24-7 Ontario Urgent Crypto
Infection Identification and Recovery Consultants

Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become a modern cyber pandemic that presents an extinction-level threat for businesses of all sizes vulnerable to an assault. Multiple generations of ransomware like the Reveton, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for a long time and still inflict harm. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, along with daily unnamed newcomers, not only do encryption of on-line critical data but also infect many available system restores and backups. Files synched to the cloud can also be ransomed. In a poorly architected environment, it can make automated restoration hopeless and basically sets the network back to zero.

Retrieving services and data after a ransomware intrusion becomes a race against the clock as the targeted business fights to contain the damage, remove the ransomware, and resume mission-critical operations. Due to the fact that ransomware takes time to move laterally, assaults are frequently launched on weekends, when successful attacks may take more time to discover. This multiplies the difficulty of rapidly mobilizing and orchestrating an experienced mitigation team.

Progent offers an assortment of support services for protecting organizations from crypto-ransomware penetrations. Among these are user education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus setup and configuration of modern security gateways with machine learning capabilities from SentinelOne to detect and disable new threats intelligently. Progent also provides the assistance of veteran ransomware recovery consultants with the skills and perseverance to reconstruct a breached system as soon as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware invasion, paying the ransom demands in cryptocurrency does not ensure that distant criminals will provide the needed keys to decrypt any of your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The other path is to setup from scratch the vital elements of your IT environment. Without access to full system backups, this calls for a broad range of skill sets, top notch team management, and the ability to work 24x7 until the task is finished.

For two decades, Progent has offered professional IT services for companies throughout the United States and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded advanced industry certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with accounting and ERP applications. This breadth of experience affords Progent the ability to knowledgably ascertain necessary systems and re-organize the surviving pieces of your IT system following a ransomware event and configure them into a functioning system.

Progent's ransomware team of experts has powerful project management tools to coordinate the complex recovery process. Progent knows the importance of working swiftly and in unison with a customer's management and Information Technology staff to assign priority to tasks and to get critical systems back online as fast as humanly possible.

Client Story: A Successful Crypto-Ransomware Penetration Response
A customer hired Progent after their company was attacked by the Ryuk ransomware. Ryuk is thought to have been launched by Northern Korean state sponsored criminal gangs, suspected of using algorithms leaked from the United States National Security Agency. Ryuk seeks specific organizations with little ability to sustain disruption and is one of the most profitable iterations of ransomware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company located in Chicago and has about 500 employees. The Ryuk intrusion had frozen all business operations and manufacturing processes. Most of the client's information backups had been online at the time of the attack and were damaged. The client was evaluating paying the ransom demand (in excess of $200,000) and wishfully thinking for the best, but ultimately called Progent.

Progent worked together with the client to quickly understand and prioritize the critical elements that had to be addressed to make it possible to continue departmental operations:

• Windows Active Directory
• Electronic Messaging
• Financials/MRP

Within two days, Progent was able to rebuild Active Directory to its pre-attack state. Progent then accomplished setup and storage recovery of critical servers. All Microsoft Exchange Server data and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to collect local OST data files (Microsoft Outlook Offline Folder Files) on staff desktop computers to recover email data. A not too old offline backup of the customer's manufacturing systems made it possible to restore these vital applications back online for users. Although a lot of work was left to recover totally from the Ryuk virus, critical systems were recovered rapidly:

Over the next month important milestones in the recovery project were made through tight cooperation between Progent team members and the client:

• Internal web applications were brought back up with no loss of data.
• The MailStore Server with over four million archived messages was restored to operations and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control capabilities were completely restored.
• A new Palo Alto Networks 850 firewall was brought on-line.
• 90% of the user desktops and notebooks were fully operational.

Conclusion
A potential business extinction catastrophe was avoided through the efforts of top-tier professionals, a wide range of IT skills, and close collaboration. Although upon completion of forensics the ransomware penetration detailed here could have been stopped with advanced cyber security technology solutions and ISO/IEC 27001 best practices, user education, and well designed incident response procedures for information backup and applying software patches, the fact remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware virus, remember that Progent's roster of experts has a proven track record in ransomware virus defense, removal, and data restoration.

To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Ontario a variety of online monitoring and security assessment services designed to assist you to minimize your vulnerability to crypto-ransomware. These services utilize modern artificial intelligence technology to uncover new strains of crypto-ransomware that can get past legacy signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management (RMM) techniques to help keep your IT system running at peak levels by tracking the state of critical computers that power your information system. When ProSight LAN Watch detects a problem, an alert is transmitted immediately to your designated IT management staff and your assigned Progent engineering consultant so that any looming issues can be resolved before they can disrupt your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for smaller businesses to map, monitor, enhance and troubleshoot their connectivity hardware like routers and switches, firewalls, and wireless controllers as well as servers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology maps are kept current, captures and displays the configuration information of almost all devices connected to your network, monitors performance, and generates notices when issues are discovered. By automating time-consuming management and troubleshooting activities, ProSight WAN Watch can knock hours off common tasks such as making network diagrams, reconfiguring your network, finding devices that require critical software patches, or identifying the cause of performance bottlenecks. Learn more details about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time and in-depth management reporting tools created to integrate with the industry's top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues like spotty support follow-through or machines with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with advanced backup technology providers to produce ProSight Data Protection Services (DPS), a family of subscription-based management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services automate and track your backup operations and allow non-disruptive backup and fast restoration of important files, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss resulting from equipment failures, natural calamities, fire, malware like ransomware, user mistakes, malicious employees, or software bugs. Managed services available in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to determine which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of top information security companies to provide centralized management and comprehensive protection for all your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service combines a Cloud Protection Layer with an on-premises security gateway device to offer advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-based malware. Email Guard's cloud filter acts as a first line of defense and keeps most threats from making it to your security perimeter. This reduces your vulnerability to inbound attacks and saves network bandwidth and storage space. Email Guard's onsite security gateway appliance provides a further layer of inspection for inbound email. For outbound email, the on-premises security gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local gateway can also assist Exchange Server to monitor and safeguard internal email that originates and ends within your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo technology to protect against password theft by using two-factor authentication (2FA). Duo enables single-tap identity verification on Apple iOS, Google Android, and other personal devices. With 2FA, when you sign into a protected application and enter your password you are asked to confirm your identity on a unit that only you have and that is accessed using a separate network channel. A broad range of devices can be used as this added means of authentication including an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You may register several validation devices. For more information about Duo identity validation services, visit Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Service Desk: Call Center Managed Services
  Progent's Support Desk services permit your information technology group to outsource Support Desk services to Progent or split activity for Service Desk support transparently between your internal network support resources and Progent's nationwide pool of certified IT support engineers and subject matter experts. Progent's Co-managed Service Desk offers a transparent extension of your in-house network support organization. Client interaction with the Service Desk, delivery of support services, problem escalation, ticket creation and updates, efficiency metrics, and maintenance of the support database are consistent regardless of whether incidents are taken care of by your core network support group, by Progent's team, or a mix of the two. Read more about Progent's outsourced/shared Help Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that incorporates next generation behavior-based analysis technology to defend endpoint devices and servers and VMs against modern malware assaults such as ransomware and email phishing, which routinely escape traditional signature-matching anti-virus tools. Progent ASM services safeguard on-premises and cloud-based resources and provides a unified platform to automate the complete malware attack lifecycle including filtering, infiltration detection, mitigation, remediation, and forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, retrieve and protect data about your IT infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates or domains. By updating and organizing your network documentation, you can eliminate up to half of time thrown away looking for vital information about your IT network. ProSight IT Asset Management includes a centralized repository for storing and sharing all documents required for managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT data. Whether you're making improvements, doing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the information you require the instant you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a versatile and affordable solution for assessing, validating, scheduling, implementing, and documenting updates to your dynamic IT network. Besides maximizing the security and reliability of your IT network, Progent's patch management services allow your in-house IT staff to focus on more strategic initiatives and tasks that deliver maximum business value from your information network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a secure Tier III data center on a fast virtual machine host configured and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting service model, the client owns the data, the OS platforms, and the applications. Because the environment is virtualized, it can be ported immediately to an alternate hosting solution without requiring a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, you are not tied a single hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's next generation behavior-based machine learning tools to guard physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which easily escape legacy signature-matching anti-virus tools. ProSight ASM protects on-premises and cloud-based resources and provides a single platform to address the entire threat progression including protection, detection, containment, remediation, and post-attack forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable in-depth protection for physical servers and VMs, desktops, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced heuristics for round-the-clock monitoring and responding to cyber assaults from all attack vectors. ProSight ESP delivers firewall protection, penetration alerts, endpoint management, and web filtering through leading-edge technologies incorporated within one agent managed from a unified control. Progent's data protection and virtualization experts can assist you to plan and configure a ProSight ESP deployment that addresses your company's unique requirements and that helps you prove compliance with legal and industry information protection standards. Progent will assist you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that call for urgent attention. Progent can also help you to install and test a backup and restore system like ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.