Dayton 24-Hour Critical Crypto-Ransomware
Malware Damage Assessment and Remediation Experts

Ransomware : Your Crippling IT Nightmare
Ransomware has become a modern cyberplague that presents an extinction-level threat for businesses of all sizes vulnerable to an attack. Versions of ransomware such as Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and still cause harm. Recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as frequent as yet unnamed viruses, not only encrypt online files but also infect many accessible system backups. Data synched to the cloud can also be encrypted. In a poorly designed system, this can make automatic restore operations useless and basically sets the network back to zero.

Getting back online services and data after a crypto-ransomware intrusion becomes a sprint against time as the targeted organization struggles to stop lateral movement, remove the ransomware, and restore enterprise-critical operations. Since crypto-ransomware needs time to move laterally, assaults are often sprung during weekends and nights, when successful attacks may take longer to recognize. This compounds the difficulty of promptly mobilizing and organizing a knowledgeable response team.

Progent makes available a variety of help services for protecting organizations from ransomware penetrations. These include staff training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of next-generation security appliances with AI technology from SentinelOne to detect and extinguish new cyber threats automatically. Progent also offers the services of veteran ransomware recovery engineers with the talent and commitment to reconstruct a breached network as quickly as possible.

Progent's Ransomware Recovery Support Services
Following a ransomware penetration, paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will provide the keys to decipher any of your information. Kaspersky Labs ascertained that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The other path is to re-install the mission-critical parts of your Information Technology environment. Absent the availability of complete information backups, this requires a broad range of skills, well-coordinated project management, and the ability to work non-stop until the recovery project is completed.

For two decades, Progent has made available professional Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded high-level industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial systems and ERP application software. This breadth of expertise gives Progent the skills to knowledgably determine necessary systems and organize the surviving parts of your network system following a ransomware attack and configure them into a functioning network.

Progent's recovery team uses powerful project management applications to orchestrate the complicated recovery process. Progent appreciates the urgency of acting swiftly and in unison with a customer's management and IT resources to assign priority to tasks and to put the most important services back on line as soon as possible.

Case Study: A Successful Ransomware Penetration Restoration
A business escalated to Progent after their organization was brought down by Ryuk ransomware. Ryuk is generally considered to have been deployed by Northern Korean government sponsored hackers, suspected of adopting technology leaked from the United States NSA organization. Ryuk attacks specific businesses with limited room for disruption and is one of the most profitable examples of crypto-ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in the Chicago metro area and has around 500 staff members. The Ryuk penetration had disabled all essential operations and manufacturing capabilities. Most of the client's data protection had been on-line at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (more than $200K) and praying for the best, but ultimately utilized Progent.

Progent worked with the customer to rapidly determine and assign priority to the critical applications that needed to be addressed to make it possible to resume business functions:

• Microsoft Active Directory
• Exchange Server
• Financials/MRP

Within two days, Progent was able to re-build Active Directory to its pre-virus state. Progent then completed reinstallations and storage recovery of critical applications. All Exchange schema and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to assemble intact OST data files (Outlook Email Off-Line Data Files) on user workstations to recover mail information. A not too old off-line backup of the businesses manufacturing software made them able to return these essential programs back servicing users. Although a large amount of work needed to be completed to recover completely from the Ryuk attack, critical systems were restored quickly:

Throughout the following couple of weeks key milestones in the recovery project were made through tight collaboration between Progent team members and the customer:

• Self-hosted web applications were brought back up with no loss of information.
• The MailStore Server containing more than four million archived emails was spun up and accessible to users.
• CRM/Orders/Invoicing/AP/AR/Inventory Control modules were 100% functional.
• A new Palo Alto Networks 850 firewall was set up.
• 90% of the user PCs were functioning as before the incident.

Conclusion
A probable enterprise-killing disaster was dodged by results-oriented professionals, a broad spectrum of subject matter expertise, and tight collaboration. Although in retrospect the ransomware virus penetration detailed here should have been blocked with modern security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and appropriate incident response procedures for information backup and proper patching controls, the reality is that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware incursion, feel confident that Progent's roster of professionals has extensive experience in ransomware virus defense, cleanup, and information systems disaster recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Dayton a variety of online monitoring and security assessment services to assist you to reduce the threat from crypto-ransomware. These services incorporate modern machine learning capability to detect new variants of crypto-ransomware that can evade legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent handles the necessary monitoring and management for you, so your network scales smoothly without becoming an obstacle. For an affordable and predictable monthly price, Progent's full-service IT team can be your complete technology safety net. Basic plans include RMM, cybersecurity, monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management technology to keep your IT system operating efficiently by tracking the state of critical computers that power your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted immediately to your specified IT management staff and your Progent engineering consultant so that all potential issues can be resolved before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for managing your client-server infrastructure by providing an environment for streamlining common time-consuming jobs. These can include health monitoring, update management, automated repairs, endpoint deployment, backup and restore, A/V response, remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alert to your specified IT management personnel and your Progent consultant so potential issues can be fixed before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for smaller businesses to map out, monitor, reconfigure and debug their connectivity appliances such as routers, firewalls, and access points as well as servers, endpoints and other networked devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch ensures that infrastructure topology diagrams are always updated, captures and displays the configuration of almost all devices connected to your network, monitors performance, and generates alerts when problems are discovered. By automating time-consuming network management activities, ProSight WAN Watch can cut hours off common chores like making network diagrams, reconfiguring your network, locating devices that require critical software patches, or isolating performance issues. Find out more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of in-depth management reporting plug-ins created to work with the industry's leading ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues like spotty support follow-through or machines with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with leading backup/restore technology companies to create ProSight Data Protection Services (DPS), a family of subscription-based management offerings that provide backup-as-a-service (BaaS). ProSight DPS products manage and monitor your data backup processes and enable transparent backup and rapid restoration of important files/folders, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS helps your business avoid data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks like ransomware, user mistakes, ill-intentioned employees, or software glitches. Managed services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading information security vendors to deliver centralized control and comprehensive protection for your inbound and outbound email. The powerful architecture of Email Guard combines a Cloud Protection Layer with an on-premises gateway appliance to offer advanced defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-based threats. The cloud filter serves as a first line of defense and blocks the vast majority of threats from making it to your network firewall. This reduces your vulnerability to inbound attacks and conserves system bandwidth and storage. Email Guard's onsite gateway appliance adds a further level of inspection for inbound email. For outgoing email, the local gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local gateway can also help Exchange Server to monitor and protect internal email that stays within your corporate firewall. For more information, see Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to defend against password theft by using two-factor authentication. Duo enables one-tap identity confirmation on Apple iOS, Android, and other personal devices. Using Duo 2FA, when you log into a secured application and give your password you are asked to verify who you are on a device that only you have and that uses a different network channel. A wide selection of devices can be used as this added means of ID validation including an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can register multiple validation devices. For details about ProSight Duo two-factor identity validation services, see Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Support Desk managed services enable your IT team to offload Help Desk services to Progent or split activity for support services seamlessly between your internal support resources and Progent's nationwide roster of IT service engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a transparent supplement to your core IT support organization. User access to the Help Desk, provision of support services, issue escalation, trouble ticket generation and updates, efficiency measurement, and management of the service database are consistent regardless of whether incidents are taken care of by your corporate support group, by Progent's team, or by a combination. Read more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior analysis technology to defend endpoints and physical and virtual servers against new malware assaults such as ransomware and file-less exploits, which easily get by traditional signature-matching anti-virus tools. Progent ASM services protect on-premises and cloud resources and provides a unified platform to manage the complete malware attack progression including protection, infiltration detection, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows VSS and automatic network-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, retrieve and safeguard information about your network infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be alerted automatically about upcoming expirations of SSLs ,domains or warranties. By cleaning up and managing your IT documentation, you can save as much as 50% of time thrown away looking for critical information about your IT network. ProSight IT Asset Management features a centralized location for storing and collaborating on all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and associating IT data. Whether you're making improvements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the knowledge you need as soon as you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide organizations of any size a flexible and affordable alternative for evaluating, validating, scheduling, applying, and documenting updates to your dynamic information network. Besides optimizing the security and reliability of your IT environment, Progent's patch management services allow your in-house IT team to focus on more strategic projects and activities that derive the highest business value from your information network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host set up and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the client owns the data, the operating system software, and the applications. Since the system is virtualized, it can be moved easily to an alternate hosting environment without a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's next generation behavior-based machine learning tools to defend physical and virtual endpoints against new malware attacks like ransomware and file-less exploits, which easily evade traditional signature-based AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a single platform to address the complete malware attack progression including filtering, infiltration detection, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback with Windows VSS and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection services deliver ultra-affordable multi-layer security for physical and virtual servers, workstations, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and advanced machine learning for round-the-clock monitoring and responding to security threats from all attack vectors. ProSight ESP delivers firewall protection, intrusion alerts, endpoint control, and web filtering via cutting-edge technologies incorporated within one agent managed from a unified control. Progent's data protection and virtualization consultants can assist your business to plan and implement a ProSight ESP environment that meets your organization's specific requirements and that helps you achieve and demonstrate compliance with government and industry information protection regulations. Progent will assist you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for urgent attention. Progent can also help you to set up and test a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can recover quickly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange filtering.