Lower Manhattan 24x7x365 Urgent CryptoLocker
Computer Virus Identification and Recovery Consulting

Crypto-Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become a too-frequent cyberplague that represents an enterprise-level threat for businesses of all sizes vulnerable to an assault. Different iterations of ransomware such as CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for years and continue to cause havoc. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, as well as more unnamed malware, not only do encryption of online information but also infiltrate all available system protection mechanisms. Information replicated to the cloud can also be ransomed. In a vulnerable environment, this can render automatic restoration impossible and effectively sets the network back to square one.

Restoring applications and data following a ransomware attack becomes a race against time as the targeted organization tries its best to contain the damage, remove the crypto-ransomware, and restore business-critical operations. Because ransomware takes time to replicate, assaults are usually launched on weekends, when penetrations are likely to take longer to detect. This compounds the difficulty of quickly assembling and coordinating a capable mitigation team.

Progent provides an assortment of help services for protecting businesses from crypto-ransomware penetrations. Among these are team education to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to deployment of the latest generation security solutions with artificial intelligence capabilities from SentinelOne to detect and disable new threats intelligently. Progent also provides the services of seasoned ransomware recovery engineers with the talent and perseverance to reconstruct a breached environment as quickly as possible.

Progent's Crypto-Ransomware Restoration Help
After a crypto-ransomware event, sending the ransom in cryptocurrency does not provide any assurance that cyber hackers will provide the keys to decrypt any of your data. Kaspersky Labs determined that 17% of ransomware victims never restored their data after having paid the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to setup from scratch the key components of your Information Technology environment. Without the availability of full information backups, this calls for a wide range of IT skills, top notch project management, and the capability to work 24x7 until the job is over.

For decades, Progent has offered certified expert IT services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial management and ERP application software. This breadth of expertise affords Progent the skills to knowledgably identify critical systems and consolidate the surviving parts of your network environment following a ransomware event and assemble them into a functioning system.

Progent's security team utilizes top notch project management systems to coordinate the complicated recovery process. Progent knows the importance of acting swiftly and together with a customer's management and Information Technology resources to assign priority to tasks and to get critical applications back online as soon as humanly possible.

Client Case Study: A Successful Ransomware Incident Restoration
A client contacted Progent after their organization was brought down by Ryuk ransomware virus. Ryuk is believed to have been developed by Northern Korean state cybercriminals, suspected of adopting techniques leaked from America's NSA organization. Ryuk seeks specific organizations with limited ability to sustain operational disruption and is among the most profitable versions of ransomware. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company located in the Chicago metro area and has around 500 staff members. The Ryuk event had frozen all company operations and manufacturing capabilities. Most of the client's backups had been directly accessible at the time of the attack and were destroyed. The client was evaluating paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for the best, but in the end brought in Progent.

Progent worked hand in hand the client to rapidly identify and prioritize the key areas that needed to be addressed in order to resume business operations:

• Windows Active Directory
• Microsoft Exchange Email
• MRP System

In less than two days, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then performed reinstallations and storage recovery of key servers. All Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was able to find local OST data files (Microsoft Outlook Offline Folder Files) on team workstations in order to recover mail data. A recent offline backup of the client's accounting/ERP software made it possible to return these required applications back online for users. Although significant work remained to recover completely from the Ryuk attack, essential services were recovered quickly:

Over the next couple of weeks important milestones in the restoration process were made through tight cooperation between Progent team members and the customer:

• Internal web sites were returned to operation without losing any data.
• The MailStore Server exceeding four million historical messages was brought online and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory Control modules were 100% recovered.
• A new Palo Alto 850 firewall was set up.
• Most of the user workstations were back into operation.

Conclusion
A likely business extinction disaster was evaded due to dedicated professionals, a wide range of technical expertise, and tight teamwork. Although in retrospect the crypto-ransomware virus incident described here would have been identified and stopped with advanced cyber security systems and NIST Cybersecurity Framework best practices, user education, and appropriate security procedures for data backup and applying software patches, the reality remains that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's roster of experts has extensive experience in ransomware virus defense, remediation, and data recovery.

To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Lower Manhattan a range of online monitoring and security evaluation services to help you to minimize the threat from ransomware. These services include next-generation AI capability to detect new strains of crypto-ransomware that can escape detection by legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the daily monitoring and management for you, so your network scales smoothly without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT group can be your dependable technology safety net. Entry-level packages include remote monitoring and management, cybersecurity, automatic monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management technology to help keep your network running at peak levels by checking the health of critical assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent immediately to your specified IT management staff and your Progent engineering consultant so that any potential issues can be addressed before they have a chance to impact productivity. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based solution for monitoring and managing your client-server infrastructure by providing an environment for performing common tedious tasks. These can include health checking, patch management, automated repairs, endpoint setup, backup and restore, anti-virus response, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alarm to your specified IT staff and your Progent technical consultant so that emerging problems can be taken care of before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller businesses to map, monitor, optimize and troubleshoot their networking hardware like routers, firewalls, and load balancers plus servers, printers, client computers and other devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology diagrams are kept updated, captures and displays the configuration information of virtually all devices connected to your network, tracks performance, and generates notices when problems are discovered. By automating complex management and troubleshooting activities, WAN Watch can knock hours off common tasks such as network mapping, reconfiguring your network, finding appliances that need important updates, or resolving performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time and in-depth management reporting utilities created to work with the industry's leading ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues such as inconsistent support follow-through or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software providers to create ProSight Data Protection Services, a portfolio of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS products manage and track your data backup operations and enable transparent backup and rapid recovery of critical files, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business protect against data loss caused by hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, user error, malicious employees, or software bugs. Managed services in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to determine which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading information security vendors to provide centralized management and world-class security for all your email traffic. The powerful architecture of Progent's Email Guard integrates cloud-based filtering with an on-premises security gateway appliance to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's cloud filter acts as a preliminary barricade and keeps most threats from making it to your security perimeter. This reduces your exposure to inbound attacks and saves system bandwidth and storage space. Email Guard's on-premises security gateway device provides a further level of analysis for inbound email. For outgoing email, the onsite security gateway provides AV and anti-spam protection, DLP, and email encryption. The onsite security gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email that stays inside your security perimeter. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication (2FA). Duo supports one-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. Using Duo 2FA, when you log into a protected application and give your password you are requested to verify who you are via a device that only you possess and that uses a separate network channel. A broad range of devices can be used as this second means of ID validation including a smartphone or watch, a hardware/software token, a landline phone, etc. You may register several validation devices. For more information about Duo identity authentication services, refer to Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Help Center: Call Center Managed Services
  Progent's Support Desk managed services permit your information technology team to offload Help Desk services to Progent or divide activity for Help Desk services seamlessly between your internal support group and Progent's nationwide pool of certified IT support engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a smooth supplement to your corporate support team. User interaction with the Service Desk, provision of support, issue escalation, ticket generation and tracking, efficiency metrics, and maintenance of the service database are cohesive whether issues are resolved by your in-house network support group, by Progent, or a mix of the two. Learn more about Progent's outsourced/shared Help Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior machine learning tools to defend endpoint devices as well as physical and virtual servers against new malware attacks such as ransomware and file-less exploits, which easily evade legacy signature-matching AV tools. Progent ASM services protect on-premises and cloud-based resources and offers a unified platform to automate the complete threat lifecycle including protection, infiltration detection, containment, cleanup, and forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, find and protect data related to your IT infrastructure, processes, business apps, and services. You can instantly find passwords or serial numbers and be warned about upcoming expirations of SSL certificates or warranties. By updating and managing your IT infrastructure documentation, you can eliminate as much as half of time wasted trying to find vital information about your IT network. ProSight IT Asset Management features a common location for storing and sharing all documents related to managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT data. Whether you're making improvements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer businesses of all sizes a flexible and affordable solution for assessing, validating, scheduling, applying, and tracking updates to your dynamic information network. Besides optimizing the protection and functionality of your IT environment, Progent's software/firmware update management services free up time for your IT team to concentrate on line-of-business projects and tasks that derive the highest business value from your network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure Tier III data center on a fast virtual host set up and maintained by Progent's IT support experts. With Progent's ProSight Virtual Hosting model, the customer owns the data, the OS software, and the applications. Since the system is virtualized, it can be ported immediately to a different hardware solution without a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior-based analysis tools to defend physical and virtual endpoints against new malware attacks like ransomware and file-less exploits, which easily get by legacy signature-based anti-virus products. ProSight Active Security Monitoring protects local and cloud-based resources and provides a single platform to automate the entire malware attack lifecycle including filtering, infiltration detection, containment, cleanup, and forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services deliver economical multi-layer security for physical servers and VMs, desktops, mobile devices, and Exchange Server. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, device control, and web filtering through leading-edge technologies packaged within one agent managed from a unified console. Progent's data protection and virtualization experts can help you to plan and configure a ProSight ESP deployment that addresses your company's unique needs and that allows you achieve and demonstrate compliance with legal and industry information security regulations. Progent will assist you define and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that require immediate attention. Progent can also help your company to set up and test a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange email filtering.