24-7 Chesapeake Urgent Ransomware
Malware Identification and Recovery Help

Ransomware : Your Worst IT Nightmare
Ransomware has become a modern cyberplague that poses an enterprise-level danger for organizations unprepared for an assault. Versions of ransomware such as CryptoLocker, Fusob, Locky, Syskey and MongoLock cryptoworms have been running rampant for years and continue to inflict harm. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, plus more unnamed newcomers, not only encrypt online files but also infect many accessible system protection mechanisms. Data synchronized to cloud environments can also be corrupted. In a poorly architected environment, it can make automated restoration hopeless and effectively knocks the datacenter back to square one.

Getting back programs and data following a ransomware event becomes a race against the clock as the targeted business fights to stop lateral movement, eradicate the crypto-ransomware, and restore business-critical activity. Since crypto-ransomware requires time to spread, assaults are often launched on weekends, when attacks typically take more time to detect. This multiplies the difficulty of quickly mobilizing and organizing a capable mitigation team.

Progent has an assortment of help services for securing businesses from ransomware attacks. Among these are staff training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of the latest generation security appliances with machine learning capabilities from SentinelOne to discover and quarantine zero-day threats rapidly. Progent also offers the services of veteran crypto-ransomware recovery consultants with the talent and perseverance to rebuild a breached system as soon as possible.

Progent's Ransomware Recovery Help
Subsequent to a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not guarantee that merciless criminals will respond with the needed codes to unencrypt any of your files. Kaspersky determined that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to setup from scratch the key components of your Information Technology environment. Without access to complete system backups, this requires a broad complement of skills, professional team management, and the willingness to work non-stop until the task is complete.

For two decades, Progent has made available professional IT services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have been awarded top industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in accounting and ERP applications. This breadth of experience provides Progent the capability to rapidly ascertain critical systems and consolidate the remaining components of your Information Technology environment after a ransomware event and rebuild them into an operational system.

Progent's ransomware team of experts uses top notch project management applications to coordinate the complicated recovery process. Progent appreciates the importance of working swiftly and in concert with a client's management and IT resources to assign priority to tasks and to get essential services back on line as fast as humanly possible.

Client Story: A Successful Ransomware Incident Recovery
A customer escalated to Progent after their network system was brought down by the Ryuk crypto-ransomware. Ryuk is believed to have been created by North Korean government sponsored cybercriminals, suspected of adopting approaches exposed from America's National Security Agency. Ryuk seeks specific companies with limited tolerance for operational disruption and is among the most lucrative examples of ransomware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in the Chicago metro area with about 500 employees. The Ryuk penetration had disabled all essential operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the start of the attack and were encrypted. The client was taking steps for paying the ransom (in excess of two hundred thousand dollars) and praying for the best, but ultimately utilized Progent.

Progent worked together with the customer to rapidly identify and assign priority to the essential applications that had to be recovered in order to continue company operations:

• Active Directory
• Electronic Mail
• Financials/MRP

In less than 2 days, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then accomplished rebuilding and hard drive recovery on the most important applications. All Microsoft Exchange Server ties and attributes were intact, which greatly helped the restore of Exchange. Progent was able to locate local OST files (Microsoft Outlook Offline Data Files) on various PCs to recover email messages. A recent off-line backup of the customer's accounting/MRP software made it possible to return these required applications back available to users. Although significant work still had to be done to recover fully from the Ryuk attack, the most important services were recovered quickly:

Throughout the following month key milestones in the restoration project were accomplished through close collaboration between Progent consultants and the client:

• Self-hosted web sites were restored without losing any data.
• The MailStore Server with over 4 million archived emails was restored to operations and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory Control capabilities were 100% recovered.
• A new Palo Alto 850 firewall was set up and programmed.
• Most of the user workstations were operational.

Conclusion
A probable business-killing catastrophe was avoided due to dedicated professionals, a wide spectrum of technical expertise, and close collaboration. Although in retrospect the crypto-ransomware attack detailed here could have been identified and disabled with current security systems and NIST Cybersecurity Framework best practices, team training, and well designed incident response procedures for data protection and keeping systems up to date with security patches, the reality is that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware attack, feel confident that Progent's roster of professionals has a proven track record in ransomware virus blocking, remediation, and information systems restoration.

To read or download a PDF version of this customer story, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Chesapeake a range of online monitoring and security evaluation services to assist you to reduce the threat from ransomware. These services include modern AI technology to detect zero-day variants of crypto-ransomware that are able to get past legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent takes care of the daily monitoring and maintenance for you, so your network scales easily without becoming an obstacle. For a low and predictable monthly price, Progent's experienced IT group can be your dependable technology safety net. Basic plans include remote monitoring and management, cybersecurity, automatic monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to best-in-class solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management technology to keep your IT system running efficiently by checking the health of vital assets that drive your business network. When ProSight LAN Watch detects an issue, an alarm is sent automatically to your designated IT personnel and your Progent consultant so all potential problems can be resolved before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for managing your client-server infrastructure by offering tools for performing common time-consuming tasks. These can include health checking, update management, automated repairs, endpoint configuration, backup and recovery, A/V protection, secure remote access, built-in and custom scripts, resource inventory, endpoint status reports, and debugging help. If ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alert to your specified IT management staff and your Progent technical consultant so emerging issues can be taken care of before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized businesses to diagram, monitor, optimize and troubleshoot their connectivity appliances such as routers, firewalls, and access points as well as servers, printers, endpoints and other networked devices. Incorporating cutting-edge RMM technology, WAN Watch makes sure that infrastructure topology diagrams are always current, captures and displays the configuration of almost all devices on your network, monitors performance, and sends alerts when problems are detected. By automating complex management processes, ProSight WAN Watch can cut hours off ordinary chores like making network diagrams, expanding your network, locating devices that require important software patches, or resolving performance bottlenecks. Learn more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time and in-depth management reporting utilities designed to integrate with the industry's top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-up or machines with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup/restore software companies to create ProSight Data Protection Services, a family of offerings that provide backup-as-a-service. ProSight DPS services automate and monitor your data backup processes and enable non-disruptive backup and rapid recovery of vital files, applications, images, plus VMs. ProSight DPS helps you recover from data loss caused by hardware breakdown, natural disasters, fire, malware like ransomware, human error, malicious insiders, or software bugs. Managed backup services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of top data security vendors to deliver web-based control and world-class protection for all your inbound and outbound email. The hybrid architecture of Email Guard managed service integrates cloud-based filtering with a local gateway appliance to provide complete protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-based malware. Email Guard's cloud filter serves as a preliminary barricade and keeps most threats from making it to your security perimeter. This reduces your exposure to external attacks and saves network bandwidth and storage. Email Guard's onsite gateway device provides a deeper level of analysis for incoming email. For outgoing email, the onsite security gateway offers anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local gateway can also assist Exchange Server to track and safeguard internal email that stays within your corporate firewall. For more information, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to defend against password theft by using two-factor authentication. Duo enables one-tap identity confirmation on iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you log into a protected application and enter your password you are asked to verify who you are on a unit that only you have and that uses a different ("out-of-band") network channel. A broad range of out-of-band devices can be used for this second means of authentication such as an iPhone or Android or watch, a hardware/software token, a landline telephone, etc. You may designate multiple validation devices. To find out more about Duo two-factor identity validation services, see Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Desk: Call Center Managed Services
  Progent's Help Desk managed services permit your information technology group to outsource Call Center services to Progent or divide responsibilities for support services transparently between your in-house network support staff and Progent's nationwide pool of IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a smooth supplement to your core network support group. Client access to the Service Desk, provision of support, issue escalation, ticket generation and updates, performance metrics, and management of the support database are cohesive whether incidents are taken care of by your internal IT support staff, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/co-managed Help Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that utilizes next generation behavior analysis tools to defend endpoint devices as well as physical and virtual servers against modern malware attacks such as ransomware and file-less exploits, which easily get by legacy signature-based anti-virus tools. Progent ASM services protect on-premises and cloud resources and provides a single platform to address the complete threat progression including blocking, detection, mitigation, remediation, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and protect data about your network infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be warned automatically about impending expirations of SSLs ,domains or warranties. By cleaning up and organizing your IT documentation, you can save up to half of time wasted searching for vital information about your IT network. ProSight IT Asset Management features a common location for holding and collaborating on all documents required for managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're planning improvements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the information you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of all sizes a versatile and affordable alternative for assessing, testing, scheduling, implementing, and tracking software and firmware updates to your ever-evolving IT network. Besides maximizing the protection and functionality of your computer network, Progent's software/firmware update management services allow your in-house IT team to focus on more strategic projects and activities that derive the highest business value from your network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a protected Tier III data center on a fast virtual machine host configured and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS software, and the apps. Since the environment is virtualized, it can be moved easily to an alternate hosting solution without requiring a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior analysis tools to guard physical and virtual endpoint devices against modern malware assaults like ransomware and email phishing, which routinely evade legacy signature-matching anti-virus tools. ProSight ASM protects local and cloud-based resources and provides a unified platform to address the complete threat lifecycle including blocking, identification, containment, cleanup, and forensics. Top capabilities include one-click rollback using Windows VSS and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection services offer ultra-affordable in-depth protection for physical servers and VMs, desktops, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to security threats from all attack vectors. ProSight ESP offers firewall protection, penetration alerts, endpoint control, and web filtering through cutting-edge tools incorporated within a single agent managed from a single console. Progent's security and virtualization experts can help you to design and configure a ProSight ESP deployment that meets your company's unique requirements and that helps you achieve and demonstrate compliance with government and industry information protection regulations. Progent will assist you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and respond to alarms that call for immediate attention. Progent can also assist your company to install and test a backup and restore system such as ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange filtering.