retains ownership of the data, the OS software, and the apps. Because the environment is virtualized, it can be moved immediately to a different hardware solution without requiring a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior-based analysis tools to guard physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which routinely escape legacy signature-matching anti-virus tools. ProSight ASM safeguards on-premises and cloud resources and provides a unified platform to address the complete malware attack progression including protection, infiltration detection, mitigation, remediation, and forensics. Key features include single-click rollback using Windows VSS and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable in-depth security for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and modern behavior analysis for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP delivers firewall protection, intrusion alerts, device control, and web filtering through cutting-edge technologies packaged within one agent managed from a unified console. Progent's data protection and virtualization consultants can assist your business to plan and configure a ProSight ESP deployment that addresses your organization's unique requirements and that helps you prove compliance with government and industry information protection regulations. Progent will assist you define and implement policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require immediate attention. Progent can also help you to install and test a backup and restore system such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange filtering.