24-Hour Schaumburg Critical CryptoLocker
Virus Identification and Remediation Experts

Crypto-Ransomware : Your Crippling IT Nightmare
Ransomware has become a modern cyber pandemic that poses an enterprise-level danger for businesses of all sizes unprepared for an assault. Different versions of crypto-ransomware such as Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been around for a long time and continue to inflict damage. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as frequent as yet unnamed newcomers, not only encrypt on-line data but also infiltrate all available system backup. Information synchronized to the cloud can also be held hostage. In a poorly designed data protection solution, it can render any restoration impossible and basically sets the network back to square one.

Restoring programs and data following a ransomware outage becomes a sprint against time as the targeted organization tries its best to contain the damage, eradicate the crypto-ransomware, and resume enterprise-critical operations. Since crypto-ransomware requires time to replicate, attacks are usually sprung on weekends, when attacks tend to take more time to discover. This multiplies the difficulty of quickly assembling and orchestrating a qualified response team.

Progent makes available a variety of support services for securing businesses from crypto-ransomware attacks. Among these are team member education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of modern security gateways with machine learning technology from SentinelOne to discover and disable zero-day cyber threats rapidly. Progent in addition provides the assistance of seasoned ransomware recovery professionals with the track record and perseverance to restore a compromised system as soon as possible.

Progent's Ransomware Restoration Support Services
Following a ransomware invasion, sending the ransom in cryptocurrency does not guarantee that cyber hackers will return the needed keys to decipher any or all of your information. Kaspersky estimated that seventeen percent of crypto-ransomware victims never recovered their data even after having paid the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to piece back together the essential elements of your IT environment. Absent the availability of essential information backups, this requires a wide complement of skill sets, top notch team management, and the capability to work continuously until the task is complete.

For two decades, Progent has provided professional Information Technology services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with accounting and ERP applications. This breadth of experience gives Progent the capability to rapidly determine critical systems and organize the surviving components of your computer network system after a ransomware attack and rebuild them into an operational network.

Progent's security group has powerful project management tools to coordinate the sophisticated recovery process. Progent appreciates the importance of acting quickly and together with a customer's management and IT team members to assign priority to tasks and to put key systems back on line as fast as possible.

Client Story: A Successful Crypto-Ransomware Penetration Response
A client contacted Progent after their network system was brought down by the Ryuk ransomware virus. Ryuk is believed to have been developed by Northern Korean government sponsored cybercriminals, possibly adopting technology leaked from the United States NSA organization. Ryuk targets specific businesses with little tolerance for operational disruption and is one of the most profitable iterations of ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in the Chicago metro area and has around 500 employees. The Ryuk attack had disabled all business operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the start of the intrusion and were damaged. The client was taking steps for paying the ransom (more than two hundred thousand dollars) and praying for good luck, but ultimately called Progent.

Progent worked with the customer to rapidly understand and prioritize the key systems that needed to be restored to make it possible to continue departmental functions:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

In less than two days, Progent was able to recover Windows Active Directory to its pre-intrusion state. Progent then helped perform setup and storage recovery of needed systems. All Exchange ties and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Email Offline Data Files) on user desktop computers in order to recover mail data. A recent off-line backup of the customer's manufacturing systems made it possible to restore these vital applications back online. Although a lot of work needed to be completed to recover completely from the Ryuk event, essential services were recovered rapidly:

During the following month critical milestones in the restoration project were completed in tight collaboration between Progent consultants and the client:

• Internal web sites were returned to operation without losing any data.
• The MailStore Exchange Server with over four million historical messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory Control functions were 100% restored.
• A new Palo Alto 850 security appliance was brought online.
• Ninety percent of the user workstations were fully operational.

Conclusion
A potential business disaster was averted by hard-working professionals, a broad spectrum of knowledge, and tight teamwork. Although in hindsight the ransomware virus incident detailed here should have been shut down with modern security technology and best practices, user and IT administrator education, and well designed security procedures for information backup and applying software patches, the fact is that state-sponsored hackers from Russia, China and elsewhere are relentless and are not going away. If you do get hit by a ransomware virus, remember that Progent's roster of experts has a proven track record in ransomware virus blocking, cleanup, and information systems disaster recovery.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Schaumburg a portfolio of remote monitoring and security assessment services to assist you to reduce the threat from ransomware. These services utilize modern artificial intelligence capability to uncover new variants of ransomware that are able to get past legacy signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create advanced network resilience. Progent takes care of the necessary monitoring and maintenance for you, so your system expands smoothly without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's experienced IT team can be your complete technology safety net. Basic packages include remote monitoring and management (RMM), cybersecurity, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management (RMM) technology to help keep your network operating at peak levels by tracking the health of vital computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your specified IT staff and your Progent engineering consultant so that any potential issues can be addressed before they have a chance to impact your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven solution for monitoring and managing your client-server infrastructure by providing tools for streamlining common tedious jobs. These can include health checking, update management, automated repairs, endpoint setup, backup and recovery, anti-virus response, remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your designated IT personnel and your assigned Progent technical consultant so potential issues can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for smaller businesses to map, monitor, enhance and troubleshoot their connectivity appliances such as routers, firewalls, and access points as well as servers, printers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, WAN Watch makes sure that network maps are kept current, copies and displays the configuration of virtually all devices connected to your network, monitors performance, and sends alerts when issues are discovered. By automating complex network management activities, ProSight WAN Watch can cut hours off ordinary tasks like making network diagrams, reconfiguring your network, finding devices that need important updates, or resolving performance issues. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of in-depth management reporting plug-ins created to work with the leading ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues such as inconsistent support follow-up or machines with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has worked with leading backup technology companies to produce ProSight Data Protection Services, a selection of subscription-based offerings that provide backup-as-a-service (BaaS). ProSight DPS products automate and monitor your data backup processes and enable non-disruptive backup and rapid restoration of critical files/folders, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss resulting from equipment breakdown, natural disasters, fire, cyber attacks like ransomware, user mistakes, malicious insiders, or application bugs. Managed backup services in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Hybrid Backup. Your Progent expert can help you to determine which of these fully managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading information security companies to deliver web-based control and world-class security for all your email traffic. The powerful architecture of Progent's Email Guard combines cloud-based filtering with a local security gateway device to offer advanced protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne malware. The Cloud Protection Layer serves as a first line of defense and keeps most unwanted email from making it to your network firewall. This decreases your exposure to inbound attacks and conserves system bandwidth and storage space. Email Guard's on-premises security gateway device adds a further level of analysis for inbound email. For outbound email, the on-premises security gateway provides anti-virus and anti-spam filtering, DLP, and email encryption. The onsite security gateway can also help Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends within your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA services incorporate Cisco's Duo cloud technology to protect against password theft by using two-factor authentication. Duo enables one-tap identity confirmation on Apple iOS, Android, and other out-of-band devices. With 2FA, whenever you log into a secured online account and enter your password you are requested to verify who you are via a unit that only you have and that is accessed using a different network channel. A wide selection of out-of-band devices can be utilized as this added form of ID validation such as a smartphone or watch, a hardware/software token, a landline telephone, etc. You can register multiple validation devices. For more information about ProSight Duo identity authentication services, visit Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Call Center managed services enable your information technology staff to offload Support Desk services to Progent or divide activity for Help Desk services seamlessly between your in-house network support group and Progent's nationwide pool of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service provides a smooth extension of your internal network support staff. Client interaction with the Service Desk, provision of support, problem escalation, trouble ticket creation and tracking, efficiency metrics, and maintenance of the service database are consistent regardless of whether incidents are resolved by your core network support organization, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/co-managed Help Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior-based machine learning technology to defend endpoint devices and physical and virtual servers against new malware attacks such as ransomware and email phishing, which routinely get by traditional signature-based AV tools. Progent Active Security Monitoring services safeguard local and cloud-based resources and provides a single platform to address the complete malware attack lifecycle including blocking, detection, containment, cleanup, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, find and protect information related to your IT infrastructure, processes, business apps, and services. You can quickly find passwords or IP addresses and be warned about impending expirations of SSL certificates or domains. By updating and organizing your IT infrastructure documentation, you can save as much as half of time spent trying to find vital information about your IT network. ProSight IT Asset Management features a common location for holding and sharing all documents required for managing your network infrastructure like standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and associating IT data. Whether you're making improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you require the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide businesses of any size a flexible and cost-effective alternative for evaluating, testing, scheduling, applying, and tracking updates to your dynamic IT system. In addition to optimizing the protection and functionality of your IT environment, Progent's software/firmware update management services free up time for your IT staff to focus on more strategic initiatives and activities that deliver the highest business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a protected fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's IT support experts. With Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be ported immediately to an alternate hosting solution without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that incorporates SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoints against new malware assaults such as ransomware and file-less exploits, which easily evade traditional signature-based anti-virus products. ProSight Active Security Monitoring protects local and cloud resources and offers a single platform to automate the entire threat lifecycle including protection, infiltration detection, mitigation, cleanup, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable in-depth protection for physical and virtual servers, workstations, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced machine learning for round-the-clock monitoring and reacting to security threats from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, device management, and web filtering through leading-edge tools incorporated within one agent managed from a unified control. Progent's data protection and virtualization consultants can assist you to plan and implement a ProSight ESP environment that meets your organization's unique requirements and that allows you prove compliance with legal and industry information protection standards. Progent will help you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that require immediate action. Progent's consultants can also help your company to install and verify a backup and disaster recovery solution like ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.