24x7 Atlanta Emergency Crypto-Ransomware
Virus Detection and Remediation Consultants

Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become a too-frequent cyberplague that poses an extinction-level danger for businesses of all sizes vulnerable to an attack. Multiple generations of crypto-ransomware such as Reveton, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for many years and continue to inflict havoc. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, plus more as yet unnamed malware, not only do encryption of on-line critical data but also infiltrate most available system protection mechanisms. Data synchronized to off-site disaster recovery sites can also be ransomed. In a poorly designed data protection solution, it can render automatic restore operations impossible and effectively knocks the datacenter back to zero.

Getting back services and data following a ransomware intrusion becomes a sprint against time as the targeted business fights to stop the spread, eradicate the crypto-ransomware, and restore enterprise-critical activity. Since ransomware takes time to replicate, assaults are frequently launched on weekends and holidays, when attacks tend to take longer to discover. This compounds the difficulty of promptly marshalling and coordinating a capable mitigation team.

Progent has a range of solutions for securing organizations from ransomware penetrations. These include user training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of modern security solutions with artificial intelligence technology from SentinelOne to discover and disable new threats rapidly. Progent also offers the assistance of seasoned ransomware recovery consultants with the track record and perseverance to reconstruct a breached network as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that cyber hackers will provide the needed codes to decrypt any or all of your information. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to re-install the essential components of your Information Technology environment. Absent access to essential information backups, this requires a wide complement of skills, professional project management, and the capability to work 24x7 until the job is done.

For two decades, Progent has made available certified expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned top industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in accounting and ERP application software. This breadth of experience provides Progent the capability to efficiently understand important systems and integrate the surviving pieces of your computer network environment following a ransomware event and rebuild them into a functioning network.

Progent's security group has powerful project management applications to orchestrate the sophisticated recovery process. Progent understands the importance of acting rapidly and in unison with a client's management and IT staff to assign priority to tasks and to put critical systems back on line as fast as humanly possible.

Client Case Study: A Successful Ransomware Penetration Response
A small business sought out Progent after their organization was crashed by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state hackers, suspected of using approaches exposed from the U.S. National Security Agency. Ryuk attacks specific businesses with little room for disruption and is among the most lucrative incarnations of ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing business located in the Chicago metro area and has around 500 workers. The Ryuk intrusion had shut down all company operations and manufacturing processes. Most of the client's data backups had been online at the time of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (exceeding $200K) and praying for the best, but in the end utilized Progent.

Progent worked together with the client to quickly assess and assign priority to the most important services that had to be restored in order to restart company functions:

• Windows Active Directory
• Microsoft Exchange Email
• Accounting and Manufacturing Software

Within two days, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then helped perform rebuilding and storage recovery on key applications. All Microsoft Exchange Server schema and configuration information were intact, which accelerated the restore of Exchange. Progent was able to locate intact OST files (Microsoft Outlook Off-Line Data Files) on user PCs and laptops in order to recover email data. A not too old off-line backup of the businesses accounting/ERP software made it possible to return these required services back on-line. Although major work still had to be done to recover completely from the Ryuk event, essential services were restored quickly:

Over the next month key milestones in the restoration process were completed in tight collaboration between Progent engineers and the client:

• In-house web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million archived messages was spun up and available for users.
• CRM/Orders/Invoices/AP/AR/Inventory Control functions were 100 percent operational.
• A new Palo Alto 850 firewall was set up and programmed.
• Nearly all of the user workstations were operational.

Conclusion
A probable enterprise-killing disaster was evaded by dedicated experts, a wide spectrum of knowledge, and tight collaboration. Although in retrospect the crypto-ransomware attack described here would have been identified and disabled with modern cyber security technology and ISO/IEC 27001 best practices, team education, and well thought out incident response procedures for information protection and keeping systems up to date with security patches, the fact is that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of experts has extensive experience in ransomware virus blocking, mitigation, and information systems disaster recovery.

To review or download a PDF version of this case study, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Atlanta a range of remote monitoring and security assessment services designed to assist you to minimize the threat from ransomware. These services incorporate modern AI capability to detect new strains of ransomware that are able to get past legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent handles the daily monitoring and maintenance for you, so your system scales smoothly without holding you back. For a low and predictable monthly price, Progent's experienced IT group can be your complete technology safety net. Entry-level plans include remote monitoring and management, security, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to keep your network running at peak levels by tracking the health of vital assets that drive your information system. When ProSight LAN Watch detects a problem, an alert is transmitted automatically to your specified IT personnel and your assigned Progent consultant so all potential issues can be resolved before they have a chance to disrupt productivity. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for managing your network, server, and desktop devices by providing an environment for streamlining common time-consuming tasks. These include health monitoring, patch management, automated repairs, endpoint setup, backup and restore, A/V response, remote access, standard and custom scripts, asset inventory, endpoint status reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alert to your designated IT personnel and your Progent consultant so potential issues can be taken care of before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for small and mid-sized organizations to diagram, track, optimize and troubleshoot their connectivity appliances such as switches, firewalls, and access points as well as servers, endpoints and other devices. Using cutting-edge RMM technology, ProSight WAN Watch makes sure that infrastructure topology maps are always current, captures and displays the configuration information of almost all devices connected to your network, tracks performance, and generates alerts when problems are detected. By automating time-consuming management and troubleshooting processes, ProSight WAN Watch can knock hours off ordinary chores such as network mapping, expanding your network, locating devices that require critical updates, or identifying the cause of performance problems. Find out more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time and in-depth management reporting plug-ins created to work with the top ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues like inconsistent support follow-up or machines with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with advanced backup software providers to create ProSight Data Protection Services, a selection of subscription-based management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup processes and enable transparent backup and rapid recovery of important files, apps, system images, and virtual machines. ProSight DPS lets your business protect against data loss resulting from equipment breakdown, natural disasters, fire, cyber attacks such as ransomware, human mistakes, malicious employees, or application glitches. Managed backup services available in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading data security vendors to deliver centralized management and world-class protection for your inbound and outbound email. The powerful architecture of Email Guard managed service integrates a Cloud Protection Layer with an on-premises gateway device to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's Cloud Protection Layer serves as a first line of defense and blocks the vast majority of threats from reaching your security perimeter. This reduces your exposure to inbound threats and saves system bandwidth and storage space. Email Guard's onsite gateway device adds a deeper level of analysis for incoming email. For outbound email, the local security gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The local security gateway can also assist Exchange Server to track and safeguard internal email traffic that originates and ends inside your corporate firewall. For more details, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to defend against stolen passwords by using two-factor authentication. Duo supports single-tap identity confirmation on Apple iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you log into a secured application and enter your password you are asked to verify who you are via a device that only you possess and that is accessed using a separate network channel. A wide selection of devices can be used for this second means of authentication including an iPhone or Android or watch, a hardware token, a landline phone, etc. You can designate several validation devices. To find out more about Duo identity authentication services, visit Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Center: Help Desk Managed Services
  Progent's Call Desk services permit your IT staff to offload Call Center services to Progent or split activity for Help Desk services transparently between your internal network support group and Progent's nationwide roster of IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a seamless extension of your core support resources. User access to the Service Desk, provision of technical assistance, problem escalation, trouble ticket creation and updates, performance metrics, and maintenance of the service database are cohesive regardless of whether issues are resolved by your corporate support group, by Progent, or a mix of the two. Learn more about Progent's outsourced/shared Help Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection solution that utilizes next generation behavior analysis technology to defend endpoint devices as well as physical and virtual servers against new malware attacks like ransomware and email phishing, which easily escape traditional signature-based AV products. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and offers a unified platform to address the entire malware attack progression including protection, detection, mitigation, cleanup, and forensics. Key features include one-click rollback with Windows VSS and real-time network-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, retrieve and safeguard information about your network infrastructure, procedures, business apps, and services. You can quickly find passwords or IP addresses and be warned automatically about upcoming expirations of SSLs or domains. By updating and managing your IT infrastructure documentation, you can save up to half of time thrown away trying to find critical information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and sharing all documents related to managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and relating IT information. Whether you're making enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you need as soon as you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer organizations of any size a versatile and cost-effective solution for evaluating, validating, scheduling, implementing, and documenting updates to your dynamic information system. Besides maximizing the protection and reliability of your IT network, Progent's patch management services permit your in-house IT staff to concentrate on more strategic projects and activities that deliver maximum business value from your information network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual host configured and maintained by Progent's network support experts. Under the ProSight Virtual Hosting model, the customer retains ownership of the data, the OS platforms, and the applications. Since the system is virtualized, it can be ported immediately to a different hosting environment without a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior-based analysis technology to defend physical and virtual endpoint devices against modern malware assaults such as ransomware and file-less exploits, which easily evade traditional signature-matching anti-virus products. ProSight ASM protects on-premises and cloud resources and offers a unified platform to manage the entire malware attack progression including filtering, detection, containment, remediation, and forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection services deliver affordable multi-layer security for physical servers and VMs, workstations, mobile devices, and Exchange email. ProSight ESP uses contextual security and advanced machine learning for round-the-clock monitoring and reacting to security assaults from all vectors. ProSight ESP provides firewall protection, intrusion alarms, endpoint control, and web filtering through leading-edge technologies packaged within one agent accessible from a single control. Progent's data protection and virtualization consultants can assist your business to plan and configure a ProSight ESP environment that addresses your company's specific needs and that allows you achieve and demonstrate compliance with government and industry data protection standards. Progent will assist you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that call for immediate action. Progent can also assist your company to install and test a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.