24-Hour Cambridge Immediate Crypto
Computer Malware Detection and Recovery Services

Crypto-Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware has become an escalating cyberplague that represents an enterprise-level threat for organizations unprepared for an attack. Different iterations of ransomware like the Reveton, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for many years and continue to inflict havoc. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, as well as daily unnamed malware, not only encrypt online files but also infect any accessible system restores and backups. Data synchronized to cloud environments can also be held hostage. In a vulnerable system, this can render automated restoration impossible and effectively knocks the datacenter back to square one.

Retrieving services and information following a ransomware outage becomes a sprint against time as the targeted business fights to stop lateral movement, remove the ransomware, and restore mission-critical activity. Since crypto-ransomware takes time to move laterally, attacks are usually launched during nights and weekends, when successful attacks typically take longer to uncover. This multiplies the difficulty of rapidly mobilizing and organizing a qualified mitigation team.

Progent offers a range of support services for protecting enterprises from ransomware attacks. Among these are team member education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of modern security appliances with artificial intelligence capabilities from SentinelOne to discover and disable new threats quickly. Progent in addition can provide the assistance of seasoned ransomware recovery consultants with the track record and perseverance to reconstruct a breached network as quickly as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware event, even paying the ransom in cryptocurrency does not ensure that merciless criminals will return the keys to decrypt any or all of your data. Kaspersky Labs ascertained that seventeen percent of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to setup from scratch the essential parts of your Information Technology environment. Absent the availability of essential data backups, this requires a wide complement of skill sets, top notch team management, and the willingness to work 24x7 until the recovery project is completed.

For decades, Progent has provided expert IT services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of expertise gives Progent the ability to efficiently determine important systems and integrate the remaining components of your network environment after a ransomware event and rebuild them into a functioning network.

Progent's security team utilizes best of breed project management systems to coordinate the sophisticated recovery process. Progent knows the urgency of working rapidly and in unison with a client's management and Information Technology staff to prioritize tasks and to put essential systems back on line as fast as possible.

Client Case Study: A Successful Ransomware Intrusion Restoration
A customer hired Progent after their network system was brought down by the Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state cybercriminals, suspected of adopting strategies leaked from America's NSA organization. Ryuk goes after specific businesses with limited tolerance for operational disruption and is one of the most profitable examples of ransomware viruses. Major organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturer based in Chicago with about 500 workers. The Ryuk event had brought down all company operations and manufacturing capabilities. Most of the client's information backups had been directly accessible at the start of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (exceeding $200K) and praying for the best, but in the end engaged Progent.

Progent worked hand in hand the customer to quickly get our arms around and prioritize the critical areas that needed to be addressed in order to resume business operations:

• Windows Active Directory
• Exchange Server
• Financials/MRP

Within two days, Progent was able to recover Active Directory services to its pre-virus state. Progent then helped perform reinstallations and storage recovery of the most important servers. All Exchange schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to collect intact OST data files (Outlook Email Offline Folder Files) on user workstations in order to recover mail messages. A not too old offline backup of the client's financials/ERP systems made it possible to recover these required programs back on-line. Although a large amount of work remained to recover totally from the Ryuk virus, essential systems were returned to operations rapidly:

During the next month critical milestones in the restoration process were made in tight cooperation between Progent consultants and the customer:

• Internal web sites were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server exceeding four million historical emails was restored to operations and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control functions were fully operational.
• A new Palo Alto 850 firewall was installed and configured.
• Ninety percent of the desktop computers were back into operation.

Conclusion
A likely business-ending disaster was evaded through the efforts of results-oriented experts, a wide spectrum of subject matter expertise, and tight teamwork. Although in hindsight the ransomware incident described here should have been stopped with advanced cyber security technology and best practices, user and IT administrator training, and well thought out incident response procedures for backup and proper patching controls, the reality is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware virus, feel confident that Progent's roster of experts has extensive experience in ransomware virus defense, remediation, and file restoration.

To read or download a PDF version of this case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Cambridge a variety of remote monitoring and security evaluation services designed to assist you to reduce the threat from ransomware. These services utilize next-generation machine learning technology to uncover zero-day variants of crypto-ransomware that are able to escape detection by traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent takes care of the necessary monitoring and management for you, so your network expands smoothly without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Entry-level plans include remote monitoring and management (RMM), cybersecurity, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) technology to help keep your network operating efficiently by checking the state of critical computers that power your business network. When ProSight LAN Watch uncovers an issue, an alarm is sent automatically to your designated IT personnel and your Progent consultant so any potential problems can be resolved before they have a chance to disrupt productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your network, server, and desktop devices by offering tools for streamlining common time-consuming tasks. These include health monitoring, patch management, automated repairs, endpoint setup, backup and recovery, anti-virus response, remote access, standard and custom scripts, asset inventory, endpoint status reporting, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it transmits an alarm to your designated IT staff and your assigned Progent consultant so that emerging problems can be fixed before they interfere with productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for smaller businesses to diagram, track, optimize and troubleshoot their networking hardware such as routers, firewalls, and wireless controllers plus servers, endpoints and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology diagrams are always current, copies and displays the configuration of almost all devices connected to your network, monitors performance, and sends notices when problems are detected. By automating time-consuming network management activities, ProSight WAN Watch can knock hours off common chores such as network mapping, expanding your network, finding appliances that require critical updates, or isolating performance problems. Find out more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of in-depth reporting plug-ins created to work with the industry's leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues such as inconsistent support follow-up or endpoints with missing patches. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore technology companies to create ProSight Data Protection Services, a selection of management outsourcing plans that deliver backup-as-a-service. ProSight DPS products automate and track your data backup processes and enable transparent backup and fast restoration of important files, applications, system images, plus VMs. ProSight DPS helps you protect against data loss caused by equipment failures, natural calamities, fire, cyber attacks like ransomware, user mistakes, ill-intentioned insiders, or application bugs. Managed services in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to determine which of these managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of leading data security companies to provide web-based management and comprehensive protection for all your inbound and outbound email. The powerful architecture of Progent's Email Guard integrates cloud-based filtering with an on-premises security gateway appliance to offer advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. Email Guard's cloud filter serves as a first line of defense and blocks most threats from reaching your network firewall. This reduces your exposure to inbound attacks and conserves network bandwidth and storage space. Email Guard's onsite security gateway appliance adds a deeper level of analysis for incoming email. For outgoing email, the local security gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The onsite gateway can also help Exchange Server to monitor and protect internal email traffic that stays inside your corporate firewall. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA managed services utilize Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication. Duo supports one-tap identity verification with Apple iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you log into a secured online account and enter your password you are requested to verify your identity on a device that only you possess and that is accessed using a separate network channel. A broad selection of devices can be used as this added form of authentication such as a smartphone or wearable, a hardware token, a landline telephone, etc. You can register several verification devices. For details about Duo identity validation services, refer to Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Center: Call Center Managed Services
  Progent's Help Center services allow your information technology staff to offload Support Desk services to Progent or split responsibilities for Help Desk services transparently between your internal support resources and Progent's extensive pool of IT service technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a smooth supplement to your in-house IT support resources. End user access to the Help Desk, provision of support, problem escalation, ticket generation and tracking, efficiency measurement, and maintenance of the service database are cohesive whether issues are taken care of by your in-house network support staff, by Progent, or both. Read more about Progent's outsourced/shared Call Center services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior machine learning tools to defend endpoint devices as well as physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which easily evade traditional signature-based AV products. Progent Active Security Monitoring services safeguard local and cloud-based resources and provides a single platform to address the entire threat lifecycle including filtering, detection, mitigation, remediation, and post-attack forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and protect information about your network infrastructure, processes, business apps, and services. You can quickly find passwords or IP addresses and be alerted about impending expirations of SSLs or warranties. By cleaning up and managing your IT documentation, you can save as much as 50% of time thrown away searching for vital information about your IT network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents required for managing your network infrastructure such as recommended procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're making enhancements, performing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the data you require the instant you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for patch management offer businesses of all sizes a versatile and affordable alternative for evaluating, testing, scheduling, applying, and documenting updates to your ever-evolving IT network. Besides optimizing the security and reliability of your IT environment, Progent's patch management services permit your in-house IT staff to focus on more strategic initiatives and activities that derive maximum business value from your information network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a secure fault tolerant data center on a high-performance virtual host set up and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the OS platforms, and the apps. Since the system is virtualized, it can be moved easily to an alternate hosting environment without requiring a lengthy and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not locked into one hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's next generation behavior analysis tools to guard physical and virtual endpoints against modern malware attacks such as ransomware and email phishing, which routinely escape traditional signature-based AV products. ProSight ASM protects on-premises and cloud resources and offers a single platform to automate the entire threat lifecycle including protection, detection, containment, remediation, and forensics. Key capabilities include single-click rollback using Windows VSS and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services offer economical multi-layer protection for physical servers and VMs, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and responding to security assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, endpoint control, and web filtering via cutting-edge tools incorporated within a single agent accessible from a single console. Progent's security and virtualization consultants can assist your business to design and configure a ProSight ESP deployment that addresses your organization's specific needs and that helps you achieve and demonstrate compliance with legal and industry information security standards. Progent will assist you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that call for immediate action. Progent's consultants can also assist your company to set up and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange email filtering.