Corpus Christi 24-7 Urgent Ransomware
Infection Assessment and Removal Support

Ransomware : Your Feared Information Technology Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that poses an extinction-level danger for businesses poorly prepared for an attack. Different iterations of ransomware like the CryptoLocker, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for many years and still inflict havoc. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, plus frequent unnamed viruses, not only encrypt online data files but also infect all configured system restores and backups. Data replicated to off-site disaster recovery sites can also be corrupted. In a poorly designed environment, this can render automatic restoration hopeless and basically sets the network back to square one.

Getting back on-line services and data following a ransomware attack becomes a race against the clock as the targeted organization struggles to contain the damage, clear the virus, and resume business-critical activity. Due to the fact that ransomware needs time to replicate, assaults are often sprung during nights and weekends, when attacks tend to take more time to identify. This multiplies the difficulty of quickly mobilizing and coordinating a knowledgeable response team.

Progent provides a range of support services for securing enterprises from crypto-ransomware penetrations. These include team member training to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of the latest generation security appliances with artificial intelligence capabilities from SentinelOne to identify and quarantine zero-day cyber threats automatically. Progent also provides the services of expert ransomware recovery consultants with the talent and perseverance to rebuild a breached network as quickly as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a ransomware penetration, even paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will return the keys to decrypt any of your data. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their files even after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to setup from scratch the vital elements of your Information Technology environment. Absent access to complete data backups, this calls for a broad complement of skill sets, well-coordinated team management, and the willingness to work continuously until the recovery project is finished.

For decades, Progent has made available professional IT services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded advanced certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with financial systems and ERP application software. This breadth of experience gives Progent the ability to rapidly determine critical systems and integrate the surviving components of your IT environment following a crypto-ransomware penetration and configure them into a functioning network.

Progent's recovery group has top notch project management systems to orchestrate the complex recovery process. Progent appreciates the importance of acting quickly and in unison with a customer's management and IT team members to assign priority to tasks and to get essential services back on line as fast as possible.

Client Case Study: A Successful Ransomware Attack Recovery
A customer hired Progent after their network system was taken over by Ryuk ransomware virus. Ryuk is believed to have been deployed by North Korean state sponsored hackers, possibly adopting algorithms leaked from the U.S. NSA organization. Ryuk targets specific companies with little room for operational disruption and is one of the most lucrative instances of crypto-ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer located in the Chicago metro area and has about 500 staff members. The Ryuk event had brought down all company operations and manufacturing capabilities. The majority of the client's backups had been on-line at the beginning of the attack and were damaged. The client was evaluating paying the ransom (in excess of $200,000) and hoping for good luck, but in the end reached out to Progent.

Progent worked together with the client to quickly identify and prioritize the most important applications that needed to be recovered to make it possible to continue departmental operations:

• Microsoft Active Directory
• Electronic Mail
• Accounting/MRP

In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then initiated reinstallations and hard drive recovery of essential applications. All Exchange ties and configuration information were usable, which facilitated the restore of Exchange. Progent was also able to locate local OST files (Outlook Off-Line Folder Files) on team PCs to recover email data. A recent off-line backup of the customer's accounting software made it possible to return these required programs back on-line. Although significant work remained to recover completely from the Ryuk damage, critical systems were recovered rapidly:

Over the next month important milestones in the restoration process were accomplished through tight cooperation between Progent team members and the customer:

• Internal web sites were returned to operation with no loss of data.
• The MailStore Server exceeding four million historical messages was restored to operations and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory capabilities were fully functional.
• A new Palo Alto 850 firewall was installed and configured.
• Ninety percent of the user desktops and notebooks were being used by staff.

Conclusion
A likely company-ending catastrophe was avoided by hard-working experts, a wide array of technical expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware penetration described here should have been blocked with current cyber security solutions and recognized best practices, user education, and properly executed incident response procedures for information protection and keeping systems up to date with security patches, the fact remains that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware virus, remember that Progent's roster of professionals has proven experience in ransomware virus blocking, cleanup, and information systems recovery.

To review or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Corpus Christi a variety of remote monitoring and security evaluation services designed to assist you to minimize your vulnerability to ransomware. These services include next-generation AI technology to detect new variants of crypto-ransomware that are able to evade legacy signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to create leading-edge IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your network scales easily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Entry-level packages include RMM, security, automatic monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to keep your network running at peak levels by tracking the state of critical computers that power your business network. When ProSight LAN Watch detects a problem, an alert is transmitted automatically to your specified IT personnel and your Progent consultant so all looming problems can be addressed before they can disrupt productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for managing your client-server infrastructure by providing tools for streamlining common tedious tasks. These can include health monitoring, update management, automated remediation, endpoint deployment, backup and restore, A/V response, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alarm to your designated IT personnel and your assigned Progent technical consultant so that emerging issues can be fixed before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized businesses to map out, track, optimize and debug their networking appliances like routers and switches, firewalls, and access points as well as servers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch ensures that network diagrams are kept current, copies and manages the configuration of virtually all devices connected to your network, monitors performance, and sends notices when problems are discovered. By automating time-consuming management and troubleshooting processes, ProSight WAN Watch can cut hours off common chores such as making network diagrams, expanding your network, locating appliances that require important software patches, or resolving performance issues. Learn more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of real-time reporting tools created to integrate with the leading ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues like spotty support follow-through or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore technology providers to create ProSight Data Protection Services, a portfolio of offerings that deliver backup-as-a-service. ProSight DPS services manage and track your data backup operations and allow non-disruptive backup and rapid restoration of vital files, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business avoid data loss caused by equipment breakdown, natural disasters, fire, malware like ransomware, user mistakes, ill-intentioned employees, or software glitches. Managed backup services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these fully managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading data security companies to provide centralized management and comprehensive security for your inbound and outbound email. The powerful structure of Progent's Email Guard managed service combines a Cloud Protection Layer with a local security gateway device to offer advanced defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-based threats. The Cloud Protection Layer acts as a first line of defense and keeps the vast majority of threats from making it to your network firewall. This reduces your vulnerability to external attacks and saves system bandwidth and storage space. Email Guard's onsite security gateway appliance provides a further level of analysis for incoming email. For outbound email, the local security gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The local gateway can also assist Microsoft Exchange Server to monitor and protect internal email traffic that originates and ends inside your corporate firewall. For more information, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo technology to defend against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation with iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you sign into a protected application and give your password you are asked to verify your identity via a unit that only you have and that is accessed using a different ("out-of-band") network channel. A broad range of out-of-band devices can be used for this second form of authentication such as a smartphone or watch, a hardware token, a landline phone, etc. You can register multiple verification devices. To learn more about ProSight Duo two-factor identity validation services, refer to Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Service Center: Call Center Managed Services
  Progent's Support Center managed services allow your IT team to outsource Help Desk services to Progent or divide activity for Service Desk support seamlessly between your internal support staff and Progent's extensive pool of IT service engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a seamless supplement to your core IT support group. End user access to the Help Desk, provision of support, problem escalation, trouble ticket creation and updates, performance measurement, and management of the support database are cohesive whether incidents are resolved by your core support organization, by Progent's team, or a mix of the two. Learn more about Progent's outsourced/co-managed Service Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior-based machine learning technology to defend endpoint devices as well as physical and virtual servers against new malware attacks such as ransomware and file-less exploits, which routinely evade traditional signature-matching anti-virus tools. Progent ASM services safeguard local and cloud-based resources and offers a single platform to address the entire malware attack lifecycle including filtering, detection, containment, cleanup, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, retrieve and protect data related to your IT infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSLs or domains. By cleaning up and organizing your IT infrastructure documentation, you can eliminate up to half of time spent searching for vital information about your IT network. ProSight IT Asset Management features a centralized repository for holding and collaborating on all documents related to managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and associating IT data. Whether you're planning enhancements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the information you require as soon as you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer businesses of any size a flexible and affordable alternative for assessing, validating, scheduling, applying, and tracking software and firmware updates to your ever-evolving information system. Besides optimizing the security and functionality of your IT environment, Progent's software/firmware update management services permit your in-house IT team to concentrate on more strategic projects and tasks that derive maximum business value from your information network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a secure Tier III data center on a fast virtual machine host set up and maintained by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be ported easily to a different hosting environment without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not tied one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior-based machine learning technology to defend physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which routinely get by traditional signature-based anti-virus products. ProSight ASM protects local and cloud resources and provides a unified platform to automate the entire malware attack progression including protection, identification, mitigation, cleanup, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver affordable multi-layer protection for physical and virtual servers, workstations, mobile devices, and Exchange email. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP provides firewall protection, intrusion alarms, device management, and web filtering through leading-edge technologies packaged within one agent accessible from a unified control. Progent's security and virtualization experts can assist your business to design and implement a ProSight ESP deployment that addresses your company's unique needs and that helps you achieve and demonstrate compliance with government and industry data security regulations. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that require urgent action. Progent can also help your company to install and verify a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.