San Bernardino 24-Hour Urgent Crypto-Ransomware
Malware Detection and Removal Help

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a modern cyberplague that presents an enterprise-level danger for businesses of all sizes vulnerable to an assault. Multiple generations of ransomware like the CryptoLocker, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for a long time and continue to cause harm. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, as well as more as yet unnamed viruses, not only do encryption of on-line files but also infect all accessible system backup. Data synched to the cloud can also be encrypted. In a poorly designed system, this can render automatic restore operations useless and effectively sets the network back to square one.

Restoring services and data following a ransomware attack becomes a sprint against time as the targeted business fights to contain, eradicate the virus, and resume mission-critical operations. Because ransomware needs time to spread, assaults are often sprung at night, when successful penetrations tend to take more time to uncover. This compounds the difficulty of rapidly mobilizing and orchestrating a qualified response team.

Progent makes available a variety of solutions for protecting organizations from ransomware events. Among these are team member education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of next-generation security appliances with AI technology from SentinelOne to identify and disable zero-day cyber threats intelligently. Progent in addition provides the services of veteran ransomware recovery consultants with the track record and perseverance to reconstruct a breached environment as quickly as possible.

Progent's Ransomware Restoration Services
Subsequent to a ransomware attack, even paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will respond with the codes to decrypt any or all of your information. Kaspersky determined that 17% of ransomware victims never restored their data even after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The fallback is to re-install the critical components of your IT environment. Absent access to complete system backups, this calls for a wide range of IT skills, top notch team management, and the willingness to work 24x7 until the job is over.

For decades, Progent has offered expert Information Technology services for companies throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded top certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in accounting and ERP application software. This breadth of experience provides Progent the capability to knowledgably determine important systems and organize the remaining pieces of your computer network system following a crypto-ransomware attack and rebuild them into an operational system.

Progent's security team utilizes powerful project management tools to orchestrate the complicated recovery process. Progent appreciates the urgency of acting rapidly and in unison with a client's management and IT resources to assign priority to tasks and to get key applications back on-line as soon as possible.

Customer Story: A Successful Crypto-Ransomware Intrusion Restoration
A business engaged Progent after their network system was crashed by the Ryuk ransomware. Ryuk is thought to have been launched by North Korean state cybercriminals, suspected of using approaches exposed from the United States NSA organization. Ryuk targets specific businesses with little tolerance for operational disruption and is among the most profitable examples of ransomware. Headline victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in Chicago and has about 500 workers. The Ryuk attack had paralyzed all essential operations and manufacturing processes. Most of the client's data backups had been online at the start of the attack and were eventually encrypted. The client was evaluating paying the ransom (more than $200K) and hoping for good luck, but in the end brought in Progent.

Progent worked together with the customer to rapidly determine and prioritize the most important elements that had to be recovered to make it possible to restart business functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• MRP System

Within two days, Progent was able to re-build Active Directory services to its pre-attack state. Progent then helped perform setup and storage recovery on essential servers. All Exchange schema and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to assemble non-encrypted OST data files (Outlook Off-Line Folder Files) on staff workstations and laptops to recover email information. A recent offline backup of the client's financials/ERP software made them able to restore these required services back available to users. Although a lot of work remained to recover totally from the Ryuk event, critical services were returned to operations quickly:

Over the following month key milestones in the recovery process were achieved in tight collaboration between Progent team members and the customer:

• Internal web applications were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server exceeding four million archived messages was spun up and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 firewall was brought on-line.
• Nearly all of the user workstations were being used by staff.

Conclusion
A likely business-killing disaster was averted with dedicated professionals, a wide range of technical expertise, and close teamwork. Although upon completion of forensics the crypto-ransomware virus penetration detailed here could have been disabled with current cyber security technology solutions and recognized best practices, user education, and properly executed security procedures for backup and proper patching controls, the reality is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware virus, remember that Progent's team of experts has extensive experience in ransomware virus defense, cleanup, and data recovery.

To review or download a PDF version of this case study, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in San Bernardino a portfolio of online monitoring and security assessment services to assist you to reduce the threat from crypto-ransomware. These services utilize next-generation AI technology to uncover new strains of ransomware that are able to evade legacy signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent takes care of the daily monitoring and management for you, so your system expands readily without holding you back. For a low and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Basic packages include remote monitoring and management (RMM), security, automatic monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management technology to help keep your network operating at peak levels by checking the health of critical computers that power your information system. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your designated IT staff and your assigned Progent engineering consultant so that all looming problems can be resolved before they have a chance to disrupt productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for managing your network, server, and desktop devices by providing an environment for performing common tedious tasks. These include health checking, update management, automated repairs, endpoint setup, backup and restore, A/V defense, secure remote access, standard and custom scripts, resource inventory, endpoint profile reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alarm to your specified IT personnel and your Progent consultant so that potential issues can be fixed before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for small and mid-sized organizations to map, monitor, optimize and debug their networking appliances like routers, firewalls, and wireless controllers plus servers, endpoints and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that infrastructure topology diagrams are always current, copies and manages the configuration of virtually all devices connected to your network, tracks performance, and generates alerts when potential issues are detected. By automating time-consuming network management processes, ProSight WAN Watch can knock hours off ordinary tasks such as network mapping, expanding your network, finding devices that require critical updates, or identifying the cause of performance bottlenecks. Find out more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of in-depth management reporting utilities designed to integrate with the industry's top ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues like inconsistent support follow-through or machines with out-of-date AVs. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has partnered with advanced backup technology companies to produce ProSight Data Protection Services (DPS), a portfolio of management offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and track your data backup processes and enable transparent backup and rapid restoration of critical files, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business recover from data loss caused by hardware failures, natural disasters, fire, malware like ransomware, user error, ill-intentioned insiders, or application glitches. Managed services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Hybrid Backup. Your Progent expert can help you to identify which of these managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of top data security companies to deliver centralized control and comprehensive security for all your inbound and outbound email. The hybrid structure of Email Guard integrates a Cloud Protection Layer with a local security gateway device to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's cloud filter acts as a preliminary barricade and keeps most unwanted email from reaching your security perimeter. This decreases your exposure to inbound attacks and saves system bandwidth and storage space. Email Guard's on-premises gateway appliance adds a deeper level of analysis for incoming email. For outgoing email, the on-premises gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to track and safeguard internal email that stays inside your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA managed services incorporate Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity confirmation with iOS, Google Android, and other out-of-band devices. With 2FA, when you sign into a secured online account and enter your password you are requested to confirm your identity on a device that only you have and that is accessed using a different network channel. A wide selection of out-of-band devices can be utilized for this added form of ID validation such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You may register multiple verification devices. For details about ProSight Duo identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Desk: Help Desk Managed Services
  Progent's Support Desk services enable your IT staff to outsource Support Desk services to Progent or split activity for Help Desk services seamlessly between your internal support group and Progent's nationwide pool of certified IT support engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a transparent supplement to your core IT support organization. Client access to the Help Desk, delivery of support, escalation, ticket generation and tracking, efficiency metrics, and maintenance of the support database are consistent whether incidents are taken care of by your in-house network support staff, by Progent's team, or by a combination. Read more about Progent's outsourced/co-managed Call Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates cutting edge behavior machine learning tools to defend endpoints as well as servers and VMs against new malware assaults such as ransomware and file-less exploits, which routinely get by legacy signature-matching AV products. Progent Active Security Monitoring services protect local and cloud-based resources and offers a unified platform to manage the entire threat progression including blocking, detection, mitigation, remediation, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new attacks. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, retrieve and protect data about your IT infrastructure, processes, business apps, and services. You can instantly find passwords or serial numbers and be warned automatically about impending expirations of SSLs or domains. By updating and organizing your IT documentation, you can save as much as half of time thrown away searching for critical information about your network. ProSight IT Asset Management includes a centralized location for holding and sharing all documents required for managing your business network like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports advanced automation for gathering and associating IT information. Whether you're planning enhancements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the information you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of all sizes a versatile and cost-effective solution for assessing, validating, scheduling, applying, and documenting updates to your dynamic IT system. Besides maximizing the protection and reliability of your IT network, Progent's patch management services free up time for your IT staff to focus on line-of-business projects and tasks that deliver the highest business value from your information network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a protected fault tolerant data center on a fast virtual host configured and maintained by Progent's network support experts. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the operating system platforms, and the apps. Since the environment is virtualized, it can be moved easily to a different hosting environment without a lengthy and difficult configuration process. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoint devices against modern malware attacks such as ransomware and file-less exploits, which routinely escape legacy signature-matching anti-virus products. ProSight ASM protects local and cloud resources and offers a single platform to automate the complete malware attack progression including protection, infiltration detection, containment, cleanup, and forensics. Top capabilities include single-click rollback using Windows VSS and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable in-depth protection for physical and virtual servers, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and responding to security assaults from all vectors. ProSight ESP delivers firewall protection, intrusion alerts, endpoint management, and web filtering via leading-edge technologies incorporated within one agent accessible from a unified console. Progent's security and virtualization experts can assist you to plan and implement a ProSight ESP environment that addresses your company's specific requirements and that helps you demonstrate compliance with government and industry information security standards. Progent will help you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that require immediate attention. Progent can also help you to install and verify a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover quickly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.