24-7 Akron Critical Crypto
Computer Malware Damage Assessment and Recovery Consultants

Ransomware : Your Worst IT Nightmare
Ransomware has become a modern cyber pandemic that presents an extinction-level danger for businesses unprepared for an assault. Versions of ransomware such as Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been circulating for years and still inflict harm. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, plus additional unnamed newcomers, not only do encryption of on-line data files but also infect many configured system restores and backups. Files synched to off-site disaster recovery sites can also be corrupted. In a vulnerable system, this can make any restoration useless and effectively sets the datacenter back to square one.

Recovering services and information following a crypto-ransomware intrusion becomes a sprint against time as the targeted organization struggles to stop the spread, clear the virus, and resume mission-critical activity. Because ransomware requires time to spread, assaults are frequently launched on weekends and holidays, when attacks are likely to take more time to identify. This compounds the difficulty of quickly marshalling and organizing a knowledgeable response team.

Progent offers an assortment of solutions for protecting businesses from crypto-ransomware attacks. These include user training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of modern security solutions with machine learning technology from SentinelOne to detect and quarantine new cyber attacks automatically. Progent in addition provides the assistance of seasoned ransomware recovery professionals with the skills and commitment to re-deploy a compromised system as rapidly as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a crypto-ransomware event, paying the ransom demands in cryptocurrency does not ensure that cyber hackers will provide the codes to decrypt all your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The fallback is to re-install the essential components of your IT environment. Without access to full data backups, this calls for a wide complement of skill sets, well-coordinated project management, and the capability to work 24x7 until the job is done.

For twenty years, Progent has made available expert IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with accounting and ERP applications. This breadth of experience gives Progent the skills to knowledgably ascertain critical systems and re-organize the remaining components of your computer network system after a ransomware event and assemble them into an operational network.

Progent's security team of experts deploys state-of-the-art project management applications to coordinate the sophisticated recovery process. Progent appreciates the urgency of working rapidly and together with a client's management and Information Technology staff to assign priority to tasks and to put the most important applications back online as fast as humanly possible.

Client Story: A Successful Crypto-Ransomware Penetration Recovery
A customer contacted Progent after their organization was crashed by the Ryuk ransomware. Ryuk is thought to have been deployed by Northern Korean state cybercriminals, suspected of using techniques leaked from America's National Security Agency. Ryuk goes after specific businesses with little ability to sustain disruption and is among the most lucrative examples of ransomware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in the Chicago metro area with about 500 staff members. The Ryuk attack had brought down all company operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the time of the attack and were damaged. The client considered paying the ransom (more than $200,000) and praying for good luck, but in the end made the decision to use Progent.

Progent worked together with the customer to rapidly determine and assign priority to the essential elements that needed to be restored in order to continue departmental operations:

• Windows Active Directory
• Microsoft Exchange Email
• Accounting and Manufacturing Software

In less than two days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then assisted with rebuilding and hard drive recovery on the most important applications. All Exchange ties and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to find local OST data files (Outlook Email Offline Data Files) on various workstations to recover mail information. A not too old off-line backup of the client's manufacturing software made them able to return these essential services back servicing users. Although a lot of work was left to recover fully from the Ryuk virus, essential services were returned to operations rapidly:

Over the next few weeks critical milestones in the recovery project were achieved through tight collaboration between Progent engineers and the customer:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server exceeding 4 million archived messages was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory modules were 100% operational.
• A new Palo Alto Networks 850 firewall was deployed.
• Nearly all of the user desktops and notebooks were back into operation.

Conclusion
A likely enterprise-killing catastrophe was avoided by dedicated professionals, a wide spectrum of technical expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware incident detailed here would have been identified and prevented with current security technology and ISO/IEC 27001 best practices, user and IT administrator training, and well designed security procedures for data protection and proper patching controls, the reality remains that state-sponsored hackers from China, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware penetration, feel confident that Progent's team of experts has proven experience in ransomware virus defense, cleanup, and file disaster recovery.

To read or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Akron a portfolio of remote monitoring and security evaluation services designed to assist you to reduce the threat from ransomware. These services utilize modern AI technology to uncover new variants of crypto-ransomware that are able to get past legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to achieve leading-edge IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your network scales smoothly without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Basic packages include remote monitoring and management, security, automatic monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management techniques to keep your network running at peak levels by checking the health of critical assets that drive your information system. When ProSight LAN Watch detects an issue, an alarm is transmitted automatically to your specified IT staff and your assigned Progent consultant so that any potential issues can be addressed before they can disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven platform for monitoring and managing your network, server, and desktop devices by providing tools for performing common time-consuming jobs. These can include health monitoring, update management, automated repairs, endpoint setup, backup and restore, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your designated IT personnel and your Progent technical consultant so emerging issues can be taken care of before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for smaller organizations to map, track, optimize and troubleshoot their networking hardware such as routers, firewalls, and access points as well as servers, printers, client computers and other networked devices. Using state-of-the-art RMM technology, WAN Watch makes sure that infrastructure topology diagrams are always current, captures and manages the configuration of almost all devices on your network, monitors performance, and generates alerts when problems are discovered. By automating complex management and troubleshooting activities, ProSight WAN Watch can cut hours off ordinary chores such as making network diagrams, reconfiguring your network, finding appliances that need critical software patches, or isolating performance issues. Find out more details about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of in-depth reporting utilities designed to integrate with the industry's leading ticketing and remote network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues such as inconsistent support follow-through or machines with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore technology providers to create ProSight Data Protection Services (DPS), a portfolio of subscription-based offerings that deliver backup-as-a-service. ProSight DPS services automate and track your data backup processes and enable transparent backup and rapid recovery of important files/folders, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you recover from data loss resulting from hardware failures, natural disasters, fire, cyber attacks such as ransomware, user error, malicious insiders, or application bugs. Managed backup services available in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these fully managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of top data security companies to provide centralized control and comprehensive protection for all your inbound and outbound email. The hybrid structure of Email Guard managed service combines a Cloud Protection Layer with a local gateway appliance to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. The cloud filter acts as a first line of defense and blocks the vast majority of threats from reaching your network firewall. This reduces your exposure to inbound threats and saves system bandwidth and storage space. Email Guard's on-premises gateway appliance provides a deeper level of analysis for incoming email. For outgoing email, the local security gateway provides AV and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also assist Microsoft Exchange Server to track and safeguard internal email traffic that stays inside your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to protect against compromised passwords by using two-factor authentication (2FA). Duo enables one-tap identity verification with Apple iOS, Google Android, and other personal devices. Using Duo 2FA, whenever you log into a protected online account and enter your password you are requested to confirm who you are on a unit that only you have and that uses a different ("out-of-band") network channel. A broad range of out-of-band devices can be used as this second form of ID validation including a smartphone or wearable, a hardware/software token, a landline telephone, etc. You may designate multiple validation devices. For more information about ProSight Duo two-factor identity authentication services, refer to Cisco Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Service Center: Help Desk Managed Services
  Progent's Support Center managed services enable your information technology group to outsource Call Center services to Progent or divide activity for Service Desk support seamlessly between your in-house network support team and Progent's extensive pool of certified IT service engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a transparent supplement to your core network support resources. User access to the Help Desk, delivery of support services, issue escalation, trouble ticket generation and tracking, efficiency metrics, and maintenance of the support database are consistent regardless of whether incidents are resolved by your internal support resources, by Progent, or by a combination. Learn more about Progent's outsourced/co-managed Service Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes cutting edge behavior-based machine learning technology to defend endpoint devices and servers and VMs against new malware assaults like ransomware and file-less exploits, which easily get by traditional signature-matching anti-virus products. Progent ASM services safeguard local and cloud resources and provides a single platform to automate the entire malware attack progression including protection, infiltration detection, containment, remediation, and post-attack forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, find and protect data related to your network infrastructure, procedures, business apps, and services. You can instantly find passwords or serial numbers and be warned about upcoming expirations of SSLs or warranties. By cleaning up and organizing your IT documentation, you can eliminate up to 50% of time spent looking for vital information about your network. ProSight IT Asset Management includes a centralized location for storing and sharing all documents required for managing your network infrastructure like recommended procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're making enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the knowledge you need as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of any size a flexible and cost-effective alternative for evaluating, testing, scheduling, applying, and tracking updates to your ever-evolving information network. Besides maximizing the security and reliability of your computer environment, Progent's software/firmware update management services free up time for your IT team to focus on more strategic initiatives and activities that derive maximum business value from your network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host configured and managed by Progent's IT support experts. Under Progent's ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS platforms, and the applications. Because the system is virtualized, it can be ported immediately to an alternate hardware environment without a time-consuming and difficult configuration process. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior-based analysis technology to defend physical and virtual endpoint devices against new malware attacks such as ransomware and email phishing, which routinely escape legacy signature-matching anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and provides a unified platform to manage the complete malware attack progression including filtering, identification, mitigation, remediation, and forensics. Top capabilities include one-click rollback using Windows VSS and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver affordable multi-layer protection for physical servers and virtual machines, workstations, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and reacting to security threats from all vectors. ProSight ESP provides firewall protection, penetration alerts, device control, and web filtering via cutting-edge tools packaged within one agent accessible from a single control. Progent's security and virtualization consultants can help you to plan and configure a ProSight ESP environment that addresses your company's unique needs and that helps you achieve and demonstrate compliance with government and industry information security regulations. Progent will assist you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alarms that call for urgent action. Progent can also help you to install and verify a backup and restore system like ProSight Data Protection Services so you can get back in business rapidly from a destructive cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.