Cincinnati 24-Hour Immediate CryptoLocker
Virus Assessment and Repair Consulting

Crypto-Ransomware : Your Worst Information Technology Catastrophe
Ransomware has become a too-frequent cyber pandemic that presents an existential threat for businesses of all sizes poorly prepared for an attack. Versions of crypto-ransomware like the CrySIS, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for years and continue to cause destruction. Recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, plus additional unnamed newcomers, not only encrypt online files but also infiltrate most configured system protection. Files synchronized to cloud environments can also be ransomed. In a poorly architected system, this can make automated restoration impossible and basically knocks the entire system back to zero.

Retrieving programs and data following a ransomware attack becomes a sprint against the clock as the targeted organization struggles to contain, eradicate the virus, and restore business-critical activity. Because crypto-ransomware requires time to replicate, assaults are often sprung on weekends, when successful penetrations may take more time to discover. This compounds the difficulty of promptly assembling and orchestrating an experienced mitigation team.

Progent has a variety of solutions for protecting organizations from ransomware events. These include team education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of next-generation security gateways with machine learning capabilities from SentinelOne to detect and extinguish day-zero cyber threats rapidly. Progent in addition provides the assistance of veteran ransomware recovery engineers with the talent and perseverance to reconstruct a compromised environment as rapidly as possible.

Progent's Ransomware Restoration Services
After a ransomware event, sending the ransom demands in cryptocurrency does not guarantee that distant criminals will respond with the needed codes to unencrypt any of your information. Kaspersky ascertained that 17% of crypto-ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to piece back together the essential elements of your IT environment. Absent access to essential data backups, this calls for a broad range of skill sets, well-coordinated project management, and the capability to work 24x7 until the job is completed.

For twenty years, Progent has offered certified expert Information Technology services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with accounting and ERP applications. This breadth of experience gives Progent the ability to quickly understand critical systems and consolidate the surviving parts of your IT environment after a crypto-ransomware event and configure them into a functioning system.

Progent's ransomware team of experts uses powerful project management applications to orchestrate the complex restoration process. Progent knows the urgency of working rapidly and together with a client's management and IT staff to assign priority to tasks and to put essential applications back online as soon as humanly possible.

Client Story: A Successful Ransomware Virus Response
A small business escalated to Progent after their organization was brought down by the Ryuk ransomware. Ryuk is believed to have been deployed by Northern Korean government sponsored cybercriminals, suspected of adopting technology exposed from America's NSA organization. Ryuk seeks specific organizations with limited room for disruption and is one of the most lucrative incarnations of ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturer located in the Chicago metro area and has around 500 workers. The Ryuk event had shut down all business operations and manufacturing processes. Most of the client's backups had been online at the time of the attack and were encrypted. The client was pursuing financing for paying the ransom demand (exceeding $200K) and praying for the best, but in the end made the decision to use Progent.

Progent worked with the customer to quickly determine and prioritize the key areas that had to be addressed in order to resume departmental operations:

• Active Directory (AD)
• Microsoft Exchange Server
• Financials/MRP

In less than 2 days, Progent was able to recover Active Directory to its pre-intrusion state. Progent then charged ahead with reinstallations and hard drive recovery on key applications. All Exchange schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was able to collect intact OST files (Outlook Offline Data Files) on various PCs to recover email messages. A recent off-line backup of the customer's manufacturing software made it possible to restore these vital applications back online. Although a large amount of work remained to recover totally from the Ryuk virus, core services were restored quickly:

Over the next few weeks critical milestones in the recovery project were accomplished in tight collaboration between Progent engineers and the client:

• Self-hosted web sites were brought back up with no loss of data.
• The MailStore Server exceeding 4 million archived emails was restored to operations and available for users.
• CRM/Product Ordering/Invoicing/AP/Accounts Receivables/Inventory Control modules were fully operational.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the user desktops were back into operation.

Conclusion
A probable business-ending disaster was avoided with top-tier professionals, a wide range of subject matter expertise, and close collaboration. Although in retrospect the ransomware attack described here could have been identified and stopped with modern security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator education, and properly executed security procedures for data protection and applying software patches, the fact is that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a crypto-ransomware incursion, feel confident that Progent's team of professionals has a proven track record in ransomware virus defense, remediation, and data restoration.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Cincinnati a portfolio of remote monitoring and security evaluation services designed to assist you to reduce the threat from crypto-ransomware. These services incorporate next-generation artificial intelligence capability to uncover new variants of crypto-ransomware that can get past legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the necessary monitoring and maintenance for you, so your system scales smoothly without holding you back. For an affordable and predictable monthly price, Progent's experienced IT team can be your complete technology safety net. Entry-level plans include remote monitoring and management, cybersecurity, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management techniques to help keep your network running efficiently by tracking the state of vital computers that power your business network. When ProSight LAN Watch uncovers an issue, an alarm is transmitted immediately to your designated IT staff and your assigned Progent engineering consultant so that any looming issues can be resolved before they can impact productivity. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your network, server, and desktop devices by offering an environment for streamlining common tedious jobs. These can include health monitoring, update management, automated remediation, endpoint deployment, backup and restore, A/V defense, secure remote access, built-in and custom scripts, asset inventory, endpoint status reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alarm to your designated IT management staff and your Progent technical consultant so that emerging issues can be taken care of before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized businesses to map, monitor, reconfigure and troubleshoot their networking hardware like routers, firewalls, and wireless controllers as well as servers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch ensures that infrastructure topology maps are always updated, copies and displays the configuration of almost all devices on your network, monitors performance, and generates alerts when problems are detected. By automating time-consuming management processes, WAN Watch can cut hours off ordinary chores like making network diagrams, expanding your network, finding devices that require critical software patches, or resolving performance bottlenecks. Learn more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of real-time management reporting utilities designed to integrate with the industry's top ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues like spotty support follow-through or machines with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore technology providers to produce ProSight Data Protection Services, a portfolio of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and track your data backup processes and enable non-disruptive backup and rapid restoration of important files/folders, applications, system images, plus VMs. ProSight DPS helps your business avoid data loss resulting from hardware breakdown, natural disasters, fire, malware such as ransomware, user error, ill-intentioned insiders, or software glitches. Managed backup services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent expert can assist you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the technology of top data security companies to deliver centralized control and comprehensive protection for all your email traffic. The powerful architecture of Email Guard managed service combines cloud-based filtering with a local gateway appliance to provide complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's Cloud Protection Layer serves as a first line of defense and blocks most threats from reaching your security perimeter. This reduces your exposure to external attacks and conserves system bandwidth and storage space. Email Guard's on-premises gateway device provides a deeper layer of analysis for inbound email. For outgoing email, the local security gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The onsite gateway can also assist Microsoft Exchange Server to monitor and protect internal email that originates and ends within your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to protect against stolen passwords through the use of two-factor authentication. Duo enables single-tap identity confirmation with iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a protected online account and enter your password you are asked to verify who you are via a device that only you have and that is accessed using a separate network channel. A wide range of out-of-band devices can be used for this second means of authentication including an iPhone or Android or watch, a hardware token, a landline telephone, etc. You may designate several verification devices. To learn more about Duo two-factor identity validation services, go to Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Help Center: Help Desk Managed Services
  Progent's Call Desk services enable your information technology group to outsource Call Center services to Progent or divide activity for Service Desk support transparently between your in-house support resources and Progent's nationwide pool of certified IT support technicians, engineers and subject matter experts. Progent's Shared Help Desk Service offers a transparent supplement to your corporate IT support staff. End user interaction with the Help Desk, provision of support services, escalation, trouble ticket creation and updates, efficiency metrics, and maintenance of the support database are cohesive whether incidents are resolved by your internal support group, by Progent's team, or a mix of the two. Learn more about Progent's outsourced/co-managed Service Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection service that incorporates cutting edge behavior machine learning tools to guard endpoints as well as physical and virtual servers against modern malware attacks like ransomware and email phishing, which routinely escape traditional signature-matching AV products. Progent ASM services safeguard local and cloud resources and offers a unified platform to address the entire malware attack progression including filtering, detection, containment, cleanup, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, retrieve and protect information related to your network infrastructure, processes, applications, and services. You can quickly find passwords or IP addresses and be warned about impending expirations of SSLs or domains. By cleaning up and managing your IT documentation, you can eliminate up to 50% of time spent trying to find vital information about your IT network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents related to managing your business network like standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT information. Whether you're planning improvements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the data you need as soon as you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of all sizes a versatile and affordable alternative for assessing, validating, scheduling, implementing, and tracking software and firmware updates to your ever-evolving information network. Besides maximizing the security and reliability of your computer network, Progent's software/firmware update management services allow your IT staff to concentrate on line-of-business projects and tasks that derive the highest business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure Tier III data center on a high-performance virtual machine host set up and maintained by Progent's network support professionals. With Progent's ProSight Virtual Hosting service model, the customer owns the data, the OS platforms, and the apps. Since the environment is virtualized, it can be ported easily to a different hosting environment without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior machine learning tools to guard physical and virtual endpoints against modern malware assaults such as ransomware and file-less exploits, which routinely evade traditional signature-matching AV tools. ProSight Active Security Monitoring protects local and cloud resources and provides a unified platform to manage the complete threat progression including filtering, infiltration detection, containment, remediation, and post-attack forensics. Top features include single-click rollback using Windows VSS and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection services offer economical in-depth protection for physical servers and virtual machines, workstations, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, device control, and web filtering through cutting-edge tools incorporated within a single agent accessible from a unified control. Progent's data protection and virtualization consultants can help your business to design and configure a ProSight ESP environment that meets your company's specific needs and that helps you prove compliance with legal and industry data security standards. Progent will assist you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that call for urgent action. Progent's consultants can also help your company to install and test a backup and restore solution like ProSight Data Protection Services so you can recover rapidly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange filtering.