24-Hour Webster Emergency Crypto-Ransomware
Computer Virus Damage Assessment and Removal Consulting

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a modern cyberplague that represents an enterprise-level danger for businesses poorly prepared for an attack. Different iterations of crypto-ransomware such as Dharma, WannaCry, Locky, SamSam and MongoLock cryptoworms have been circulating for years and continue to inflict damage. The latest strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with frequent as yet unnamed viruses, not only encrypt on-line data files but also infect most available system protection. Data replicated to the cloud can also be corrupted. In a poorly designed system, this can render automated recovery impossible and effectively knocks the network back to zero.

Recovering applications and information after a crypto-ransomware outage becomes a sprint against time as the targeted business tries its best to stop the spread, clear the ransomware, and resume mission-critical operations. Because crypto-ransomware requires time to spread, penetrations are often launched during weekends and nights, when attacks tend to take longer to identify. This multiplies the difficulty of quickly marshalling and coordinating a capable mitigation team.

Progent makes available a range of solutions for protecting businesses from ransomware attacks. Among these are user training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of next-generation security solutions with machine learning capabilities from SentinelOne to identify and quarantine day-zero threats quickly. Progent in addition can provide the services of experienced ransomware recovery consultants with the track record and commitment to restore a compromised network as soon as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a ransomware invasion, even paying the ransom in cryptocurrency does not ensure that cyber criminals will return the keys to decrypt any of your files. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to piece back together the mission-critical elements of your Information Technology environment. Without the availability of full data backups, this requires a broad range of IT skills, professional team management, and the capability to work 24x7 until the job is complete.

For decades, Progent has provided expert Information Technology services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have attained top certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of expertise provides Progent the skills to knowledgably determine important systems and consolidate the remaining components of your IT system after a ransomware penetration and configure them into a functioning system.

Progent's ransomware team utilizes best of breed project management applications to coordinate the complicated recovery process. Progent understands the importance of acting swiftly and in unison with a client's management and Information Technology resources to assign priority to tasks and to put essential services back on-line as soon as possible.

Customer Story: A Successful Ransomware Penetration Recovery
A small business engaged Progent after their network system was crashed by Ryuk ransomware. Ryuk is believed to have been created by North Korean government sponsored cybercriminals, suspected of adopting approaches leaked from America's National Security Agency. Ryuk targets specific companies with limited room for disruption and is one of the most lucrative instances of crypto-ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in the Chicago metro area and has about 500 workers. The Ryuk penetration had brought down all business operations and manufacturing processes. The majority of the client's backups had been directly accessible at the time of the attack and were damaged. The client considered paying the ransom (exceeding $200,000) and hoping for good luck, but in the end brought in Progent.

Progent worked together with the client to rapidly get our arms around and assign priority to the essential systems that needed to be restored in order to restart departmental functions:

• Active Directory (AD)
• Microsoft Exchange
• Financials/MRP

In less than 48 hours, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then helped perform setup and hard drive recovery on critical applications. All Microsoft Exchange Server schema and attributes were intact, which greatly helped the restore of Exchange. Progent was able to find non-encrypted OST files (Outlook Email Off-Line Folder Files) on team workstations in order to recover email information. A not too old off-line backup of the customer's financials/MRP systems made them able to recover these essential services back servicing users. Although significant work needed to be completed to recover totally from the Ryuk virus, critical services were recovered rapidly:

During the next couple of weeks key milestones in the recovery process were accomplished through close collaboration between Progent consultants and the customer:

• Internal web sites were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server containing more than 4 million archived messages was restored to operations and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory modules were fully functional.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Ninety percent of the user desktops and notebooks were fully operational.

Conclusion
A possible business disaster was avoided through the efforts of hard-working experts, a wide range of knowledge, and tight teamwork. Although upon completion of forensics the ransomware virus attack detailed here should have been identified and blocked with current security systems and best practices, user and IT administrator training, and appropriate security procedures for data protection and applying software patches, the reality remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware virus, feel confident that Progent's roster of experts has extensive experience in ransomware virus blocking, cleanup, and data restoration.

To read or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Webster a variety of online monitoring and security assessment services to help you to minimize your vulnerability to ransomware. These services include next-generation artificial intelligence capability to detect new strains of ransomware that can get past legacy signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to create advanced network resilience. Progent handles the necessary monitoring and management for you, so your system scales readily without holding you back. For an affordable and predictable monthly price, Progent's full-service IT group can be your complete technology safety net. Basic plans include RMM, security, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management (RMM) technology to help keep your IT system operating efficiently by tracking the health of critical computers that power your business network. When ProSight LAN Watch uncovers a problem, an alert is sent automatically to your specified IT personnel and your Progent engineering consultant so any potential issues can be addressed before they have a chance to disrupt productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your client-server infrastructure by providing an environment for streamlining common tedious tasks. These include health checking, patch management, automated repairs, endpoint setup, backup and recovery, A/V protection, secure remote access, standard and custom scripts, asset inventory, endpoint status reports, and debugging support. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alarm to your designated IT management staff and your Progent consultant so that emerging issues can be fixed before they interfere with your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for small and mid-sized organizations to map out, track, reconfigure and troubleshoot their networking hardware like routers and switches, firewalls, and wireless controllers plus servers, printers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management technology, WAN Watch ensures that network diagrams are kept current, copies and displays the configuration information of almost all devices connected to your network, monitors performance, and sends notices when potential issues are detected. By automating time-consuming management activities, WAN Watch can cut hours off ordinary chores such as making network diagrams, expanding your network, locating appliances that need important updates, or isolating performance bottlenecks. Learn more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of in-depth management reporting utilities designed to integrate with the top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues such as spotty support follow-up or machines with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore software companies to create ProSight Data Protection Services, a family of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services manage and track your data backup processes and enable transparent backup and fast recovery of important files, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business recover from data loss resulting from hardware failures, natural disasters, fire, malware such as ransomware, user mistakes, malicious employees, or application bugs. Managed services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to determine which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of top information security companies to provide centralized management and comprehensive protection for your inbound and outbound email. The hybrid structure of Progent's Email Guard integrates a Cloud Protection Layer with a local gateway appliance to provide complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's cloud filter serves as a preliminary barricade and keeps the vast majority of threats from reaching your security perimeter. This decreases your vulnerability to external attacks and saves system bandwidth and storage. Email Guard's onsite security gateway device adds a deeper level of analysis for incoming email. For outgoing email, the on-premises gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also assist Exchange Server to track and protect internal email traffic that stays within your corporate firewall. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication (2FA). Duo enables one-tap identity verification on Apple iOS, Android, and other personal devices. With Duo 2FA, whenever you log into a secured online account and give your password you are requested to verify who you are via a device that only you have and that uses a different network channel. A broad selection of devices can be utilized as this added form of authentication including an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You may designate multiple validation devices. To learn more about Duo two-factor identity authentication services, refer to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Desk: Support Desk Managed Services
  Progent's Help Center services permit your information technology team to outsource Support Desk services to Progent or split activity for Service Desk support seamlessly between your internal network support group and Progent's extensive roster of certified IT support engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a smooth supplement to your corporate IT support organization. Client access to the Help Desk, provision of technical assistance, problem escalation, trouble ticket generation and tracking, performance measurement, and maintenance of the service database are consistent whether incidents are resolved by your in-house support organization, by Progent, or a mix of the two. Read more about Progent's outsourced/shared Call Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior-based analysis tools to defend endpoint devices as well as physical and virtual servers against modern malware assaults such as ransomware and file-less exploits, which easily escape legacy signature-matching AV products. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and provides a single platform to manage the complete malware attack lifecycle including protection, identification, containment, remediation, and forensics. Key capabilities include one-click rollback using Windows VSS and automatic network-wide immunization against new threats. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, retrieve and protect information related to your network infrastructure, processes, business apps, and services. You can quickly locate passwords or serial numbers and be warned about impending expirations of SSLs or warranties. By updating and managing your network documentation, you can save up to half of time wasted looking for critical information about your network. ProSight IT Asset Management includes a common location for holding and sharing all documents related to managing your network infrastructure such as recommended procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT data. Whether you're planning improvements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you need as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of any size a flexible and affordable alternative for assessing, validating, scheduling, implementing, and tracking updates to your ever-evolving information system. In addition to maximizing the security and reliability of your computer network, Progent's patch management services free up time for your in-house IT staff to concentrate on line-of-business projects and tasks that deliver maximum business value from your network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a protected fault tolerant data center on a fast virtual host set up and maintained by Progent's network support professionals. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system platforms, and the applications. Because the system is virtualized, it can be moved easily to a different hardware solution without a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that utilizes SentinelOne's next generation behavior-based machine learning tools to guard physical and virtual endpoint devices against new malware assaults such as ransomware and file-less exploits, which routinely escape traditional signature-matching AV products. ProSight Active Security Monitoring protects on-premises and cloud resources and provides a unified platform to manage the entire threat lifecycle including blocking, identification, mitigation, remediation, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable in-depth security for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced machine learning for round-the-clock monitoring and reacting to security threats from all vectors. ProSight ESP offers two-way firewall protection, penetration alerts, device control, and web filtering through cutting-edge technologies incorporated within a single agent managed from a unified control. Progent's data protection and virtualization consultants can help you to plan and implement a ProSight ESP environment that meets your company's unique needs and that allows you achieve and demonstrate compliance with legal and industry data protection regulations. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that call for immediate attention. Progent can also help your company to set up and test a backup and restore system like ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange email filtering.