24x7x365 Charlotte Critical CryptoLocker
Malware Damage Assessment and Recovery Support

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a too-frequent cyber pandemic that poses an extinction-level threat for organizations vulnerable to an attack. Versions of ransomware like the CryptoLocker, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for a long time and continue to inflict destruction. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, as well as frequent as yet unnamed newcomers, not only encrypt online data but also infiltrate all accessible system backup. Files synchronized to cloud environments can also be ransomed. In a poorly architected data protection solution, it can render automatic recovery hopeless and basically knocks the datacenter back to square one.

Getting back online services and data after a ransomware event becomes a sprint against the clock as the targeted business struggles to stop the spread, clear the ransomware, and resume mission-critical operations. Due to the fact that ransomware needs time to spread, penetrations are usually sprung at night, when successful penetrations are likely to take more time to notice. This multiplies the difficulty of promptly assembling and coordinating a knowledgeable mitigation team.

Progent makes available a range of services for securing enterprises from ransomware events. These include user education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus setup and configuration of next-generation security solutions with machine learning technology from SentinelOne to discover and extinguish zero-day cyber threats rapidly. Progent also can provide the assistance of seasoned ransomware recovery engineers with the track record and commitment to rebuild a breached network as soon as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware penetration, sending the ransom in cryptocurrency does not ensure that merciless criminals will provide the needed keys to decipher any of your files. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to setup from scratch the key components of your IT environment. Absent the availability of complete system backups, this calls for a wide range of skills, well-coordinated team management, and the ability to work 24x7 until the job is completed.

For twenty years, Progent has made available professional Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained advanced industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-recognized certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with accounting and ERP application software. This breadth of experience provides Progent the capability to knowledgably determine important systems and organize the remaining components of your Information Technology environment after a ransomware attack and configure them into a functioning system.

Progent's security group utilizes powerful project management applications to orchestrate the complex recovery process. Progent knows the urgency of working rapidly and in concert with a customer's management and IT staff to assign priority to tasks and to put the most important systems back on-line as fast as possible.

Customer Story: A Successful Ransomware Penetration Restoration
A client escalated to Progent after their company was crashed by the Ryuk crypto-ransomware. Ryuk is thought to have been launched by North Korean state sponsored criminal gangs, possibly adopting algorithms exposed from America's National Security Agency. Ryuk attacks specific organizations with limited tolerance for disruption and is one of the most lucrative instances of ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company based in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had brought down all business operations and manufacturing processes. Most of the client's backups had been online at the time of the intrusion and were damaged. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and praying for good luck, but in the end brought in Progent.

Progent worked with the client to rapidly understand and prioritize the key applications that had to be addressed in order to resume departmental operations:

• Microsoft Active Directory
• Exchange Server
• Accounting/MRP

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then helped perform rebuilding and storage recovery on key systems. All Microsoft Exchange Server data and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to collect local OST files (Outlook Email Offline Data Files) on team desktop computers to recover mail data. A not too old off-line backup of the businesses accounting/ERP software made it possible to recover these vital applications back servicing users. Although major work still had to be done to recover totally from the Ryuk attack, critical services were returned to operations rapidly:

Throughout the following month critical milestones in the recovery process were completed in tight collaboration between Progent team members and the client:

• In-house web sites were returned to operation with no loss of information.
• The MailStore Exchange Server with over four million historical emails was spun up and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control capabilities were 100 percent functional.
• A new Palo Alto 850 security appliance was set up.
• Most of the user workstations were operational.

Conclusion
A probable business extinction disaster was evaded by results-oriented professionals, a wide spectrum of knowledge, and close collaboration. Although upon completion of forensics the ransomware virus penetration described here could have been identified and prevented with advanced cyber security technology and ISO/IEC 27001 best practices, staff training, and well designed security procedures for data protection and keeping systems up to date with security patches, the fact remains that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incident, feel confident that Progent's roster of experts has extensive experience in crypto-ransomware virus blocking, removal, and information systems disaster recovery.

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Charlotte a portfolio of online monitoring and security evaluation services designed to help you to reduce the threat from ransomware. These services utilize next-generation artificial intelligence technology to detect new variants of crypto-ransomware that can escape detection by legacy signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve leading-edge IT resilience. Progent handles the necessary monitoring and maintenance for you, so your network scales easily without holding you back. For an affordable and predictable monthly price, Progent's experienced IT team can be your complete technology safety net. Basic plans include remote monitoring and management, security, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) technology to keep your IT system running at peak levels by tracking the health of vital computers that power your information system. When ProSight LAN Watch uncovers an issue, an alert is transmitted immediately to your specified IT personnel and your assigned Progent consultant so any looming problems can be addressed before they can disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for managing your client-server infrastructure by providing tools for streamlining common time-consuming jobs. These can include health checking, patch management, automated repairs, endpoint deployment, backup and restore, anti-virus defense, secure remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alarm to your specified IT management personnel and your assigned Progent consultant so that emerging issues can be fixed before they impact productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to map out, track, enhance and debug their networking hardware like switches, firewalls, and access points as well as servers, endpoints and other networked devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that network maps are always updated, captures and displays the configuration information of virtually all devices connected to your network, monitors performance, and sends alerts when problems are detected. By automating time-consuming network management activities, WAN Watch can knock hours off ordinary tasks like making network diagrams, expanding your network, finding devices that require important software patches, or identifying the cause of performance bottlenecks. Find out more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time reporting utilities designed to work with the top ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues like spotty support follow-through or machines with missing patches. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup software providers to create ProSight Data Protection Services, a family of management offerings that deliver backup-as-a-service. ProSight DPS services automate and track your backup processes and allow transparent backup and fast restoration of important files/folders, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business protect against data loss resulting from equipment breakdown, natural disasters, fire, malware such as ransomware, human mistakes, ill-intentioned insiders, or application bugs. Managed services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top information security companies to deliver web-based control and comprehensive security for all your email traffic. The hybrid architecture of Progent's Email Guard managed service integrates cloud-based filtering with an on-premises gateway device to provide advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-based threats. Email Guard's cloud filter serves as a first line of defense and blocks the vast majority of unwanted email from reaching your network firewall. This reduces your vulnerability to external attacks and saves system bandwidth and storage space. Email Guard's on-premises gateway device adds a deeper layer of inspection for incoming email. For outbound email, the local gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local gateway can also help Microsoft Exchange Server to track and protect internal email that originates and ends inside your corporate firewall. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA services incorporate Cisco's Duo technology to protect against stolen passwords by using two-factor authentication. Duo supports one-tap identity confirmation on iOS, Android, and other personal devices. Using 2FA, whenever you log into a protected online account and give your password you are asked to confirm who you are on a device that only you possess and that uses a separate network channel. A wide selection of devices can be used as this added means of authentication including an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You may register multiple validation devices. To learn more about ProSight Duo identity authentication services, refer to Cisco Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Center: Help Desk Managed Services
  Progent's Help Center managed services enable your IT staff to offload Call Center services to Progent or split activity for Service Desk support transparently between your in-house network support resources and Progent's nationwide pool of IT service engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a seamless supplement to your core IT support resources. Client access to the Service Desk, provision of support services, issue escalation, ticket generation and tracking, performance metrics, and management of the service database are cohesive whether incidents are resolved by your internal support resources, by Progent's team, or both. Read more about Progent's outsourced/co-managed Help Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes next generation behavior machine learning technology to guard endpoints and servers and VMs against modern malware attacks such as ransomware and email phishing, which routinely escape traditional signature-based anti-virus tools. Progent ASM services protect local and cloud resources and offers a unified platform to automate the entire threat lifecycle including filtering, detection, mitigation, cleanup, and forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new threats. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, update, find and protect information related to your IT infrastructure, processes, business apps, and services. You can instantly find passwords or IP addresses and be alerted about upcoming expirations of SSL certificates or warranties. By cleaning up and organizing your IT documentation, you can save as much as 50% of time thrown away looking for critical information about your IT network. ProSight IT Asset Management includes a common repository for holding and sharing all documents related to managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're planning enhancements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you need as soon as you need it. Read more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer organizations of all sizes a flexible and cost-effective alternative for assessing, validating, scheduling, applying, and documenting updates to your dynamic IT system. In addition to maximizing the security and functionality of your IT environment, Progent's software/firmware update management services allow your IT team to concentrate on more strategic initiatives and activities that derive maximum business value from your network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual host set up and managed by Progent's IT support experts. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS software, and the apps. Because the environment is virtualized, it can be ported immediately to a different hardware environment without a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior-based analysis technology to guard physical and virtual endpoint devices against new malware assaults like ransomware and file-less exploits, which routinely escape traditional signature-matching anti-virus tools. ProSight Active Security Monitoring safeguards on-premises and cloud resources and offers a single platform to automate the entire threat lifecycle including blocking, infiltration detection, containment, cleanup, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver economical multi-layer protection for physical servers and virtual machines, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced machine learning for round-the-clock monitoring and reacting to cyber assaults from all vectors. ProSight ESP delivers firewall protection, penetration alarms, device management, and web filtering via cutting-edge technologies packaged within one agent managed from a single control. Progent's data protection and virtualization experts can help your business to design and implement a ProSight ESP environment that meets your organization's unique needs and that allows you demonstrate compliance with government and industry information security standards. Progent will help you specify and configure policies that ProSight ESP will manage, and Progent will monitor your network and respond to alarms that require urgent action. Progent can also help your company to install and verify a backup and restore solution such as ProSight Data Protection Services so you can recover rapidly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.