24/7 Albany Emergency Ransomware
Infection Damage Assessment and Remediation Services

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that represents an extinction-level danger for businesses of all sizes unprepared for an attack. Versions of ransomware such as Reveton, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for years and continue to cause havoc. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, along with additional unnamed malware, not only do encryption of on-line data files but also infect most available system backup. Data synched to off-site disaster recovery sites can also be ransomed. In a poorly architected system, it can render automated recovery impossible and effectively knocks the datacenter back to square one.

Getting back online programs and information following a ransomware attack becomes a race against time as the victim tries its best to stop the spread, cleanup the ransomware, and restore mission-critical activity. Since crypto-ransomware needs time to move laterally, penetrations are often sprung on weekends and holidays, when successful attacks in many cases take more time to detect. This compounds the difficulty of promptly assembling and coordinating a qualified mitigation team.

Progent makes available a variety of support services for securing businesses from ransomware attacks. These include team training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus installation of the latest generation security appliances with artificial intelligence capabilities from SentinelOne to discover and extinguish new cyber threats quickly. Progent in addition offers the assistance of expert crypto-ransomware recovery professionals with the talent and commitment to rebuild a breached network as quickly as possible.

Progent's Ransomware Restoration Help
Soon after a crypto-ransomware attack, even paying the ransom in cryptocurrency does not guarantee that criminal gangs will respond with the keys to decrypt any of your information. Kaspersky Labs determined that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The other path is to piece back together the key components of your Information Technology environment. Without access to complete information backups, this calls for a wide complement of skills, well-coordinated project management, and the ability to work non-stop until the recovery project is finished.

For decades, Progent has made available certified expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned top industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-recognized industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in accounting and ERP application software. This breadth of expertise affords Progent the skills to efficiently determine necessary systems and consolidate the remaining components of your Information Technology system after a ransomware penetration and configure them into a functioning network.

Progent's ransomware team of experts uses state-of-the-art project management systems to orchestrate the complex recovery process. Progent understands the importance of acting swiftly and together with a customer's management and Information Technology staff to prioritize tasks and to get essential systems back online as fast as humanly possible.

Customer Story: A Successful Ransomware Penetration Restoration
A client sought out Progent after their company was attacked by Ryuk ransomware virus. Ryuk is generally considered to have been launched by Northern Korean state criminal gangs, suspected of adopting strategies exposed from America's National Security Agency. Ryuk goes after specific companies with little room for operational disruption and is one of the most lucrative examples of ransomware malware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in the Chicago metro area with around 500 employees. The Ryuk penetration had brought down all company operations and manufacturing capabilities. The majority of the client's system backups had been on-line at the time of the attack and were encrypted. The client was pursuing financing for paying the ransom demand (exceeding $200,000) and hoping for good luck, but ultimately reached out to Progent.

Progent worked together with the customer to rapidly understand and assign priority to the mission critical systems that needed to be recovered to make it possible to restart departmental operations:

• Active Directory
• Exchange Server
• Accounting/MRP

Within 2 days, Progent was able to recover Active Directory services to its pre-attack state. Progent then accomplished reinstallations and hard drive recovery of critical systems. All Microsoft Exchange Server ties and attributes were usable, which greatly helped the restore of Exchange. Progent was able to find non-encrypted OST files (Outlook Offline Folder Files) on user PCs in order to recover mail information. A not too old off-line backup of the businesses financials/ERP software made them able to return these essential services back servicing users. Although a lot of work needed to be completed to recover totally from the Ryuk attack, essential services were returned to operations quickly:

Throughout the next couple of weeks critical milestones in the restoration process were accomplished in close cooperation between Progent consultants and the customer:

• Internal web sites were restored without losing any data.
• The MailStore Microsoft Exchange Server containing more than 4 million historical emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory Control modules were 100% recovered.
• A new Palo Alto Networks 850 firewall was installed.
• Nearly all of the desktops and laptops were back into operation.

Conclusion
A probable business extinction disaster was averted due to results-oriented experts, a broad array of technical expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware penetration described here should have been blocked with current cyber security solutions and NIST Cybersecurity Framework best practices, user training, and appropriate incident response procedures for data protection and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware penetration, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, removal, and file recovery.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Albany a portfolio of online monitoring and security assessment services to help you to minimize the threat from ransomware. These services include next-generation machine learning technology to uncover new strains of ransomware that can get past traditional signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your network expands easily without holding you back. For a low and predictable monthly subscription, Progent's experienced IT group can be your dependable technology safety net. Entry-level plans include remote monitoring and management, security, automatic monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to advanced solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management techniques to keep your network operating at peak levels by checking the state of critical assets that drive your business network. When ProSight LAN Watch uncovers an issue, an alert is transmitted immediately to your specified IT personnel and your assigned Progent consultant so all potential issues can be resolved before they can impact your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for monitoring and managing your client-server infrastructure by providing tools for streamlining common tedious jobs. These include health monitoring, update management, automated remediation, endpoint deployment, backup and recovery, anti-virus response, secure remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alert to your specified IT personnel and your Progent technical consultant so potential issues can be fixed before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to map, monitor, reconfigure and debug their networking hardware like routers and switches, firewalls, and access points plus servers, endpoints and other networked devices. Using state-of-the-art RMM technology, WAN Watch ensures that network maps are kept current, captures and displays the configuration information of virtually all devices on your network, tracks performance, and generates notices when potential issues are discovered. By automating complex management and troubleshooting processes, ProSight WAN Watch can knock hours off common tasks such as network mapping, expanding your network, locating devices that require critical updates, or isolating performance bottlenecks. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time management reporting tools created to integrate with the industry's top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues like spotty support follow-up or endpoints with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with leading backup/restore technology companies to produce ProSight Data Protection Services, a family of subscription-based management offerings that deliver backup-as-a-service. ProSight DPS services automate and monitor your data backup operations and allow non-disruptive backup and rapid restoration of important files/folders, apps, system images, plus virtual machines. ProSight DPS lets your business protect against data loss caused by hardware breakdown, natural disasters, fire, malware like ransomware, user mistakes, ill-intentioned employees, or software glitches. Managed services in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Hybrid Backup. Your Progent expert can help you to identify which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top data security companies to deliver web-based control and world-class security for all your inbound and outbound email. The powerful structure of Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway appliance to provide complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's cloud filter serves as a first line of defense and blocks the vast majority of unwanted email from making it to your security perimeter. This reduces your vulnerability to inbound threats and saves system bandwidth and storage space. Email Guard's onsite gateway device provides a further level of analysis for inbound email. For outgoing email, the local security gateway provides anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also assist Microsoft Exchange Server to monitor and protect internal email that originates and ends inside your security perimeter. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA managed services utilize Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication (2FA). Duo enables one-tap identity confirmation on iOS, Google Android, and other personal devices. With 2FA, whenever you log into a secured application and give your password you are asked to confirm your identity via a unit that only you have and that is accessed using a separate network channel. A wide range of devices can be utilized as this added form of authentication such as an iPhone or Android or wearable, a hardware token, a landline phone, etc. You may register multiple validation devices. For more information about ProSight Duo two-factor identity authentication services, go to Duo MFA two-factor authentication services.

• Outsourced/Co-managed Service Desk: Help Desk Managed Services
  Progent's Call Desk managed services enable your information technology team to offload Help Desk services to Progent or split responsibilities for Help Desk services transparently between your internal support group and Progent's extensive pool of IT service engineers and subject matter experts. Progent's Shared Service Desk offers a seamless supplement to your internal network support resources. Client access to the Help Desk, delivery of support, issue escalation, ticket generation and updates, performance measurement, and management of the service database are cohesive whether incidents are resolved by your core support resources, by Progent's team, or a mix of the two. Learn more about Progent's outsourced/co-managed Help Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates next generation behavior machine learning technology to defend endpoints and servers and VMs against modern malware assaults such as ransomware and email phishing, which routinely get by legacy signature-matching AV products. Progent ASM services safeguard on-premises and cloud-based resources and offers a single platform to address the entire malware attack lifecycle including filtering, infiltration detection, mitigation, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, find and protect information about your network infrastructure, processes, applications, and services. You can instantly find passwords or serial numbers and be warned about impending expirations of SSLs or domains. By cleaning up and organizing your IT infrastructure documentation, you can eliminate up to 50% of time thrown away looking for vital information about your network. ProSight IT Asset Management features a common location for storing and sharing all documents required for managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and relating IT information. Whether you're making enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you need the instant you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer businesses of all sizes a versatile and affordable solution for assessing, validating, scheduling, implementing, and documenting updates to your dynamic information network. In addition to maximizing the security and reliability of your IT environment, Progent's patch management services permit your in-house IT team to concentrate on more strategic initiatives and tasks that derive the highest business value from your information network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a secure fault tolerant data center on a high-performance virtual host set up and managed by Progent's network support professionals. Under the ProSight Virtual Hosting model, the client retains ownership of the data, the operating system platforms, and the apps. Since the environment is virtualized, it can be moved easily to an alternate hardware environment without a lengthy and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoints against new malware attacks such as ransomware and email phishing, which easily get by legacy signature-matching AV products. ProSight ASM protects local and cloud resources and provides a unified platform to manage the complete threat lifecycle including protection, infiltration detection, mitigation, remediation, and forensics. Top capabilities include single-click rollback with Windows VSS and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection managed services offer economical in-depth security for physical servers and VMs, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced heuristics for round-the-clock monitoring and reacting to cyber threats from all vectors. ProSight ESP delivers firewall protection, penetration alerts, device management, and web filtering via cutting-edge technologies incorporated within one agent accessible from a unified control. Progent's security and virtualization experts can assist your business to design and implement a ProSight ESP environment that meets your organization's unique needs and that helps you achieve and demonstrate compliance with legal and industry information security standards. Progent will help you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that require immediate action. Progent can also assist you to set up and test a backup and restore system like ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.