Waltham 24-Hour Critical Crypto-Ransomware
Computer Virus Damage Assessment and Repair Help

Crypto-Ransomware : Your Worst IT Nightmare
Ransomware has become an escalating cyber pandemic that presents an extinction-level threat for businesses of all sizes poorly prepared for an attack. Different iterations of ransomware like the CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for a long time and still inflict havoc. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, along with more unnamed viruses, not only encrypt on-line files but also infiltrate all configured system protection mechanisms. Files synched to off-site disaster recovery sites can also be corrupted. In a poorly designed system, it can make automated restore operations hopeless and basically sets the entire system back to zero.

Retrieving services and data following a crypto-ransomware intrusion becomes a sprint against time as the victim tries its best to stop the spread, remove the ransomware, and resume enterprise-critical activity. Since ransomware takes time to move laterally, attacks are frequently launched during nights and weekends, when penetrations in many cases take more time to detect. This compounds the difficulty of rapidly mobilizing and coordinating a capable response team.

Progent makes available a range of solutions for protecting organizations from ransomware attacks. These include team member training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus setup and configuration of the latest generation security solutions with AI capabilities from SentinelOne to detect and suppress new cyber attacks automatically. Progent in addition provides the services of experienced ransomware recovery consultants with the talent and commitment to restore a compromised network as urgently as possible.

Progent's Crypto-Ransomware Recovery Services
Subsequent to a crypto-ransomware penetration, paying the ransom in cryptocurrency does not ensure that cyber criminals will return the keys to decrypt any or all of your data. Kaspersky Labs determined that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to piece back together the mission-critical elements of your Information Technology environment. Without the availability of full system backups, this requires a broad range of skills, professional team management, and the ability to work continuously until the recovery project is completed.

For twenty years, Progent has provided certified expert Information Technology services for companies throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned top industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with accounting and ERP software solutions. This breadth of expertise affords Progent the skills to quickly ascertain necessary systems and consolidate the surviving pieces of your computer network environment after a ransomware penetration and rebuild them into an operational network.

Progent's ransomware team of experts utilizes powerful project management tools to orchestrate the complex recovery process. Progent understands the importance of acting rapidly and together with a customer's management and IT team members to prioritize tasks and to put essential applications back on line as fast as humanly possible.

Client Case Study: A Successful Ransomware Virus Restoration
A business hired Progent after their company was taken over by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state cybercriminals, suspected of using technology leaked from the United States National Security Agency. Ryuk goes after specific companies with limited tolerance for operational disruption and is among the most lucrative iterations of ransomware malware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing business located in Chicago and has around 500 employees. The Ryuk intrusion had shut down all essential operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the time of the intrusion and were encrypted. The client was pursuing financing for paying the ransom (exceeding $200,000) and wishfully thinking for the best, but in the end engaged Progent.

Progent worked hand in hand the customer to rapidly understand and assign priority to the mission critical areas that needed to be restored to make it possible to resume company operations:

• Active Directory
• Microsoft Exchange Email
• Accounting/MRP

Within two days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then helped perform setup and hard drive recovery on the most important systems. All Microsoft Exchange Server data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to locate local OST files (Outlook Off-Line Folder Files) on team desktop computers in order to recover email data. A recent offline backup of the customer's financials/MRP software made it possible to restore these vital services back servicing users. Although a lot of work needed to be completed to recover completely from the Ryuk event, essential services were recovered rapidly:

During the next couple of weeks critical milestones in the restoration process were made through tight collaboration between Progent consultants and the client:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server exceeding four million historical messages was spun up and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control functions were fully recovered.
• A new Palo Alto 850 security appliance was set up.
• Most of the desktops and laptops were operational.

Conclusion
A probable company-ending disaster was evaded due to top-tier professionals, a broad spectrum of technical expertise, and tight teamwork. Although in post mortem the ransomware virus penetration detailed here would have been blocked with current security technology and best practices, user and IT administrator training, and well designed incident response procedures for backup and applying software patches, the fact is that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's roster of professionals has proven experience in ransomware virus defense, removal, and information systems restoration.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide companies in Waltham a range of remote monitoring and security evaluation services to help you to minimize your vulnerability to ransomware. These services include next-generation machine learning technology to uncover zero-day variants of crypto-ransomware that are able to get past legacy signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent handles the necessary monitoring and maintenance for you, so your network scales smoothly without holding you back. For an affordable and predictable monthly price, Progent's experienced IT team can be your complete technology safety net. Basic packages include RMM, security, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-in-class solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management techniques to keep your IT system operating at peak levels by tracking the health of vital computers that power your business network. When ProSight LAN Watch uncovers a problem, an alarm is transmitted immediately to your specified IT staff and your Progent consultant so all potential problems can be addressed before they can disrupt productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for monitoring and managing your client-server infrastructure by providing an environment for performing common time-consuming tasks. These can include health monitoring, update management, automated remediation, endpoint deployment, backup and recovery, anti-virus protection, remote access, standard and custom scripts, resource inventory, endpoint status reporting, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it transmits an alarm to your designated IT personnel and your assigned Progent consultant so that emerging issues can be fixed before they interfere with your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for smaller organizations to map, monitor, optimize and debug their networking appliances like routers and switches, firewalls, and load balancers as well as servers, printers, client computers and other devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network maps are kept current, copies and displays the configuration information of virtually all devices connected to your network, tracks performance, and sends alerts when issues are discovered. By automating tedious network management processes, ProSight WAN Watch can cut hours off common tasks such as network mapping, expanding your network, finding appliances that need critical updates, or identifying the cause of performance issues. Learn more details about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of real-time and in-depth reporting utilities designed to work with the leading ticketing and remote network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-through or machines with out-of-date AVs. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software providers to produce ProSight Data Protection Services (DPS), a family of subscription-based management offerings that deliver backup-as-a-service. ProSight DPS services automate and track your data backup processes and allow transparent backup and fast recovery of vital files, apps, system images, plus VMs. ProSight DPS lets your business avoid data loss caused by equipment failures, natural disasters, fire, malware like ransomware, human error, ill-intentioned insiders, or application bugs. Managed backup services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can help you to identify which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of leading information security vendors to deliver web-based management and comprehensive protection for your inbound and outbound email. The powerful structure of Progent's Email Guard combines cloud-based filtering with a local security gateway device to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The cloud filter serves as a preliminary barricade and blocks the vast majority of unwanted email from reaching your network firewall. This reduces your vulnerability to external threats and saves network bandwidth and storage. Email Guard's on-premises security gateway appliance provides a further layer of inspection for incoming email. For outgoing email, the local security gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The local security gateway can also assist Exchange Server to track and protect internal email that originates and ends inside your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo technology to defend against compromised passwords by using two-factor authentication. Duo enables single-tap identity confirmation with Apple iOS, Android, and other out-of-band devices. Using Duo 2FA, whenever you log into a protected application and enter your password you are asked to confirm who you are via a device that only you have and that uses a separate network channel. A broad range of devices can be utilized for this second form of authentication such as an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You can designate multiple verification devices. For details about ProSight Duo identity authentication services, see Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Service Center: Support Desk Managed Services
  Progent's Call Center services allow your information technology team to outsource Help Desk services to Progent or split activity for support services transparently between your in-house network support resources and Progent's nationwide roster of IT service engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a transparent extension of your core network support organization. User access to the Help Desk, delivery of support services, problem escalation, trouble ticket creation and tracking, efficiency measurement, and maintenance of the support database are consistent whether incidents are resolved by your core support organization, by Progent's team, or by a combination. Find out more about Progent's outsourced/shared Call Center services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that incorporates next generation behavior analysis tools to guard endpoint devices as well as physical and virtual servers against new malware attacks like ransomware and email phishing, which easily escape traditional signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and offers a unified platform to address the complete malware attack lifecycle including filtering, identification, containment, cleanup, and forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against new threats. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and protect data about your network infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be alerted about impending expirations of SSL certificates or domains. By updating and organizing your network documentation, you can save up to half of time thrown away trying to find vital information about your network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents required for managing your business network like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and associating IT information. Whether you're planning enhancements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the information you need the instant you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of all sizes a flexible and affordable alternative for evaluating, testing, scheduling, implementing, and documenting updates to your dynamic information network. Besides optimizing the security and functionality of your IT network, Progent's software/firmware update management services allow your in-house IT team to concentrate on line-of-business projects and tasks that derive the highest business value from your network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual host configured and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting model, the client owns the data, the OS software, and the applications. Since the environment is virtualized, it can be moved immediately to an alternate hosting environment without requiring a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which routinely evade legacy signature-matching AV tools. ProSight ASM protects local and cloud-based resources and provides a unified platform to manage the complete threat lifecycle including protection, infiltration detection, containment, cleanup, and post-attack forensics. Top capabilities include single-click rollback using Windows VSS and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer affordable multi-layer protection for physical servers and VMs, workstations, smartphones, and Exchange email. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to security threats from all attack vectors. ProSight ESP offers two-way firewall protection, penetration alerts, device control, and web filtering via leading-edge technologies packaged within one agent accessible from a unified control. Progent's security and virtualization consultants can help you to plan and implement a ProSight ESP environment that addresses your company's specific needs and that allows you demonstrate compliance with legal and industry information protection standards. Progent will help you specify and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that call for immediate action. Progent's consultants can also assist your company to set up and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange filtering.