24/7 Phoenix Urgent Ransomware
Virus Identification and Recovery Support

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become an escalating cyber pandemic that poses an extinction-level danger for organizations poorly prepared for an assault. Different versions of ransomware such as Dharma, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for a long time and still cause destruction. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, along with daily unnamed viruses, not only do encryption of online information but also infiltrate all configured system backups. Information replicated to cloud environments can also be held hostage. In a poorly designed environment, this can render automatic restoration useless and basically sets the network back to zero.

Getting back applications and data after a ransomware event becomes a race against the clock as the targeted organization struggles to contain, eradicate the ransomware, and resume enterprise-critical operations. Because ransomware takes time to move laterally, penetrations are frequently launched on weekends and holidays, when penetrations typically take longer to detect. This compounds the difficulty of quickly mobilizing and coordinating a knowledgeable mitigation team.

Progent has a range of help services for protecting organizations from crypto-ransomware penetrations. These include team member training to help identify and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of next-generation security appliances with artificial intelligence technology from SentinelOne to detect and quarantine zero-day cyber threats rapidly. Progent in addition can provide the services of expert ransomware recovery engineers with the skills and commitment to reconstruct a breached system as urgently as possible.

Progent's Ransomware Restoration Help
Soon after a crypto-ransomware event, sending the ransom in cryptocurrency does not guarantee that distant criminals will respond with the needed keys to decipher any or all of your information. Kaspersky estimated that 17% of ransomware victims never recovered their files after having paid the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to piece back together the mission-critical parts of your Information Technology environment. Absent the availability of essential information backups, this requires a wide range of IT skills, well-coordinated project management, and the capability to work continuously until the job is complete.

For twenty years, Progent has offered professional Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded high-level certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP applications. This breadth of experience affords Progent the ability to efficiently ascertain important systems and organize the remaining components of your IT system after a crypto-ransomware event and assemble them into a functioning system.

Progent's security group uses state-of-the-art project management systems to coordinate the complex recovery process. Progent appreciates the urgency of acting swiftly and in unison with a client's management and IT resources to prioritize tasks and to put critical systems back on-line as fast as possible.

Business Case Study: A Successful Crypto-Ransomware Penetration Response
A business hired Progent after their network was taken over by Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean government sponsored criminal gangs, possibly adopting approaches leaked from the U.S. NSA organization. Ryuk goes after specific organizations with limited tolerance for operational disruption and is one of the most lucrative instances of ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturer headquartered in the Chicago metro area with about 500 staff members. The Ryuk event had disabled all business operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the beginning of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (more than two hundred thousand dollars) and praying for good luck, but ultimately brought in Progent.

Progent worked hand in hand the client to rapidly assess and prioritize the most important applications that needed to be addressed to make it possible to continue company functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting/MRP

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then accomplished setup and hard drive recovery on needed applications. All Exchange Server data and attributes were intact, which greatly helped the restore of Exchange. Progent was also able to assemble local OST files (Microsoft Outlook Off-Line Data Files) on user workstations in order to recover email data. A recent offline backup of the customer's accounting/MRP systems made it possible to recover these required programs back servicing users. Although significant work was left to recover completely from the Ryuk damage, critical systems were returned to operations rapidly:

Throughout the next couple of weeks important milestones in the recovery process were achieved through tight cooperation between Progent consultants and the client:

• Self-hosted web sites were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server exceeding 4 million historical emails was restored to operations and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory functions were fully recovered.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• 90% of the user workstations were back into operation.

Conclusion
A probable company-ending catastrophe was avoided with results-oriented experts, a wide range of technical expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware penetration described here should have been stopped with current cyber security technology solutions and best practices, user education, and well designed incident response procedures for data protection and applying software patches, the reality remains that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and file disaster recovery.

To review or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Phoenix a range of remote monitoring and security assessment services designed to help you to minimize your vulnerability to crypto-ransomware. These services utilize modern machine learning technology to detect new strains of crypto-ransomware that are able to get past traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent handles the necessary monitoring and maintenance for you, so your network expands smoothly without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management, security, automatic monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) technology to keep your network operating efficiently by checking the state of critical assets that drive your information system. When ProSight LAN Watch detects an issue, an alarm is transmitted immediately to your specified IT management personnel and your Progent consultant so any potential problems can be resolved before they have a chance to impact your network. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based solution for managing your client-server infrastructure by providing tools for streamlining common time-consuming tasks. These include health monitoring, update management, automated remediation, endpoint deployment, backup and restore, A/V defense, secure remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it sends an alarm to your specified IT management staff and your assigned Progent technical consultant so that emerging issues can be fixed before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for small and mid-sized businesses to map out, track, enhance and debug their networking appliances such as switches, firewalls, and access points as well as servers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network diagrams are always updated, captures and displays the configuration of virtually all devices on your network, monitors performance, and generates notices when issues are detected. By automating tedious management processes, ProSight WAN Watch can knock hours off common chores like making network diagrams, reconfiguring your network, locating appliances that need critical updates, or identifying the cause of performance issues. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of real-time and in-depth management reporting utilities created to integrate with the industry's top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize critical issues like inconsistent support follow-up or endpoints with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has partnered with leading backup software companies to produce ProSight Data Protection Services, a portfolio of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services manage and monitor your backup operations and enable transparent backup and fast restoration of vital files, applications, images, plus Hyper-V and VMware virtual machines. ProSight DPS lets your business protect against data loss resulting from equipment breakdown, natural disasters, fire, cyber attacks like ransomware, human error, malicious insiders, or application glitches. Managed services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to identify which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of top data security companies to deliver web-based control and comprehensive protection for your email traffic. The powerful architecture of Progent's Email Guard combines a Cloud Protection Layer with a local gateway appliance to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-borne threats. The cloud filter serves as a preliminary barricade and keeps most unwanted email from making it to your network firewall. This decreases your exposure to inbound threats and saves network bandwidth and storage space. Email Guard's on-premises security gateway device adds a deeper level of analysis for incoming email. For outbound email, the on-premises security gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also assist Exchange Server to monitor and protect internal email that originates and ends within your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication services incorporate Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo supports single-tap identity confirmation with iOS, Google Android, and other personal devices. With 2FA, when you sign into a secured application and give your password you are requested to confirm who you are via a device that only you have and that is accessed using a separate network channel. A wide range of out-of-band devices can be utilized as this added form of authentication including a smartphone or wearable, a hardware token, a landline telephone, etc. You may register multiple validation devices. To learn more about Duo identity authentication services, go to Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Desk: Call Center Managed Services
  Progent's Call Center services permit your information technology group to offload Support Desk services to Progent or split activity for Help Desk services seamlessly between your in-house network support staff and Progent's nationwide pool of certified IT service technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a transparent supplement to your core support team. End user access to the Help Desk, provision of support, problem escalation, ticket generation and updates, performance measurement, and management of the support database are consistent regardless of whether issues are resolved by your in-house support resources, by Progent, or by a combination. Learn more about Progent's outsourced/shared Help Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes next generation behavior-based machine learning tools to guard endpoint devices as well as servers and VMs against new malware attacks like ransomware and file-less exploits, which easily evade traditional signature-matching anti-virus products. Progent Active Security Monitoring services protect on-premises and cloud-based resources and offers a unified platform to manage the entire threat lifecycle including filtering, infiltration detection, containment, cleanup, and forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against new threats. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, find and safeguard data about your network infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSLs or warranties. By cleaning up and organizing your IT infrastructure documentation, you can eliminate up to 50% of time spent looking for critical information about your network. ProSight IT Asset Management features a common location for storing and collaborating on all documents required for managing your business network like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and relating IT data. Whether you're making enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you require when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and affordable solution for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your ever-evolving IT system. Besides maximizing the protection and functionality of your IT environment, Progent's software/firmware update management services allow your IT team to focus on line-of-business projects and activities that deliver maximum business value from your information network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a protected Tier III data center on a fast virtual machine host set up and maintained by Progent's IT support experts. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the apps. Since the environment is virtualized, it can be ported easily to a different hardware solution without requiring a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior-based machine learning tools to defend physical and virtual endpoint devices against modern malware assaults such as ransomware and email phishing, which easily escape legacy signature-matching anti-virus products. ProSight Active Security Monitoring protects local and cloud resources and offers a single platform to manage the complete malware attack progression including filtering, detection, containment, cleanup, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services deliver affordable multi-layer protection for physical servers and virtual machines, desktops, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and reacting to security threats from all attack vectors. ProSight ESP provides firewall protection, penetration alarms, device management, and web filtering through cutting-edge technologies incorporated within one agent accessible from a single control. Progent's security and virtualization consultants can help you to design and configure a ProSight ESP environment that meets your company's specific requirements and that allows you demonstrate compliance with government and industry data security standards. Progent will assist you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that call for immediate attention. Progent can also help your company to set up and test a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.