24-Hour Allen Immediate Crypto-Ransomware
Infection Damage Assessment and Removal Support

Crypto-Ransomware : Your Feared IT Catastrophe
Ransomware has become a too-frequent cyberplague that presents an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Different iterations of crypto-ransomware like the CryptoLocker, WannaCry, Locky, SamSam and MongoLock cryptoworms have been around for a long time and still inflict harm. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, along with daily as yet unnamed newcomers, not only do encryption of online information but also infiltrate all accessible system restores and backups. Files synchronized to off-site disaster recovery sites can also be held hostage. In a poorly designed data protection solution, it can make any restore operations impossible and effectively sets the datacenter back to square one.

Getting back on-line services and data following a ransomware event becomes a sprint against time as the targeted organization fights to contain, clear the virus, and restore business-critical activity. Due to the fact that ransomware takes time to spread, assaults are frequently launched on weekends and holidays, when successful attacks tend to take longer to discover. This multiplies the difficulty of promptly mobilizing and coordinating a qualified response team.

Progent has a range of solutions for protecting businesses from crypto-ransomware events. These include user training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of next-generation security gateways with artificial intelligence capabilities from SentinelOne to detect and quarantine day-zero cyber threats automatically. Progent in addition provides the assistance of expert crypto-ransomware recovery consultants with the track record and commitment to restore a breached network as urgently as possible.

Progent's Crypto-Ransomware Restoration Services
After a ransomware penetration, sending the ransom in cryptocurrency does not ensure that cyber criminals will provide the codes to unencrypt any or all of your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The alternative is to re-install the vital elements of your IT environment. Absent access to complete system backups, this requires a wide complement of IT skills, professional project management, and the capability to work non-stop until the task is complete.

For decades, Progent has made available expert Information Technology services for companies throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of experience affords Progent the skills to knowledgably identify critical systems and consolidate the remaining components of your Information Technology system after a crypto-ransomware event and rebuild them into an operational network.

Progent's security team of experts deploys state-of-the-art project management systems to orchestrate the complicated restoration process. Progent knows the urgency of acting quickly and in concert with a customer's management and IT team members to assign priority to tasks and to get key systems back on line as soon as possible.

Business Case Study: A Successful Ransomware Attack Recovery
A business hired Progent after their organization was penetrated by the Ryuk ransomware. Ryuk is believed to have been launched by Northern Korean government sponsored criminal gangs, possibly adopting technology leaked from the U.S. NSA organization. Ryuk goes after specific organizations with little tolerance for disruption and is among the most profitable incarnations of ransomware malware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer headquartered in Chicago and has around 500 staff members. The Ryuk penetration had frozen all essential operations and manufacturing capabilities. The majority of the client's data protection had been online at the beginning of the attack and were damaged. The client considered paying the ransom (more than two hundred thousand dollars) and hoping for good luck, but ultimately made the decision to use Progent.

Progent worked hand in hand the client to rapidly understand and assign priority to the essential systems that had to be restored in order to continue company functions:

• Windows Active Directory
• Microsoft Exchange Server
• Financials/MRP

Within two days, Progent was able to restore Active Directory services to its pre-attack state. Progent then initiated setup and storage recovery of mission critical applications. All Exchange ties and attributes were intact, which accelerated the restore of Exchange. Progent was also able to find non-encrypted OST files (Outlook Offline Folder Files) on user desktop computers and laptops to recover email messages. A not too old offline backup of the client's manufacturing systems made it possible to recover these essential services back servicing users. Although a large amount of work was left to recover fully from the Ryuk attack, core services were restored quickly:

During the following couple of weeks critical milestones in the recovery process were accomplished through close collaboration between Progent consultants and the customer:

• In-house web sites were brought back up without losing any data.
• The MailStore Microsoft Exchange Server containing more than 4 million historical messages was brought on-line and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were 100% restored.
• A new Palo Alto 850 firewall was set up.
• Ninety percent of the user workstations were being used by staff.

Conclusion
A potential company-ending disaster was evaded with top-tier professionals, a broad spectrum of IT skills, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware attack described here could have been stopped with current security solutions and ISO/IEC 27001 best practices, staff training, and appropriate security procedures for backup and applying software patches, the fact remains that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's roster of experts has extensive experience in ransomware virus defense, remediation, and data recovery.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide companies in Allen a range of online monitoring and security evaluation services designed to help you to minimize your vulnerability to ransomware. These services utilize next-generation AI capability to detect zero-day variants of crypto-ransomware that can escape detection by traditional signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management (RMM) techniques to keep your IT system operating at peak levels by checking the health of vital assets that power your information system. When ProSight LAN Watch detects a problem, an alarm is sent immediately to your designated IT personnel and your Progent engineering consultant so any potential issues can be addressed before they can impact productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for managing your network, server, and desktop devices by providing tools for streamlining common time-consuming tasks. These include health checking, patch management, automated remediation, endpoint setup, backup and recovery, anti-virus response, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it transmits an alert to your specified IT management staff and your assigned Progent consultant so potential issues can be taken care of before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller businesses to map out, monitor, enhance and troubleshoot their connectivity appliances such as routers and switches, firewalls, and load balancers as well as servers, endpoints and other networked devices. Using cutting-edge RMM technology, WAN Watch ensures that infrastructure topology diagrams are always updated, captures and displays the configuration information of almost all devices on your network, monitors performance, and sends notices when issues are detected. By automating tedious management processes, WAN Watch can knock hours off common chores like network mapping, reconfiguring your network, finding appliances that require critical updates, or identifying the cause of performance problems. Learn more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of in-depth management reporting utilities designed to work with the leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues such as spotty support follow-up or machines with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore software providers to produce ProSight Data Protection Services (DPS), a portfolio of subscription-based offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and monitor your data backup processes and allow non-disruptive backup and fast restoration of important files, applications, images, and VMs. ProSight DPS lets your business protect against data loss caused by hardware failures, natural disasters, fire, malware such as ransomware, user error, malicious employees, or software glitches. Managed services in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of top information security vendors to provide centralized management and comprehensive security for all your email traffic. The powerful architecture of Progent's Email Guard combines cloud-based filtering with a local security gateway device to offer advanced protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-based malware. Email Guard's Cloud Protection Layer serves as a first line of defense and blocks most threats from making it to your network firewall. This reduces your vulnerability to external threats and conserves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a further layer of inspection for inbound email. For outbound email, the onsite security gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email that originates and ends inside your corporate firewall. For more information, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo authentication service plans incorporate Cisco's Duo technology to protect against password theft through the use of two-factor authentication (2FA). Duo enables one-tap identity confirmation on Apple iOS, Android, and other out-of-band devices. Using 2FA, when you sign into a secured online account and give your password you are asked to confirm who you are on a device that only you possess and that uses a different ("out-of-band") network channel. A wide range of devices can be used for this second form of ID validation including a smartphone or wearable, a hardware token, a landline phone, etc. You may register multiple verification devices. For details about Duo two-factor identity authentication services, visit Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Service Center: Support Desk Managed Services
  Progent's Support Desk managed services enable your information technology team to outsource Help Desk services to Progent or divide responsibilities for support services seamlessly between your internal support staff and Progent's extensive pool of certified IT support engineers and subject matter experts. Progent's Shared Help Desk Service provides a smooth supplement to your core network support organization. Client interaction with the Help Desk, provision of technical assistance, issue escalation, ticket creation and tracking, performance metrics, and maintenance of the support database are consistent regardless of whether incidents are taken care of by your core support group, by Progent's team, or a mix of the two. Learn more about Progent's outsourced/shared Call Desk services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection service that incorporates cutting edge behavior-based analysis technology to guard endpoints as well as servers and VMs against modern malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-based anti-virus products. Progent Active Security Monitoring services protect local and cloud resources and offers a unified platform to automate the complete malware attack lifecycle including protection, infiltration detection, mitigation, cleanup, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against new threats. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, retrieve and safeguard data about your network infrastructure, procedures, business apps, and services. You can quickly find passwords or serial numbers and be warned about impending expirations of SSLs or domains. By updating and organizing your network documentation, you can eliminate as much as half of time wasted searching for critical information about your IT network. ProSight IT Asset Management features a centralized location for storing and sharing all documents required for managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT information. Whether you're planning improvements, doing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the data you require as soon as you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer organizations of all sizes a versatile and affordable solution for evaluating, validating, scheduling, applying, and documenting updates to your dynamic information system. In addition to optimizing the protection and reliability of your computer environment, Progent's patch management services allow your IT team to concentrate on more strategic projects and tasks that derive maximum business value from your network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a protected Tier III data center on a high-performance virtual host configured and maintained by Progent's network support professionals. Under the ProSight Virtual Hosting model, the client owns the data, the OS software, and the apps. Since the system is virtualized, it can be ported immediately to an alternate hardware solution without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior machine learning tools to guard physical and virtual endpoints against modern malware assaults like ransomware and email phishing, which easily escape legacy signature-matching anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a single platform to manage the entire threat lifecycle including blocking, detection, containment, remediation, and post-attack forensics. Key features include single-click rollback using Windows VSS and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer affordable in-depth protection for physical and virtual servers, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for round-the-clock monitoring and reacting to security assaults from all vectors. ProSight ESP delivers firewall protection, intrusion alerts, endpoint management, and web filtering through leading-edge technologies incorporated within one agent managed from a unified control. Progent's security and virtualization consultants can assist you to plan and configure a ProSight ESP environment that meets your organization's specific needs and that helps you prove compliance with government and industry data security standards. Progent will assist you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that require immediate action. Progent's consultants can also help you to install and test a backup and disaster recovery system such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange filtering.