24x7 San Diego Immediate Ransomware
Computer Virus Detection and Repair Consultants

Crypto-Ransomware : Your Feared Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that represents an existential danger for organizations poorly prepared for an assault. Multiple generations of crypto-ransomware such as Dharma, Fusob, Locky, SamSam and MongoLock cryptoworms have been running rampant for many years and continue to cause harm. Modern strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, plus daily unnamed newcomers, not only do encryption of on-line data but also infect all available system backup. Files replicated to off-site disaster recovery sites can also be corrupted. In a vulnerable data protection solution, this can render automated restore operations hopeless and effectively knocks the entire system back to zero.

Recovering programs and data following a ransomware event becomes a race against the clock as the victim tries its best to stop lateral movement, clear the ransomware, and resume business-critical activity. Since ransomware requires time to spread, assaults are frequently launched at night, when penetrations in many cases take longer to notice. This multiplies the difficulty of quickly mobilizing and orchestrating a knowledgeable mitigation team.

Progent provides a range of support services for securing organizations from ransomware events. These include team member education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of modern security gateways with AI technology from SentinelOne to identify and disable new cyber threats automatically. Progent also provides the services of veteran ransomware recovery engineers with the track record and commitment to re-deploy a compromised environment as urgently as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware attack, sending the ransom in cryptocurrency does not provide any assurance that cyber hackers will provide the needed keys to unencrypt any or all of your files. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to setup from scratch the key components of your Information Technology environment. Absent the availability of complete information backups, this requires a broad complement of IT skills, professional project management, and the ability to work non-stop until the task is finished.

For decades, Progent has provided expert IT services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with financial systems and ERP software solutions. This breadth of expertise provides Progent the ability to rapidly ascertain critical systems and organize the remaining parts of your network environment following a crypto-ransomware attack and configure them into an operational system.

Progent's recovery team uses state-of-the-art project management applications to orchestrate the complex recovery process. Progent appreciates the urgency of working quickly and in unison with a customer's management and Information Technology resources to assign priority to tasks and to put essential applications back online as fast as humanly possible.

Customer Case Study: A Successful Ransomware Penetration Response
A small business engaged Progent after their network was taken over by Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state sponsored cybercriminals, possibly using techniques leaked from the U.S. NSA organization. Ryuk targets specific businesses with little room for operational disruption and is among the most lucrative incarnations of ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in the Chicago metro area and has about 500 workers. The Ryuk event had shut down all company operations and manufacturing capabilities. Most of the client's information backups had been on-line at the beginning of the attack and were destroyed. The client considered paying the ransom (exceeding $200K) and wishfully thinking for good luck, but in the end utilized Progent.

Progent worked with the customer to quickly get our arms around and assign priority to the mission critical systems that needed to be recovered to make it possible to resume departmental functions:

• Windows Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

Within two days, Progent was able to re-build Windows Active Directory to its pre-penetration state. Progent then charged ahead with setup and storage recovery of critical servers. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to locate non-encrypted OST data files (Outlook Offline Data Files) on user desktop computers in order to recover mail data. A recent offline backup of the client's accounting/ERP software made them able to restore these essential applications back online. Although major work still had to be done to recover totally from the Ryuk damage, the most important systems were recovered rapidly:

During the next few weeks critical milestones in the restoration project were made in close collaboration between Progent consultants and the customer:

• Self-hosted web sites were restored with no loss of data.
• The MailStore Server with over 4 million archived messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory modules were completely restored.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• Ninety percent of the desktops and laptops were fully operational.

Conclusion
A potential enterprise-killing catastrophe was evaded due to hard-working professionals, a wide array of IT skills, and close teamwork. Although in retrospect the crypto-ransomware virus incident detailed here should have been identified and blocked with up-to-date security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and well designed incident response procedures for backup and proper patching controls, the fact is that government-sponsored hackers from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware virus, feel confident that Progent's team of professionals has a proven track record in ransomware virus blocking, mitigation, and information systems recovery.

To read or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in San Diego a range of online monitoring and security evaluation services to help you to reduce your vulnerability to ransomware. These services utilize modern AI capability to detect new variants of ransomware that can get past traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent handles the necessary monitoring and maintenance for you, so your network scales smoothly without holding you back. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Basic plans include remote monitoring and management (RMM), security, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-in-class solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) technology to help keep your IT system operating at peak levels by tracking the health of vital assets that drive your information system. When ProSight LAN Watch detects a problem, an alert is transmitted immediately to your specified IT management personnel and your assigned Progent engineering consultant so any looming problems can be addressed before they can disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for monitoring and managing your network, server, and desktop devices by providing an environment for performing common tedious tasks. These can include health monitoring, update management, automated remediation, endpoint setup, backup and restore, anti-virus response, remote access, built-in and custom scripts, asset inventory, endpoint status reports, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alarm to your designated IT management personnel and your assigned Progent technical consultant so emerging issues can be fixed before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized businesses to map out, track, enhance and troubleshoot their networking hardware like switches, firewalls, and access points as well as servers, endpoints and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are always current, copies and displays the configuration information of virtually all devices connected to your network, monitors performance, and generates alerts when problems are discovered. By automating tedious network management activities, WAN Watch can cut hours off ordinary chores such as network mapping, reconfiguring your network, locating appliances that need critical software patches, or identifying the cause of performance problems. Find out more about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time reporting tools created to integrate with the industry's leading ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as inconsistent support follow-up or machines with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with leading backup technology companies to produce ProSight Data Protection Services, a portfolio of management offerings that deliver backup-as-a-service. ProSight DPS services manage and monitor your backup operations and allow transparent backup and rapid restoration of important files/folders, applications, images, plus virtual machines. ProSight DPS lets you recover from data loss resulting from equipment breakdown, natural disasters, fire, malware like ransomware, user mistakes, ill-intentioned insiders, or application glitches. Managed backup services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Hybrid Backup. Your Progent consultant can assist you to determine which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of top information security companies to deliver web-based control and comprehensive protection for your inbound and outbound email. The powerful architecture of Email Guard integrates cloud-based filtering with an on-premises security gateway device to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. Email Guard's cloud filter serves as a first line of defense and blocks the vast majority of unwanted email from reaching your network firewall. This reduces your exposure to inbound attacks and saves network bandwidth and storage. Email Guard's onsite security gateway device provides a further layer of analysis for incoming email. For outgoing email, the local security gateway offers AV and anti-spam protection, DLP, and email encryption. The on-premises security gateway can also assist Exchange Server to monitor and protect internal email traffic that stays inside your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA managed services utilize Cisco's Duo technology to protect against compromised passwords by using two-factor authentication (2FA). Duo enables one-tap identity verification with iOS, Android, and other out-of-band devices. With 2FA, whenever you sign into a secured application and give your password you are asked to confirm who you are via a unit that only you possess and that uses a separate network channel. A wide selection of out-of-band devices can be used as this added form of authentication including an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can register several verification devices. To find out more about Duo identity validation services, visit Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Call Desk: Call Center Managed Services
  Progent's Call Center managed services allow your IT staff to outsource Help Desk services to Progent or split activity for support services transparently between your internal network support group and Progent's nationwide pool of certified IT service engineers and subject matter experts. Progent's Shared Help Desk Service offers a smooth supplement to your internal IT support group. User access to the Help Desk, provision of technical assistance, escalation, trouble ticket creation and tracking, efficiency measurement, and management of the support database are cohesive regardless of whether issues are resolved by your in-house support group, by Progent, or both. Find out more about Progent's outsourced/co-managed Service Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior-based machine learning tools to guard endpoints and physical and virtual servers against new malware assaults like ransomware and email phishing, which easily escape traditional signature-based anti-virus tools. Progent ASM services protect on-premises and cloud resources and offers a unified platform to automate the entire malware attack lifecycle including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Key features include one-click rollback using Windows VSS and real-time network-wide immunization against new attacks. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, retrieve and protect information related to your IT infrastructure, procedures, business apps, and services. You can instantly find passwords or serial numbers and be alerted automatically about impending expirations of SSL certificates ,domains or warranties. By cleaning up and managing your IT infrastructure documentation, you can eliminate up to half of time wasted looking for vital information about your network. ProSight IT Asset Management features a centralized location for storing and sharing all documents required for managing your network infrastructure like standard operating procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and relating IT information. Whether you're planning improvements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the information you need when you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer businesses of all sizes a flexible and affordable alternative for assessing, testing, scheduling, applying, and documenting updates to your ever-evolving IT system. In addition to maximizing the security and functionality of your IT network, Progent's patch management services allow your IT staff to focus on line-of-business projects and activities that deliver the highest business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a protected Tier III data center on a fast virtual host configured and managed by Progent's IT support experts. Under the ProSight Virtual Hosting service model, the customer owns the data, the OS software, and the apps. Because the environment is virtualized, it can be ported easily to an alternate hosting environment without a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not locked into one hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior analysis technology to guard physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which routinely evade legacy signature-matching anti-virus tools. ProSight Active Security Monitoring protects on-premises and cloud-based resources and provides a unified platform to automate the entire threat progression including blocking, identification, mitigation, remediation, and forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services offer ultra-affordable multi-layer security for physical servers and VMs, workstations, mobile devices, and Microsoft Exchange. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and responding to cyber assaults from all attack vectors. ProSight ESP offers two-way firewall protection, intrusion alerts, device control, and web filtering through leading-edge tools incorporated within a single agent accessible from a unified console. Progent's data protection and virtualization consultants can assist your business to plan and implement a ProSight ESP environment that meets your company's specific requirements and that allows you achieve and demonstrate compliance with government and industry information security regulations. Progent will assist you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that call for immediate attention. Progent's consultants can also help you to install and verify a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover rapidly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange email filtering.