Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware  Remediation ExpertsRansomware has become an escalating cyberplague that poses an existential danger for businesses of all sizes poorly prepared for an attack. Multiple generations of ransomware such as CryptoLocker, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been around for years and still inflict havoc. The latest versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, along with frequent unnamed malware, not only encrypt on-line files but also infiltrate all configured system restores and backups. Files synchronized to cloud environments can also be rendered useless. In a poorly designed environment, it can make automated restore operations hopeless and effectively sets the entire system back to square one.

Restoring programs and data after a ransomware intrusion becomes a race against time as the targeted organization fights to stop lateral movement and clear the virus and to restore mission-critical activity. Due to the fact that crypto-ransomware requires time to replicate, penetrations are usually sprung on weekends and holidays, when successful attacks in many cases take longer to detect. This multiplies the difficulty of rapidly marshalling and organizing an experienced mitigation team.

Progent makes available a range of solutions for protecting enterprises from ransomware events. Among these are team member training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of next-generation security solutions with AI technology to intelligently discover and suppress zero-day cyber attacks. Progent in addition can provide the services of experienced crypto-ransomware recovery engineers with the skills and perseverance to re-deploy a compromised environment as quickly as possible.

Progent's Ransomware Restoration Support Services
After a crypto-ransomware event, paying the ransom demands in Bitcoin cryptocurrency does not guarantee that cyber hackers will provide the needed keys to decipher any of your data. Kaspersky determined that 17% of ransomware victims never recovered their information even after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is well above the typical ransomware demands, which ZDNET averages to be approximately $13,000. The fallback is to re-install the critical components of your IT environment. Absent the availability of complete data backups, this calls for a wide complement of skill sets, professional team management, and the willingness to work 24x7 until the task is finished.

For twenty years, Progent has provided expert Information Technology services for companies in Roseville and throughout the U.S. and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned high-level certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-recognized industry certifications including CISA, CISSP, CRISC, and SANS GIAC. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of experience provides Progent the skills to efficiently identify necessary systems and consolidate the surviving pieces of your Information Technology environment following a ransomware event and configure them into an operational system.

Progent's recovery team of experts utilizes state-of-the-art project management systems to orchestrate the complex recovery process. Progent appreciates the importance of acting swiftly and together with a client's management and IT team members to prioritize tasks and to get critical services back online as fast as humanly possible.

Client Story: A Successful Crypto-Ransomware Virus Restoration
A small business escalated to Progent after their network was taken over by Ryuk ransomware. Ryuk is thought to have been created by Northern Korean government sponsored hackers, suspected of adopting approaches exposed from the U.S. NSA organization. Ryuk targets specific companies with limited tolerance for operational disruption and is among the most profitable examples of ransomware viruses. Major targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company located in Chicago and has about 500 staff members. The Ryuk attack had brought down all company operations and manufacturing processes. The majority of the client's data backups had been on-line at the beginning of the intrusion and were damaged. The client was taking steps for paying the ransom (exceeding two hundred thousand dollars) and hoping for good luck, but ultimately called Progent.


"I cannot thank you enough about the help Progent gave us throughout the most stressful time of (our) businesses existence. We would have paid the cyber criminals behind the attack if not for the confidence the Progent experts gave us. The fact that you could get our e-mail system and important servers back on-line quicker than 1 week was beyond my wildest dreams. Each expert I talked with or e-mailed at Progent was absolutely committed on getting us back on-line and was working at all hours on our behalf."

Progent worked with the client to rapidly assess and prioritize the key systems that had to be addressed to make it possible to resume company functions:

  • Microsoft Active Directory
  • Email
  • Financials/MRP
To start, Progent followed Anti-virus event mitigation best practices by halting the spread and performing virus removal steps. Progent then started the task of restoring Microsoft AD, the core of enterprise systems built upon Microsoft Windows Server technology. Microsoft Exchange Server email will not operate without Windows AD, and the businessesí financials and MRP system used Microsoft SQL Server, which needs Active Directory for security authorization to the data.

Within 2 days, Progent was able to restore Active Directory to its pre-attack state. Progent then performed setup and hard drive recovery of essential servers. All Exchange schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was able to find local OST files (Outlook Offline Folder Files) on various desktop computers and laptops in order to recover mail messages. A recent offline backup of the client's accounting/MRP systems made them able to recover these vital programs back on-line. Although a lot of work needed to be completed to recover totally from the Ryuk virus, core systems were recovered rapidly:


"For the most part, the production manufacturing operation showed little impact and we made all customer orders."

Over the next few weeks important milestones in the recovery project were completed in tight cooperation between Progent team members and the client:

  • In-house web applications were brought back up with no loss of data.
  • The MailStore Microsoft Exchange Server containing more than 4 million archived messages was brought online and accessible to users.
  • CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory capabilities were fully restored.
  • A new Palo Alto 850 firewall was set up and programmed.
  • Most of the user PCs were operational.

"Much of what transpired those first few days is mostly a blur for me, but I will not soon forget the countless hours each of the team accomplished to give us our business back. I have utilized Progent for the past ten years, possibly more, and every time Progent has come through and delivered. This situation was a testament to your capabilities."

Conclusion
A potential business-ending catastrophe was avoided due to hard-working professionals, a wide spectrum of knowledge, and close teamwork. Although in hindsight the crypto-ransomware penetration detailed here could have been identified and blocked with modern security technology solutions and recognized best practices, user training, and well thought out incident response procedures for backup and applying software patches, the reality remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware incident, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, remediation, and file recovery.


"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others that were involved), thank you for allowing me to get some sleep after we made it through the most critical parts. All of you did an impressive job, and if anyone that helped is in the Chicago area, dinner is on me!"

To read or download a PDF version of this customer story, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Roseville a portfolio of remote monitoring and security evaluation services to assist you to minimize the threat from crypto-ransomware. These services incorporate modern artificial intelligence capability to uncover zero-day variants of ransomware that are able to get past traditional signature-based anti-virus solutions.

  • ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
    ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates next generation behavior-based machine learning tools to defend physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which easily get by traditional signature-based AV tools. ProSight Active Security Monitoring protects on-premises and cloud-based resources and provides a unified platform to address the complete malware attack progression including protection, detection, mitigation, cleanup, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new attacks. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

  • ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
    ProSight Enhanced Security Protection managed services offer economical in-depth protection for physical servers and virtual machines, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and responding to security assaults from all vectors. ProSight ESP delivers firewall protection, intrusion alerts, endpoint management, and web filtering via cutting-edge tools packaged within one agent managed from a unified control. Progent's security and virtualization consultants can assist your business to plan and implement a ProSight ESP environment that meets your company's unique requirements and that allows you demonstrate compliance with government and industry data security standards. Progent will assist you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that require immediate action. Progent can also help your company to install and test a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange filtering.

  • ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
    Progent has partnered with advanced backup/restore technology companies to produce ProSight Data Protection Services (DPS), a family of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS products manage and track your data backup processes and allow transparent backup and fast recovery of critical files/folders, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss caused by hardware failures, natural calamities, fire, cyber attacks such as ransomware, human error, ill-intentioned employees, or application bugs. Managed services in the ProSight Data Protection Services product family include ProSight DPS Ataro VM Backup, ProSight Ataro Office 365 Total Backup, ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to determine which of these fully managed backup services are best suited for your IT environment.

  • ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
    ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading information security vendors to provide centralized control and comprehensive security for your inbound and outbound email. The hybrid structure of Email Guard integrates a Cloud Protection Layer with a local gateway appliance to provide complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. Email Guard's cloud filter serves as a first line of defense and keeps the vast majority of unwanted email from making it to your network firewall. This reduces your vulnerability to inbound threats and saves network bandwidth and storage space. Email Guard's onsite gateway appliance adds a further level of inspection for incoming email. For outbound email, the on-premises security gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to track and protect internal email traffic that originates and ends inside your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

  • ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
    ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized businesses to diagram, track, reconfigure and troubleshoot their networking hardware like routers, firewalls, and access points plus servers, printers, client computers and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that network maps are always current, copies and displays the configuration information of almost all devices connected to your network, tracks performance, and sends alerts when problems are discovered. By automating time-consuming management activities, WAN Watch can knock hours off ordinary chores such as making network diagrams, expanding your network, locating appliances that need important software patches, or identifying the cause of performance issues. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

  • ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
    ProSight LAN Watch is Progentís server and desktop monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) technology to help keep your IT system running at peak levels by checking the state of critical computers that power your information system. When ProSight LAN Watch uncovers a problem, an alert is sent automatically to your designated IT management personnel and your assigned Progent consultant so all looming problems can be addressed before they have a chance to impact your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

  • ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
    With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host set up and maintained by Progent's network support professionals. Under Progent's ProSight Virtual Hosting model, the client owns the data, the operating system software, and the applications. Since the system is virtualized, it can be moved easily to a different hardware environment without a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

  • ProSight IT Asset Management: Network Documentation Management
    Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, find and safeguard data related to your network infrastructure, procedures, business apps, and services. You can quickly find passwords or serial numbers and be alerted about impending expirations of SSL certificates or domains. By updating and organizing your IT documentation, you can eliminate up to 50% of time thrown away looking for vital information about your IT network. ProSight IT Asset Management includes a common location for storing and sharing all documents required for managing your business network like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT data. Whether youíre planning enhancements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you require when you need it. Find out more about Progent's ProSight IT Asset Management service.

  • Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
    Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes cutting edge behavior machine learning technology to defend endpoints and servers and VMs against new malware attacks like ransomware and file-less exploits, which routinely evade traditional signature-matching anti-virus products. Progent ASM services protect local and cloud resources and provides a single platform to manage the entire threat lifecycle including filtering, identification, containment, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new attacks. Learn more about Progent's ransomware protection and cleanup services.

  • Progent's Outsourced/Shared Call Center: Support Desk Managed Services
    Progent's Help Desk managed services enable your information technology staff to offload Support Desk services to Progent or divide responsibilities for support services transparently between your internal network support team and Progent's nationwide roster of certified IT support engineers and subject matter experts (SBEs). Progent's Shared Help Desk Service provides a smooth extension of your internal IT support team. End user interaction with the Service Desk, provision of support, problem escalation, trouble ticket generation and tracking, performance measurement, and management of the service database are cohesive regardless of whether issues are taken care of by your core support group, by Progent, or by a combination. Find out more about Progent's outsourced/shared Help Desk services.

  • Patch Management: Patch Management Services
    Progent's managed services for patch management offer organizations of all sizes a versatile and affordable solution for evaluating, testing, scheduling, implementing, and tracking updates to your dynamic IT system. Besides optimizing the protection and functionality of your IT network, Progent's software/firmware update management services allow your IT staff to focus on line-of-business projects and activities that derive maximum business value from your information network. Learn more about Progent's patch management support services.

  • ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on
    Progent's Duo MFA service plans utilize Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo supports single-tap identity confirmation on Apple iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you sign into a protected online account and enter your password you are asked to verify who you are via a device that only you have and that uses a different ("out-of-band") network channel. A wide selection of out-of-band devices can be used for this second means of ID validation such as an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You can register multiple validation devices. For details about Duo identity validation services, refer to Cisco Duo MFA two-factor authentication (2FA) services for access security.
For 24x7x365 Roseville Crypto Removal Experts, contact Progent at 800-462-8800 or go to Contact Progent.