24x7x365 Milwaukee Emergency Crypto-Ransomware
Malware Detection and Remediation Help

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Crypto-Ransomware has become an escalating cyberplague that poses an extinction-level threat for businesses poorly prepared for an assault. Different versions of ransomware such as Dharma, Fusob, Locky, Syskey and MongoLock cryptoworms have been around for many years and still cause damage. Recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, along with frequent unnamed viruses, not only encrypt on-line information but also infect many configured system backup. Data synched to off-site disaster recovery sites can also be ransomed. In a vulnerable environment, it can render any restore operations impossible and effectively knocks the network back to zero.

Restoring programs and data following a crypto-ransomware event becomes a race against the clock as the targeted organization struggles to stop the spread, clear the ransomware, and restore enterprise-critical activity. Due to the fact that crypto-ransomware requires time to move laterally, assaults are frequently sprung on weekends and holidays, when penetrations may take longer to recognize. This multiplies the difficulty of rapidly assembling and coordinating a capable response team.

Progent has an assortment of support services for securing enterprises from ransomware penetrations. These include staff education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of next-generation security solutions with artificial intelligence capabilities from SentinelOne to detect and suppress day-zero threats intelligently. Progent also provides the services of veteran crypto-ransomware recovery engineers with the skills and perseverance to reconstruct a compromised system as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Following a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that distant criminals will return the needed keys to unencrypt all your data. Kaspersky ascertained that seventeen percent of ransomware victims never restored their information even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to re-install the vital parts of your Information Technology environment. Without access to essential information backups, this calls for a wide complement of IT skills, professional team management, and the willingness to work 24x7 until the task is complete.

For decades, Progent has made available expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned high-level certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial management and ERP applications. This breadth of expertise affords Progent the skills to quickly determine important systems and consolidate the remaining pieces of your IT environment after a ransomware attack and assemble them into an operational system.

Progent's recovery team deploys top notch project management tools to orchestrate the complex recovery process. Progent knows the urgency of acting swiftly and in concert with a client's management and IT staff to assign priority to tasks and to get the most important systems back on line as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Penetration Restoration
A business engaged Progent after their company was penetrated by Ryuk ransomware. Ryuk is generally considered to have been created by Northern Korean state sponsored cybercriminals, possibly adopting techniques leaked from the United States NSA organization. Ryuk seeks specific companies with limited ability to sustain disruption and is among the most lucrative incarnations of ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in the Chicago metro area with about 500 staff members. The Ryuk penetration had brought down all company operations and manufacturing capabilities. The majority of the client's data protection had been online at the start of the intrusion and were destroyed. The client was taking steps for paying the ransom demand (exceeding $200K) and praying for the best, but ultimately reached out to Progent.

Progent worked together with the client to rapidly understand and prioritize the most important services that needed to be recovered in order to restart company operations:

• Active Directory
• Electronic Messaging
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then helped perform reinstallations and storage recovery of essential applications. All Exchange Server schema and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to locate non-encrypted OST files (Microsoft Outlook Off-Line Data Files) on staff workstations to recover email information. A not too old offline backup of the businesses accounting/ERP systems made them able to return these essential services back online for users. Although major work still had to be done to recover fully from the Ryuk virus, critical systems were returned to operations quickly:

Throughout the following couple of weeks important milestones in the restoration process were accomplished through tight cooperation between Progent consultants and the client:

• Internal web applications were restored with no loss of information.
• The MailStore Exchange Server exceeding four million archived messages was brought on-line and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control modules were 100% recovered.
• A new Palo Alto 850 firewall was brought online.
• Nearly all of the desktops and laptops were operational.

Conclusion
A potential business-killing catastrophe was dodged due to hard-working professionals, a wide range of knowledge, and tight teamwork. Although in hindsight the crypto-ransomware virus penetration described here could have been identified and blocked with up-to-date security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and well designed security procedures for information protection and proper patching controls, the reality is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware incursion, remember that Progent's roster of experts has a proven track record in ransomware virus defense, remediation, and information systems disaster recovery.

To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Milwaukee a range of online monitoring and security assessment services designed to help you to minimize your vulnerability to crypto-ransomware. These services utilize next-generation artificial intelligence technology to detect new variants of ransomware that can evade legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your system scales smoothly without holding you back. For an affordable and predictable monthly price, Progent's full-service IT team can be your complete technology safety net. Entry-level packages include remote monitoring and management (RMM), cybersecurity, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management technology to help keep your network operating efficiently by tracking the health of vital computers that drive your business network. When ProSight LAN Watch detects a problem, an alarm is sent immediately to your specified IT management staff and your Progent engineering consultant so that any potential problems can be resolved before they have a chance to disrupt your network. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your network, server, and desktop devices by offering tools for streamlining common time-consuming tasks. These include health monitoring, update management, automated remediation, endpoint setup, backup and restore, anti-virus defense, secure remote access, standard and custom scripts, resource inventory, endpoint status reporting, and debugging support. When ProSight LAN Watch with NinjaOne RMM spots a serious incident, it transmits an alarm to your specified IT personnel and your assigned Progent technical consultant so that emerging problems can be fixed before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for smaller organizations to map, track, reconfigure and troubleshoot their connectivity hardware such as switches, firewalls, and wireless controllers as well as servers, endpoints and other networked devices. Incorporating state-of-the-art RMM technology, WAN Watch makes sure that infrastructure topology diagrams are kept current, captures and manages the configuration information of almost all devices on your network, monitors performance, and sends alerts when issues are discovered. By automating tedious network management activities, WAN Watch can knock hours off ordinary chores such as network mapping, reconfiguring your network, locating appliances that require important software patches, or resolving performance problems. Find out more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time and in-depth reporting plug-ins designed to work with the leading ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues like spotty support follow-through or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has partnered with leading backup/restore software providers to produce ProSight Data Protection Services, a selection of offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and track your backup processes and enable non-disruptive backup and rapid restoration of vital files/folders, apps, images, plus VMs. ProSight DPS lets you protect against data loss resulting from hardware failures, natural disasters, fire, malware such as ransomware, user mistakes, malicious employees, or application bugs. Managed backup services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to identify which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top information security companies to deliver centralized management and world-class protection for your email traffic. The hybrid architecture of Email Guard managed service combines a Cloud Protection Layer with a local security gateway appliance to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's cloud filter acts as a first line of defense and keeps the vast majority of threats from reaching your security perimeter. This reduces your vulnerability to inbound threats and conserves network bandwidth and storage space. Email Guard's onsite security gateway appliance provides a further level of analysis for incoming email. For outbound email, the on-premises gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to monitor and safeguard internal email that stays inside your corporate firewall. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication service plans utilize Cisco's Duo cloud technology to protect against password theft by using two-factor authentication (2FA). Duo enables single-tap identity verification with iOS, Google Android, and other personal devices. Using Duo 2FA, when you sign into a secured online account and give your password you are requested to verify who you are via a unit that only you possess and that uses a separate network channel. A broad selection of out-of-band devices can be utilized as this added means of authentication such as a smartphone or watch, a hardware/software token, a landline telephone, etc. You can register several verification devices. To learn more about Duo two-factor identity authentication services, refer to Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Call Center: Call Center Managed Services
  Progent's Support Desk managed services allow your IT group to outsource Help Desk services to Progent or split responsibilities for support services seamlessly between your in-house network support resources and Progent's nationwide roster of IT service engineers and subject matter experts (SMEs). Progent's Shared Service Desk offers a seamless supplement to your core support team. End user access to the Service Desk, provision of support services, issue escalation, ticket creation and updates, efficiency measurement, and maintenance of the service database are consistent regardless of whether incidents are taken care of by your corporate IT support group, by Progent's team, or by a combination. Learn more about Progent's outsourced/co-managed Call Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes next generation behavior machine learning tools to guard endpoint devices and servers and VMs against new malware assaults such as ransomware and email phishing, which routinely evade legacy signature-based anti-virus products. Progent Active Security Monitoring services protect local and cloud resources and offers a single platform to address the entire malware attack lifecycle including protection, identification, containment, remediation, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and protect information about your IT infrastructure, processes, applications, and services. You can instantly locate passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates or domains. By updating and organizing your network documentation, you can save up to half of time wasted trying to find critical information about your network. ProSight IT Asset Management includes a common location for holding and sharing all documents required for managing your network infrastructure like recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT data. Whether you're making enhancements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the knowledge you require the instant you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a versatile and affordable solution for evaluating, testing, scheduling, applying, and documenting software and firmware updates to your dynamic information system. In addition to maximizing the security and reliability of your IT network, Progent's patch management services free up time for your in-house IT staff to concentrate on more strategic projects and activities that derive maximum business value from your information network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a protected Tier III data center on a fast virtual machine host configured and managed by Progent's IT support experts. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS platforms, and the apps. Since the system is virtualized, it can be ported easily to an alternate hosting environment without requiring a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior machine learning tools to guard physical and virtual endpoint devices against new malware assaults such as ransomware and file-less exploits, which easily get by legacy signature-matching AV products. ProSight ASM protects local and cloud resources and offers a single platform to address the complete threat progression including filtering, infiltration detection, mitigation, cleanup, and forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection services deliver economical multi-layer security for physical servers and VMs, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced heuristics for continuously monitoring and reacting to security threats from all vectors. ProSight ESP provides firewall protection, intrusion alarms, device control, and web filtering through leading-edge tools incorporated within one agent accessible from a unified control. Progent's security and virtualization experts can help you to plan and configure a ProSight ESP deployment that addresses your company's unique requirements and that allows you achieve and demonstrate compliance with government and industry data security standards. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for urgent action. Progent's consultants can also assist your company to install and test a backup and restore system such as ProSight Data Protection Services so you can recover rapidly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange filtering.