24/7 New Haven Critical Crypto-Ransomware
Virus Assessment and Restoration Help

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an existential danger for businesses of all sizes poorly prepared for an attack. Different iterations of crypto-ransomware like the CryptoLocker, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been running rampant for a long time and still inflict havoc. Recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, plus frequent as yet unnamed viruses, not only do encryption of on-line critical data but also infiltrate most accessible system protection. Information synched to the cloud can also be held hostage. In a poorly architected data protection solution, this can make any recovery useless and basically sets the network back to square one.

Getting back on-line services and information after a ransomware outage becomes a race against time as the targeted business struggles to contain, remove the ransomware, and restore enterprise-critical operations. Because crypto-ransomware takes time to replicate, penetrations are often sprung on weekends, when successful penetrations in many cases take more time to uncover. This compounds the difficulty of rapidly marshalling and organizing a qualified response team.

Progent has an assortment of support services for protecting businesses from ransomware penetrations. Among these are staff education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of next-generation security gateways with artificial intelligence capabilities from SentinelOne to detect and extinguish day-zero threats rapidly. Progent in addition can provide the services of expert crypto-ransomware recovery engineers with the track record and commitment to rebuild a compromised system as soon as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will provide the keys to decipher all your information. Kaspersky ascertained that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The other path is to piece back together the vital components of your Information Technology environment. Without access to complete system backups, this requires a wide complement of skill sets, well-coordinated project management, and the capability to work non-stop until the recovery project is completed.

For two decades, Progent has made available expert IT services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained advanced certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of experience affords Progent the ability to knowledgably determine important systems and organize the remaining components of your computer network system after a crypto-ransomware attack and rebuild them into a functioning system.

Progent's recovery group deploys powerful project management tools to orchestrate the sophisticated recovery process. Progent appreciates the urgency of working rapidly and together with a customer's management and IT team members to assign priority to tasks and to put essential applications back online as fast as possible.

Client Story: A Successful Ransomware Penetration Restoration
A business escalated to Progent after their network system was penetrated by the Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by Northern Korean state sponsored hackers, possibly using strategies exposed from America's NSA organization. Ryuk attacks specific businesses with little or no room for operational disruption and is one of the most profitable incarnations of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in the Chicago metro area with around 500 staff members. The Ryuk intrusion had brought down all company operations and manufacturing capabilities. Most of the client's backups had been online at the beginning of the intrusion and were destroyed. The client considered paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately called Progent.

Progent worked hand in hand the client to quickly determine and assign priority to the essential systems that needed to be recovered to make it possible to restart departmental operations:

• Microsoft Active Directory
• E-Mail
• Financials/MRP

Within 2 days, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then assisted with rebuilding and hard drive recovery on the most important servers. All Exchange Server ties and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to collect local OST files (Outlook Off-Line Data Files) on team workstations and laptops to recover mail information. A recent offline backup of the client's accounting/ERP software made it possible to recover these essential applications back servicing users. Although significant work remained to recover completely from the Ryuk attack, essential services were returned to operations quickly:

During the following month important milestones in the recovery process were accomplished in close cooperation between Progent team members and the client:

• Internal web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was spun up and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were fully recovered.
• A new Palo Alto 850 firewall was deployed.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A possible business-ending catastrophe was avoided with dedicated professionals, a broad range of IT skills, and close teamwork. Although in analyzing the event afterwards the ransomware attack detailed here could have been shut down with current security technology solutions and NIST Cybersecurity Framework best practices, user education, and well designed incident response procedures for information protection and proper patching controls, the reality remains that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware virus, feel confident that Progent's team of experts has substantial experience in crypto-ransomware virus defense, mitigation, and information systems recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in New Haven a variety of remote monitoring and security evaluation services designed to assist you to reduce the threat from ransomware. These services incorporate modern AI capability to detect zero-day variants of crypto-ransomware that can get past traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the necessary monitoring and management for you, so your network expands readily without becoming an obstacle. For an affordable and predictable monthly price, Progent's experienced IT team can be your complete technology safety net. Basic packages include remote monitoring and management, security, automatic monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management technology to keep your network operating efficiently by checking the health of vital assets that drive your information system. When ProSight LAN Watch detects a problem, an alert is sent immediately to your specified IT personnel and your Progent consultant so that all looming problems can be addressed before they can disrupt your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for monitoring and managing your network, server, and desktop devices by offering tools for streamlining common time-consuming tasks. These can include health monitoring, update management, automated remediation, endpoint setup, backup and recovery, A/V defense, secure remote access, standard and custom scripts, asset inventory, endpoint status reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your designated IT management staff and your Progent consultant so potential issues can be taken care of before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to map, track, reconfigure and troubleshoot their networking hardware such as routers and switches, firewalls, and access points plus servers, printers, client computers and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that infrastructure topology maps are always current, copies and displays the configuration of virtually all devices on your network, tracks performance, and generates alerts when potential issues are discovered. By automating tedious management processes, ProSight WAN Watch can cut hours off common chores like making network diagrams, expanding your network, finding appliances that require important software patches, or resolving performance problems. Find out more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time reporting plug-ins created to integrate with the industry's leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues such as inconsistent support follow-up or machines with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has worked with leading backup/restore software companies to create ProSight Data Protection Services (DPS), a family of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS products automate and monitor your backup processes and allow non-disruptive backup and rapid recovery of vital files/folders, apps, images, and VMs. ProSight DPS helps you avoid data loss resulting from hardware failures, natural disasters, fire, malware such as ransomware, user error, malicious insiders, or application bugs. Managed backup services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of top information security vendors to provide web-based management and comprehensive security for your email traffic. The hybrid structure of Progent's Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway device to provide complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's cloud filter serves as a preliminary barricade and keeps the vast majority of threats from reaching your network firewall. This reduces your vulnerability to inbound threats and conserves network bandwidth and storage space. Email Guard's onsite security gateway appliance adds a further layer of inspection for incoming email. For outgoing email, the local security gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The on-premises gateway can also help Exchange Server to track and protect internal email that originates and ends inside your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication. Duo supports one-tap identity verification with iOS, Google Android, and other out-of-band devices. Using Duo 2FA, whenever you sign into a protected application and enter your password you are requested to verify your identity via a unit that only you have and that is accessed using a different network channel. A broad selection of devices can be used for this second means of authentication including an iPhone or Android or wearable, a hardware/software token, a landline phone, etc. You can designate multiple validation devices. For more information about ProSight Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Desk: Support Desk Managed Services
  Progent's Support Desk managed services allow your IT staff to offload Call Center services to Progent or divide activity for Service Desk support seamlessly between your internal network support staff and Progent's extensive pool of IT support engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a smooth supplement to your in-house network support resources. End user access to the Service Desk, provision of technical assistance, escalation, ticket creation and updates, performance measurement, and management of the service database are cohesive whether incidents are taken care of by your in-house IT support organization, by Progent, or both. Find out more about Progent's outsourced/shared Call Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes next generation behavior analysis technology to defend endpoint devices as well as servers and VMs against modern malware assaults such as ransomware and email phishing, which easily get by legacy signature-matching anti-virus products. Progent Active Security Monitoring services protect local and cloud-based resources and provides a unified platform to manage the entire threat progression including filtering, infiltration detection, containment, cleanup, and forensics. Key features include single-click rollback with Windows VSS and real-time system-wide immunization against new threats. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, update, retrieve and protect information related to your network infrastructure, processes, business apps, and services. You can instantly find passwords or IP addresses and be alerted automatically about upcoming expirations of SSL certificates or warranties. By updating and managing your IT documentation, you can eliminate as much as 50% of time spent trying to find vital information about your IT network. ProSight IT Asset Management includes a common repository for holding and sharing all documents related to managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for gathering and associating IT data. Whether you're planning improvements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you require when you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of any size a versatile and affordable alternative for evaluating, validating, scheduling, applying, and documenting updates to your ever-evolving information system. Besides optimizing the protection and functionality of your IT environment, Progent's patch management services free up time for your IT team to concentrate on line-of-business initiatives and tasks that derive maximum business value from your information network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual machine host set up and maintained by Progent's network support experts. With Progent's ProSight Virtual Hosting service model, the client owns the data, the operating system software, and the applications. Since the system is virtualized, it can be ported easily to a different hardware solution without requiring a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior analysis tools to defend physical and virtual endpoint devices against new malware attacks such as ransomware and file-less exploits, which easily escape traditional signature-matching anti-virus products. ProSight ASM safeguards local and cloud resources and offers a unified platform to manage the complete malware attack progression including protection, identification, containment, cleanup, and forensics. Key capabilities include single-click rollback with Windows VSS and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer economical multi-layer security for physical servers and VMs, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and reacting to cyber threats from all attack vectors. ProSight ESP delivers firewall protection, intrusion alarms, device management, and web filtering via cutting-edge tools incorporated within a single agent managed from a unified control. Progent's data protection and virtualization experts can assist you to plan and configure a ProSight ESP environment that addresses your company's specific requirements and that helps you demonstrate compliance with legal and industry data protection standards. Progent will assist you define and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that require urgent attention. Progent can also help your company to set up and test a backup and disaster recovery solution like ProSight Data Protection Services so you can recover quickly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange email filtering.