24x7x365 Bristol Emergency CryptoLocker
Infection Identification and Removal Consultants

Crypto-Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become a too-frequent cyberplague that represents an existential threat for organizations poorly prepared for an attack. Different iterations of ransomware like the Dharma, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for years and still inflict havoc. Recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, plus daily as yet unnamed viruses, not only do encryption of online information but also infect many available system protection mechanisms. Files replicated to cloud environments can also be held hostage. In a vulnerable environment, this can render automated restoration useless and effectively sets the entire system back to zero.

Retrieving services and data following a crypto-ransomware outage becomes a race against time as the victim struggles to contain, cleanup the crypto-ransomware, and restore business-critical operations. Because crypto-ransomware takes time to move laterally, penetrations are frequently launched during nights and weekends, when attacks may take more time to identify. This multiplies the difficulty of quickly mobilizing and organizing an experienced response team.

Progent makes available a variety of help services for securing organizations from ransomware events. These include team member training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to deployment of the latest generation security solutions with AI technology from SentinelOne to discover and quarantine zero-day threats quickly. Progent also can provide the assistance of experienced ransomware recovery engineers with the skills and perseverance to rebuild a breached system as urgently as possible.

Progent's Crypto-Ransomware Restoration Support Services
Following a crypto-ransomware event, paying the ransom in cryptocurrency does not guarantee that distant criminals will provide the keys to unencrypt any of your files. Kaspersky estimated that 17% of crypto-ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The fallback is to piece back together the vital components of your Information Technology environment. Without access to full system backups, this calls for a wide range of skill sets, well-coordinated team management, and the willingness to work continuously until the job is completed.

For two decades, Progent has offered expert Information Technology services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained top certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-renowned certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial systems and ERP applications. This breadth of experience affords Progent the ability to quickly ascertain necessary systems and consolidate the remaining parts of your IT system following a ransomware penetration and rebuild them into a functioning system.

Progent's ransomware group utilizes state-of-the-art project management tools to orchestrate the sophisticated recovery process. Progent appreciates the importance of acting swiftly and in concert with a customer's management and IT resources to assign priority to tasks and to put critical services back on line as fast as possible.

Client Case Study: A Successful Ransomware Penetration Recovery
A small business hired Progent after their network was taken over by the Ryuk ransomware. Ryuk is believed to have been developed by North Korean state hackers, possibly adopting algorithms leaked from the U.S. National Security Agency. Ryuk goes after specific organizations with little ability to sustain disruption and is one of the most profitable incarnations of ransomware viruses. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer based in the Chicago metro area and has around 500 employees. The Ryuk attack had frozen all essential operations and manufacturing processes. Most of the client's system backups had been directly accessible at the time of the attack and were encrypted. The client considered paying the ransom demand (more than $200,000) and praying for the best, but in the end utilized Progent.

Progent worked together with the client to quickly assess and assign priority to the essential applications that had to be restored in order to restart business functions:

• Active Directory
• Email
• Accounting/MRP

Within 2 days, Progent was able to recover Windows Active Directory to its pre-intrusion state. Progent then completed rebuilding and storage recovery of critical applications. All Microsoft Exchange Server schema and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to assemble local OST files (Outlook Offline Folder Files) on user PCs and laptops in order to recover mail messages. A recent off-line backup of the customer's accounting software made it possible to recover these essential programs back available to users. Although a large amount of work needed to be completed to recover completely from the Ryuk event, the most important systems were returned to operations rapidly:

During the following few weeks critical milestones in the recovery project were completed through close collaboration between Progent team members and the customer:

• Self-hosted web applications were brought back up without losing any data.
• The MailStore Server exceeding 4 million historical messages was brought online and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control capabilities were completely functional.
• A new Palo Alto Networks 850 firewall was deployed.
• Nearly all of the user PCs were fully operational.

Conclusion
A probable business-killing catastrophe was evaded due to dedicated experts, a broad spectrum of technical expertise, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware virus penetration detailed here would have been shut down with modern security systems and security best practices, staff training, and well thought out incident response procedures for data backup and keeping systems up to date with security patches, the fact remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware virus, remember that Progent's team of professionals has proven experience in ransomware virus defense, remediation, and data restoration.

To review or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Bristol a range of remote monitoring and security evaluation services to assist you to minimize your vulnerability to ransomware. These services include next-generation machine learning technology to detect new strains of ransomware that can evade legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent handles the necessary monitoring and management for you, so your network expands readily without holding you back. For a low and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Entry-level packages include remote monitoring and management, cybersecurity, automatic monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-in-class solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management (RMM) techniques to keep your network operating efficiently by checking the state of critical assets that power your business network. When ProSight LAN Watch uncovers an issue, an alarm is sent automatically to your specified IT management personnel and your Progent consultant so that any looming problems can be addressed before they have a chance to impact your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for monitoring and managing your client-server infrastructure by offering tools for performing common tedious tasks. These can include health monitoring, update management, automated repairs, endpoint deployment, backup and recovery, A/V protection, secure remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alarm to your specified IT staff and your Progent consultant so emerging issues can be fixed before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized businesses to map out, monitor, reconfigure and debug their connectivity hardware such as routers and switches, firewalls, and load balancers as well as servers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology maps are always updated, copies and displays the configuration of virtually all devices on your network, tracks performance, and sends notices when issues are detected. By automating complex network management processes, WAN Watch can knock hours off ordinary tasks like making network diagrams, reconfiguring your network, finding appliances that require important software patches, or isolating performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time management reporting tools created to work with the industry's leading ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as inconsistent support follow-through or endpoints with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup/restore software companies to create ProSight Data Protection Services (DPS), a selection of subscription-based offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup processes and enable transparent backup and rapid restoration of important files/folders, apps, images, plus virtual machines. ProSight DPS lets you avoid data loss resulting from hardware breakdown, natural calamities, fire, malware such as ransomware, human mistakes, malicious insiders, or software bugs. Managed services in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of top data security vendors to deliver centralized control and comprehensive security for your email traffic. The hybrid architecture of Progent's Email Guard managed service combines cloud-based filtering with a local gateway device to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The cloud filter serves as a first line of defense and blocks most unwanted email from making it to your network firewall. This reduces your vulnerability to inbound attacks and saves network bandwidth and storage space. Email Guard's onsite security gateway device provides a further layer of analysis for incoming email. For outgoing email, the local security gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Exchange Server to monitor and protect internal email traffic that originates and ends inside your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA service plans incorporate Cisco's Duo cloud technology to defend against password theft through the use of two-factor authentication. Duo enables single-tap identity confirmation with iOS, Android, and other personal devices. With 2FA, whenever you log into a secured application and give your password you are asked to confirm who you are on a unit that only you have and that uses a separate network channel. A broad selection of out-of-band devices can be utilized for this second means of authentication including an iPhone or Android or watch, a hardware token, a landline phone, etc. You can designate several verification devices. To learn more about Duo two-factor identity authentication services, go to Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Call Center: Help Desk Managed Services
  Progent's Support Center managed services permit your IT team to outsource Support Desk services to Progent or divide responsibilities for Help Desk services transparently between your internal support resources and Progent's extensive roster of IT support technicians, engineers and subject matter experts. Progent's Co-managed Service Desk provides a transparent extension of your internal network support group. Client interaction with the Help Desk, delivery of support services, escalation, ticket generation and updates, efficiency metrics, and maintenance of the support database are consistent whether incidents are resolved by your core network support staff, by Progent, or by a combination. Read more about Progent's outsourced/shared Service Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that incorporates next generation behavior-based machine learning technology to guard endpoints and servers and VMs against new malware assaults such as ransomware and email phishing, which routinely evade traditional signature-matching AV products. Progent ASM services protect on-premises and cloud-based resources and offers a unified platform to manage the entire threat progression including protection, identification, containment, remediation, and forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered attacks. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, update, retrieve and safeguard data about your IT infrastructure, procedures, applications, and services. You can instantly locate passwords or serial numbers and be alerted about impending expirations of SSLs or warranties. By cleaning up and organizing your network documentation, you can save as much as 50% of time thrown away searching for critical information about your network. ProSight IT Asset Management includes a centralized repository for holding and sharing all documents required for managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and associating IT data. Whether you're making improvements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you require when you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a versatile and cost-effective solution for assessing, validating, scheduling, applying, and tracking updates to your dynamic information network. Besides optimizing the security and functionality of your IT environment, Progent's patch management services permit your in-house IT staff to focus on more strategic initiatives and tasks that derive maximum business value from your information network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host configured and managed by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the client retains ownership of the data, the operating system software, and the applications. Since the system is virtualized, it can be ported immediately to an alternate hardware solution without a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's next generation behavior-based analysis technology to guard physical and virtual endpoint devices against modern malware attacks like ransomware and email phishing, which routinely get by traditional signature-based anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a single platform to automate the complete malware attack lifecycle including protection, identification, containment, remediation, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection services deliver affordable multi-layer protection for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP provides two-way firewall protection, penetration alerts, endpoint control, and web filtering via leading-edge tools packaged within a single agent managed from a unified console. Progent's data protection and virtualization consultants can assist you to plan and configure a ProSight ESP deployment that addresses your organization's specific needs and that helps you prove compliance with legal and industry data protection standards. Progent will assist you specify and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that require urgent attention. Progent's consultants can also assist you to set up and verify a backup and restore solution like ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange email filtering.