Barueri-Alphaville 24-Hour Urgent Ransomware
Malware Assessment and Recovery Experts

Ransomware : Your Crippling IT Catastrophe
Ransomware has become a modern cyber pandemic that poses an extinction-level threat for businesses of all sizes vulnerable to an assault. Different versions of ransomware such as CryptoLocker, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been running rampant for many years and still cause damage. The latest versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, as well as additional as yet unnamed viruses, not only do encryption of on-line files but also infiltrate many accessible system protection mechanisms. Information synched to off-site disaster recovery sites can also be encrypted. In a poorly designed system, it can render automated recovery useless and basically knocks the network back to zero.

Getting back programs and information following a crypto-ransomware intrusion becomes a race against time as the targeted business fights to contain the damage, eradicate the virus, and restore mission-critical operations. Because ransomware requires time to spread, attacks are usually sprung during weekends and nights, when attacks typically take longer to recognize. This multiplies the difficulty of quickly marshalling and orchestrating an experienced response team.

Progent offers a range of solutions for protecting businesses from ransomware events. These include team member education to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of the latest generation security gateways with artificial intelligence technology from SentinelOne to identify and suppress new cyber threats rapidly. Progent also provides the services of expert ransomware recovery engineers with the track record and perseverance to reconstruct a breached system as urgently as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the codes to decipher all your files. Kaspersky determined that 17% of crypto-ransomware victims never recovered their data after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to re-install the vital parts of your Information Technology environment. Without the availability of full data backups, this calls for a wide range of skill sets, well-coordinated project management, and the willingness to work 24x7 until the task is finished.

For decades, Progent has provided expert IT services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned advanced certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial management and ERP application software. This breadth of experience affords Progent the capability to efficiently identify critical systems and integrate the surviving parts of your computer network system following a ransomware penetration and assemble them into an operational system.

Progent's ransomware group utilizes state-of-the-art project management applications to coordinate the complex recovery process. Progent appreciates the urgency of working rapidly and together with a client's management and IT staff to prioritize tasks and to get key applications back online as fast as humanly possible.

Case Study: A Successful Ransomware Virus Restoration
A small business contacted Progent after their company was brought down by Ryuk ransomware. Ryuk is believed to have been created by North Korean government sponsored criminal gangs, suspected of using technology leaked from America's NSA organization. Ryuk goes after specific businesses with little or no ability to sustain operational disruption and is among the most profitable versions of ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in the Chicago metro area with around 500 staff members. The Ryuk event had frozen all essential operations and manufacturing processes. Most of the client's backups had been directly accessible at the time of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but in the end brought in Progent.

Progent worked with the customer to quickly get our arms around and assign priority to the most important systems that needed to be addressed to make it possible to restart departmental functions:

• Windows Active Directory
• E-Mail
• Accounting/MRP

In less than 48 hours, Progent was able to rebuild Windows Active Directory to its pre-virus state. Progent then performed reinstallations and storage recovery of essential servers. All Exchange ties and attributes were usable, which greatly helped the restore of Exchange. Progent was able to collect non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on various PCs and laptops to recover email data. A recent off-line backup of the client's financials/MRP systems made it possible to recover these vital services back available to users. Although major work was left to recover fully from the Ryuk damage, critical services were restored quickly:

Over the following month critical milestones in the restoration project were made through tight cooperation between Progent team members and the customer:

• Self-hosted web applications were brought back up without losing any data.
• The MailStore Server containing more than 4 million archived messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control functions were fully recovered.
• A new Palo Alto 850 security appliance was brought online.
• Most of the desktops and laptops were fully operational.

Conclusion
A probable business extinction catastrophe was avoided with hard-working experts, a broad array of subject matter expertise, and close teamwork. Although in hindsight the ransomware virus penetration detailed here would have been stopped with up-to-date security systems and recognized best practices, user and IT administrator training, and well designed incident response procedures for information protection and proper patching controls, the reality remains that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's team of professionals has substantial experience in ransomware virus blocking, removal, and information systems recovery.

To read or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Barueri-Alphaville a portfolio of online monitoring and security assessment services to help you to reduce your vulnerability to ransomware. These services incorporate next-generation artificial intelligence technology to detect zero-day strains of ransomware that can get past legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent takes care of the daily monitoring and maintenance for you, so your system scales smoothly without holding you back. For a low and predictable monthly price, Progent's full-service IT group can be your complete technology safety net. Entry-level packages include RMM, security, automatic monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) technology to keep your IT system operating efficiently by checking the health of critical computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alarm is transmitted immediately to your specified IT staff and your assigned Progent consultant so any looming issues can be addressed before they have a chance to impact productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based solution for monitoring and managing your client-server infrastructure by offering an environment for performing common time-consuming jobs. These can include health checking, patch management, automated repairs, endpoint deployment, backup and restore, A/V defense, remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and debugging help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your designated IT management personnel and your assigned Progent consultant so potential problems can be fixed before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized organizations to map out, monitor, enhance and debug their networking hardware like switches, firewalls, and wireless controllers as well as servers, printers, client computers and other networked devices. Using cutting-edge RMM technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are always current, captures and manages the configuration of almost all devices on your network, monitors performance, and sends notices when problems are discovered. By automating complex management and troubleshooting processes, WAN Watch can knock hours off common chores such as network mapping, reconfiguring your network, locating devices that need critical updates, or isolating performance problems. Find out more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time and in-depth management reporting tools created to integrate with the leading ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like inconsistent support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with leading backup software companies to create ProSight Data Protection Services, a portfolio of subscription-based offerings that provide backup-as-a-service (BaaS). ProSight DPS products manage and monitor your data backup processes and allow non-disruptive backup and rapid restoration of critical files, apps, images, plus virtual machines. ProSight DPS helps you protect against data loss resulting from hardware failures, natural disasters, fire, malware such as ransomware, human error, ill-intentioned insiders, or software glitches. Managed services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can assist you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top data security companies to provide centralized control and world-class security for all your inbound and outbound email. The hybrid structure of Progent's Email Guard integrates cloud-based filtering with an on-premises gateway device to offer complete protection against spam, viruses, Dos Attacks, DHAs, and other email-based malware. The Cloud Protection Layer serves as a preliminary barricade and blocks most unwanted email from reaching your network firewall. This reduces your exposure to inbound attacks and conserves system bandwidth and storage. Email Guard's on-premises security gateway device adds a further layer of inspection for inbound email. For outgoing email, the onsite security gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also assist Exchange Server to monitor and safeguard internal email traffic that stays inside your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo technology to defend against password theft by using two-factor authentication. Duo supports single-tap identity confirmation on Apple iOS, Google Android, and other personal devices. With 2FA, when you log into a protected application and enter your password you are asked to verify your identity via a device that only you possess and that uses a separate network channel. A wide range of out-of-band devices can be used for this second means of authentication such as a smartphone or wearable, a hardware token, a landline phone, etc. You may designate several verification devices. For more information about Duo two-factor identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Desk: Support Desk Managed Services
  Progent's Call Center managed services allow your information technology team to offload Call Center services to Progent or split responsibilities for Service Desk support seamlessly between your internal network support team and Progent's extensive pool of IT support technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a transparent supplement to your in-house network support organization. End user access to the Help Desk, delivery of technical assistance, issue escalation, ticket generation and tracking, performance measurement, and maintenance of the service database are cohesive whether incidents are taken care of by your core support organization, by Progent's team, or by a combination. Read more about Progent's outsourced/co-managed Call Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior machine learning technology to guard endpoints and physical and virtual servers against new malware assaults such as ransomware and email phishing, which routinely escape legacy signature-matching AV products. Progent ASM services safeguard local and cloud-based resources and provides a single platform to automate the entire threat lifecycle including filtering, detection, mitigation, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, find and protect information related to your network infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSL certificates or domains. By updating and organizing your network documentation, you can eliminate up to half of time spent trying to find vital information about your IT network. ProSight IT Asset Management features a common location for holding and collaborating on all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're planning enhancements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the information you need the instant you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer organizations of any size a flexible and cost-effective solution for assessing, validating, scheduling, applying, and tracking updates to your dynamic information system. Besides maximizing the protection and reliability of your computer environment, Progent's software/firmware update management services allow your in-house IT team to concentrate on line-of-business projects and tasks that derive maximum business value from your information network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a protected fault tolerant data center on a high-performance virtual machine host configured and maintained by Progent's network support professionals. Under the ProSight Virtual Hosting model, the customer owns the data, the operating system software, and the apps. Since the environment is virtualized, it can be ported easily to an alternate hosting environment without requiring a time-consuming and difficult configuration process. With ProSight Virtual Hosting, you are not tied a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoint devices against new malware attacks like ransomware and email phishing, which easily get by traditional signature-based anti-virus tools. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a unified platform to manage the complete malware attack progression including filtering, infiltration detection, mitigation, remediation, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer economical in-depth protection for physical and virtual servers, workstations, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and responding to cyber assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, device control, and web filtering via leading-edge tools packaged within a single agent managed from a single control. Progent's data protection and virtualization experts can assist your business to design and implement a ProSight ESP deployment that addresses your company's unique requirements and that allows you achieve and demonstrate compliance with legal and industry data security standards. Progent will help you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that call for immediate attention. Progent's consultants can also help your company to install and test a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange email filtering.