24x7 Barra da Tijuca Emergency Crypto
Infection Assessment and Restoration Experts

Crypto-Ransomware : Your Crippling IT Nightmare
Ransomware has become an escalating cyberplague that poses an extinction-level threat for organizations poorly prepared for an attack. Different versions of ransomware such as CryptoLocker, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for years and still cause havoc. Recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, along with daily unnamed newcomers, not only encrypt on-line critical data but also infect any configured system backup. Files synchronized to the cloud can also be held hostage. In a poorly designed system, it can make automated recovery hopeless and effectively knocks the datacenter back to square one.

Retrieving applications and information after a ransomware event becomes a race against time as the targeted organization fights to contain the damage, cleanup the ransomware, and restore enterprise-critical operations. Since ransomware takes time to move laterally, assaults are frequently sprung during weekends and nights, when successful penetrations may take longer to notice. This multiplies the difficulty of quickly marshalling and coordinating a knowledgeable response team.

Progent offers a range of solutions for protecting enterprises from ransomware attacks. These include staff education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus setup and configuration of next-generation security appliances with AI technology from SentinelOne to identify and extinguish new threats intelligently. Progent in addition can provide the assistance of veteran ransomware recovery engineers with the skills and perseverance to re-deploy a compromised system as urgently as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the needed codes to unencrypt all your files. Kaspersky ascertained that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The fallback is to setup from scratch the critical elements of your IT environment. Without access to full system backups, this requires a broad range of skill sets, top notch project management, and the willingness to work continuously until the task is complete.

For twenty years, Progent has offered professional Information Technology services for companies across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with accounting and ERP applications. This breadth of experience affords Progent the ability to quickly determine necessary systems and integrate the surviving parts of your network environment after a ransomware event and assemble them into a functioning network.

Progent's ransomware group uses state-of-the-art project management systems to coordinate the complex restoration process. Progent knows the importance of acting swiftly and in concert with a customer's management and Information Technology staff to assign priority to tasks and to get key services back on-line as soon as humanly possible.

Customer Story: A Successful Crypto-Ransomware Intrusion Recovery
A business hired Progent after their company was attacked by Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state cybercriminals, suspected of using strategies exposed from the U.S. NSA organization. Ryuk seeks specific businesses with little room for disruption and is among the most profitable versions of crypto-ransomware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company based in Chicago and has around 500 staff members. The Ryuk penetration had paralyzed all company operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the beginning of the attack and were encrypted. The client considered paying the ransom (exceeding $200K) and hoping for good luck, but in the end reached out to Progent.

Progent worked with the client to rapidly assess and assign priority to the mission critical applications that needed to be recovered in order to resume departmental functions:

• Windows Active Directory
• Email
• Accounting and Manufacturing Software

In less than two days, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then assisted with rebuilding and storage recovery of mission critical systems. All Microsoft Exchange Server data and attributes were intact, which facilitated the restore of Exchange. Progent was also able to locate intact OST files (Microsoft Outlook Off-Line Data Files) on staff workstations in order to recover mail data. A recent offline backup of the customer's accounting/ERP software made it possible to return these essential applications back servicing users. Although a large amount of work still had to be done to recover totally from the Ryuk attack, critical services were returned to operations rapidly:

Over the following couple of weeks critical milestones in the restoration process were accomplished through tight collaboration between Progent team members and the client:

• In-house web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million archived emails was spun up and accessible to users.
• CRM/Customer Orders/Invoices/AP/AR/Inventory capabilities were completely functional.
• A new Palo Alto Networks 850 security appliance was brought online.
• 90% of the user PCs were back into operation.

Conclusion
A potential business-killing catastrophe was avoided due to results-oriented experts, a wide range of technical expertise, and tight collaboration. Although in retrospect the ransomware virus incident detailed here should have been identified and disabled with up-to-date cyber security technology and NIST Cybersecurity Framework best practices, user and IT administrator training, and properly executed security procedures for data protection and applying software patches, the fact is that government-sponsored cybercriminals from China, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware incursion, feel confident that Progent's team of professionals has proven experience in ransomware virus blocking, mitigation, and data disaster recovery.

To read or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Barra da Tijuca a portfolio of online monitoring and security assessment services designed to assist you to reduce your vulnerability to ransomware. These services include next-generation artificial intelligence capability to detect zero-day variants of ransomware that can get past traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to achieve leading-edge network resilience. Progent handles the necessary monitoring and maintenance for you, so your system expands readily without holding you back. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Entry-level packages include RMM, cybersecurity, automatic monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to advanced solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) technology to help keep your network running efficiently by checking the state of critical computers that power your information system. When ProSight LAN Watch uncovers a problem, an alarm is transmitted immediately to your designated IT management personnel and your assigned Progent consultant so that any potential problems can be resolved before they have a chance to impact productivity. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for managing your network, server, and desktop devices by providing an environment for performing common time-consuming jobs. These include health monitoring, patch management, automated repairs, endpoint configuration, backup and restore, A/V response, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alert to your specified IT management staff and your assigned Progent technical consultant so that emerging issues can be taken care of before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller businesses to diagram, monitor, enhance and troubleshoot their networking appliances such as switches, firewalls, and wireless controllers as well as servers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that infrastructure topology diagrams are kept current, copies and manages the configuration of virtually all devices on your network, tracks performance, and generates alerts when issues are detected. By automating time-consuming network management processes, WAN Watch can cut hours off common tasks like network mapping, expanding your network, locating appliances that require critical software patches, or identifying the cause of performance issues. Learn more details about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of real-time and in-depth management reporting plug-ins created to integrate with the industry's top ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues such as spotty support follow-up or machines with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with advanced backup software providers to produce ProSight Data Protection Services, a family of offerings that provide backup-as-a-service. ProSight DPS services automate and track your backup operations and allow non-disruptive backup and fast restoration of critical files, apps, images, and VMs. ProSight DPS lets you protect against data loss resulting from equipment breakdown, natural calamities, fire, malware like ransomware, human mistakes, ill-intentioned insiders, or application glitches. Managed backup services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent expert can help you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of leading data security vendors to deliver web-based control and world-class security for your email traffic. The hybrid structure of Email Guard managed service combines cloud-based filtering with an on-premises security gateway device to offer complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-based threats. Email Guard's cloud filter serves as a preliminary barricade and blocks the vast majority of threats from making it to your security perimeter. This decreases your exposure to inbound attacks and saves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a deeper layer of analysis for inbound email. For outbound email, the local security gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends within your security perimeter. For more information, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to protect against stolen passwords through the use of two-factor authentication. Duo supports single-tap identity confirmation with Apple iOS, Android, and other out-of-band devices. Using 2FA, when you log into a protected online account and enter your password you are requested to verify who you are on a unit that only you possess and that uses a different ("out-of-band") network channel. A wide selection of out-of-band devices can be utilized as this added form of authentication including an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You may designate multiple validation devices. To learn more about ProSight Duo two-factor identity authentication services, go to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Call Desk: Help Desk Managed Services
  Progent's Help Desk services enable your information technology group to outsource Call Center services to Progent or divide activity for Help Desk services transparently between your internal support team and Progent's extensive roster of IT service engineers and subject matter experts. Progent's Shared Help Desk Service provides a seamless extension of your internal support organization. End user interaction with the Service Desk, delivery of technical assistance, escalation, trouble ticket generation and tracking, efficiency metrics, and management of the support database are cohesive regardless of whether incidents are taken care of by your core IT support group, by Progent, or both. Read more about Progent's outsourced/shared Help Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior analysis tools to defend endpoints and servers and VMs against new malware assaults such as ransomware and file-less exploits, which routinely escape traditional signature-based anti-virus tools. Progent Active Security Monitoring services protect local and cloud resources and offers a unified platform to automate the complete threat lifecycle including protection, identification, mitigation, remediation, and post-attack forensics. Top capabilities include one-click rollback using Windows VSS and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, find and safeguard data related to your network infrastructure, procedures, applications, and services. You can quickly locate passwords or IP addresses and be alerted about upcoming expirations of SSLs or domains. By cleaning up and managing your network documentation, you can eliminate as much as 50% of time thrown away searching for critical information about your IT network. ProSight IT Asset Management features a common repository for storing and sharing all documents required for managing your business network such as recommended procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and relating IT data. Whether you're planning enhancements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you require when you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer organizations of all sizes a flexible and cost-effective alternative for evaluating, validating, scheduling, applying, and tracking updates to your ever-evolving IT system. Besides optimizing the protection and reliability of your IT network, Progent's patch management services permit your in-house IT staff to focus on line-of-business initiatives and activities that derive the highest business value from your information network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual host configured and managed by Progent's network support professionals. With Progent's ProSight Virtual Hosting service model, the client owns the data, the operating system platforms, and the apps. Because the environment is virtualized, it can be moved immediately to a different hardware environment without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, your business is not tied one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's cutting edge behavior analysis technology to defend physical and virtual endpoints against new malware attacks such as ransomware and email phishing, which routinely escape legacy signature-based anti-virus tools. ProSight Active Security Monitoring protects local and cloud resources and offers a unified platform to automate the complete malware attack lifecycle including blocking, infiltration detection, containment, remediation, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer ultra-affordable in-depth protection for physical servers and VMs, workstations, smartphones, and Exchange Server. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to cyber threats from all vectors. ProSight ESP provides firewall protection, intrusion alarms, device control, and web filtering through cutting-edge tools incorporated within a single agent accessible from a single control. Progent's data protection and virtualization consultants can assist your business to design and configure a ProSight ESP deployment that meets your organization's specific requirements and that allows you demonstrate compliance with legal and industry data protection standards. Progent will assist you define and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for urgent action. Progent's consultants can also assist you to install and test a backup and disaster recovery solution such as ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange filtering.