Addison 24-7 Emergency Ransomware
Infection Damage Assessment and Recovery Consultants

Crypto-Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become an escalating cyberplague that poses an extinction-level threat for businesses of all sizes unprepared for an assault. Different iterations of crypto-ransomware like the Dharma, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for many years and still cause havoc. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, along with daily unnamed viruses, not only do encryption of online information but also infiltrate all configured system backups. Files synched to off-site disaster recovery sites can also be ransomed. In a poorly designed system, it can make any recovery impossible and effectively sets the entire system back to square one.

Getting back on-line services and information following a ransomware intrusion becomes a race against the clock as the targeted business fights to stop lateral movement, clear the virus, and resume mission-critical operations. Due to the fact that ransomware takes time to move laterally, assaults are often sprung at night, when attacks in many cases take more time to notice. This compounds the difficulty of rapidly marshalling and organizing a capable response team.

Progent offers a range of help services for protecting businesses from ransomware attacks. Among these are staff education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of modern security solutions with AI technology from SentinelOne to detect and suppress day-zero cyber threats quickly. Progent in addition can provide the services of expert crypto-ransomware recovery professionals with the track record and commitment to rebuild a breached network as quickly as possible.

Progent's Ransomware Restoration Support Services
Following a crypto-ransomware event, sending the ransom demands in cryptocurrency does not ensure that distant criminals will provide the codes to decipher any of your files. Kaspersky determined that 17% of ransomware victims never recovered their files even after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The alternative is to piece back together the mission-critical elements of your IT environment. Without access to full system backups, this requires a wide complement of IT skills, top notch project management, and the willingness to work 24x7 until the recovery project is complete.

For twenty years, Progent has offered expert Information Technology services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have earned top certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have earned internationally-renowned certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of experience affords Progent the ability to knowledgably determine important systems and consolidate the remaining components of your Information Technology environment after a ransomware event and rebuild them into a functioning system.

Progent's recovery group uses best of breed project management systems to orchestrate the complicated restoration process. Progent understands the importance of acting rapidly and together with a client's management and Information Technology team members to prioritize tasks and to put the most important systems back on-line as soon as humanly possible.

Business Case Study: A Successful Ransomware Incident Restoration
A client engaged Progent after their company was brought down by the Ryuk ransomware. Ryuk is believed to have been developed by North Korean state sponsored cybercriminals, possibly using technology exposed from the United States National Security Agency. Ryuk attacks specific organizations with little or no ability to sustain disruption and is one of the most lucrative instances of ransomware malware. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in Chicago with about 500 workers. The Ryuk event had paralyzed all company operations and manufacturing capabilities. Most of the client's backups had been directly accessible at the beginning of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and hoping for good luck, but in the end utilized Progent.

Progent worked with the client to rapidly get our arms around and assign priority to the essential areas that had to be restored in order to continue company functions:

• Active Directory (AD)
• Email
• Accounting/MRP

In less than two days, Progent was able to restore Windows Active Directory to its pre-penetration state. Progent then assisted with setup and storage recovery on essential systems. All Microsoft Exchange Server ties and attributes were usable, which facilitated the restore of Exchange. Progent was able to locate local OST files (Outlook Email Offline Folder Files) on user desktop computers and laptops in order to recover mail data. A not too old off-line backup of the client's accounting/MRP systems made them able to restore these essential services back on-line. Although major work needed to be completed to recover totally from the Ryuk virus, the most important systems were recovered rapidly:

During the following month critical milestones in the restoration process were achieved in close collaboration between Progent team members and the customer:

• Internal web applications were brought back up without losing any information.
• The MailStore Exchange Server exceeding 4 million historical messages was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory modules were completely functional.
• A new Palo Alto 850 firewall was installed.
• 90% of the user desktops and notebooks were functioning as before the incident.

Conclusion
A possible business-ending disaster was evaded due to dedicated experts, a broad spectrum of knowledge, and close collaboration. Although in post mortem the ransomware attack detailed here could have been stopped with up-to-date security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and properly executed incident response procedures for data backup and proper patching controls, the reality is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware penetration, remember that Progent's team of professionals has a proven track record in crypto-ransomware virus defense, removal, and file disaster recovery.

To review or download a PDF version of this customer story, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Addison a range of remote monitoring and security evaluation services designed to help you to reduce your vulnerability to crypto-ransomware. These services include modern machine learning capability to detect zero-day strains of crypto-ransomware that can evade legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent handles the daily monitoring and management for you, so your system expands easily without becoming an obstacle. For an affordable and predictable monthly price, Progent's full-service IT group can be your dependable technology safety net. Basic packages include remote monitoring and management (RMM), security, automatic monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management techniques to help keep your network running efficiently by checking the state of vital computers that drive your business network. When ProSight LAN Watch detects an issue, an alert is sent immediately to your designated IT personnel and your assigned Progent engineering consultant so all looming problems can be resolved before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for monitoring and managing your network, server, and desktop devices by providing tools for performing common tedious tasks. These include health monitoring, update management, automated repairs, endpoint deployment, backup and recovery, anti-virus defense, secure remote access, built-in and custom scripts, asset inventory, endpoint status reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alarm to your specified IT personnel and your assigned Progent technical consultant so that potential problems can be taken care of before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for smaller organizations to map out, monitor, enhance and troubleshoot their connectivity appliances such as routers, firewalls, and load balancers plus servers, client computers and other networked devices. Incorporating cutting-edge RMM technology, WAN Watch ensures that network maps are always current, copies and displays the configuration of virtually all devices connected to your network, monitors performance, and generates notices when problems are discovered. By automating time-consuming management and troubleshooting processes, WAN Watch can cut hours off common tasks such as network mapping, reconfiguring your network, finding appliances that need critical updates, or isolating performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of in-depth reporting utilities created to integrate with the industry's leading ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues such as inconsistent support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with advanced backup software providers to produce ProSight Data Protection Services (DPS), a family of management outsourcing plans that provide backup-as-a-service. ProSight DPS products automate and monitor your backup processes and allow transparent backup and rapid restoration of important files, apps, images, plus VMs. ProSight DPS helps your business avoid data loss resulting from equipment failures, natural calamities, fire, malware such as ransomware, user mistakes, ill-intentioned insiders, or application bugs. Managed backup services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to determine which of these managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of top data security companies to provide centralized management and comprehensive protection for all your email traffic. The powerful architecture of Email Guard combines a Cloud Protection Layer with an on-premises security gateway device to provide complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-borne threats. Email Guard's Cloud Protection Layer acts as a first line of defense and keeps most unwanted email from making it to your network firewall. This reduces your exposure to inbound attacks and saves network bandwidth and storage space. Email Guard's onsite security gateway appliance provides a further level of inspection for inbound email. For outbound email, the local security gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also help Microsoft Exchange Server to track and protect internal email that stays inside your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo technology to defend against compromised passwords by using two-factor authentication (2FA). Duo supports single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. Using Duo 2FA, whenever you log into a protected application and give your password you are requested to confirm your identity on a device that only you possess and that is accessed using a separate network channel. A broad selection of out-of-band devices can be utilized for this second form of ID validation including a smartphone or watch, a hardware/software token, a landline telephone, etc. You may register several verification devices. For details about Duo two-factor identity authentication services, go to Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Desk: Help Desk Managed Services
  Progent's Call Desk services enable your IT staff to offload Call Center services to Progent or divide activity for Help Desk services seamlessly between your in-house support staff and Progent's nationwide pool of certified IT support technicians, engineers and subject matter experts. Progent's Co-managed Service Desk offers a seamless supplement to your internal IT support resources. End user interaction with the Help Desk, delivery of support services, escalation, trouble ticket generation and tracking, efficiency measurement, and maintenance of the service database are cohesive whether issues are taken care of by your internal support resources, by Progent's team, or by a combination. Learn more about Progent's outsourced/co-managed Help Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior-based machine learning technology to guard endpoint devices as well as servers and VMs against new malware attacks like ransomware and file-less exploits, which routinely evade traditional signature-based anti-virus products. Progent ASM services safeguard on-premises and cloud resources and offers a unified platform to address the entire malware attack lifecycle including protection, infiltration detection, containment, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, find and protect data related to your IT infrastructure, processes, applications, and services. You can quickly find passwords or serial numbers and be warned about upcoming expirations of SSLs ,domains or warranties. By updating and managing your IT infrastructure documentation, you can save up to 50% of time thrown away looking for critical information about your network. ProSight IT Asset Management features a common repository for holding and sharing all documents related to managing your business network like standard operating procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and relating IT information. Whether you're making enhancements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management provide organizations of any size a flexible and affordable solution for evaluating, testing, scheduling, implementing, and documenting updates to your ever-evolving IT network. Besides optimizing the protection and functionality of your IT network, Progent's software/firmware update management services permit your in-house IT team to concentrate on line-of-business initiatives and tasks that derive maximum business value from your information network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual machine host set up and maintained by Progent's network support experts. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the OS software, and the apps. Since the environment is virtualized, it can be ported immediately to a different hardware solution without requiring a time-consuming and difficult configuration process. With ProSight Virtual Hosting, your business is not locked into a single hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's next generation behavior machine learning technology to guard physical and virtual endpoints against new malware assaults such as ransomware and file-less exploits, which easily escape traditional signature-based AV tools. ProSight ASM protects local and cloud resources and offers a single platform to automate the entire threat lifecycle including protection, detection, mitigation, cleanup, and post-attack forensics. Top features include single-click rollback using Windows VSS and automatic system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable multi-layer security for physical servers and virtual machines, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and reacting to cyber assaults from all vectors. ProSight ESP provides two-way firewall protection, penetration alarms, endpoint management, and web filtering through cutting-edge tools incorporated within a single agent accessible from a unified console. Progent's data protection and virtualization consultants can assist you to plan and configure a ProSight ESP environment that meets your organization's specific needs and that allows you demonstrate compliance with legal and industry information security standards. Progent will help you specify and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that call for immediate action. Progent's consultants can also assist you to install and test a backup and restore system like ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange filtering.