24x7 Raleigh Immediate Crypto-Ransomware
Computer Malware Identification and Recovery Services

Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become a modern cyberplague that poses an extinction-level threat for organizations unprepared for an assault. Multiple generations of ransomware like the Dharma, WannaCry, Locky, Syskey and MongoLock cryptoworms have been running rampant for years and continue to cause destruction. The latest variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, as well as more unnamed malware, not only encrypt online data files but also infiltrate many accessible system protection mechanisms. Data synchronized to off-site disaster recovery sites can also be held hostage. In a poorly designed data protection solution, it can make any restoration useless and basically knocks the datacenter back to zero.

Recovering services and information following a ransomware event becomes a race against time as the targeted business fights to contain the damage, remove the ransomware, and resume business-critical activity. Due to the fact that ransomware takes time to replicate, assaults are often sprung at night, when attacks are likely to take longer to uncover. This multiplies the difficulty of quickly marshalling and organizing an experienced mitigation team.

Progent provides a range of solutions for protecting businesses from crypto-ransomware events. Among these are team member training to help identify and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of modern security solutions with AI technology from SentinelOne to detect and quarantine zero-day cyber threats quickly. Progent in addition offers the assistance of veteran ransomware recovery engineers with the talent and perseverance to re-deploy a breached environment as urgently as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware invasion, even paying the ransom in cryptocurrency does not guarantee that cyber criminals will return the codes to decipher any or all of your files. Kaspersky determined that 17% of ransomware victims never restored their files after having paid the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The fallback is to piece back together the vital elements of your Information Technology environment. Absent the availability of essential data backups, this calls for a broad complement of skill sets, well-coordinated project management, and the capability to work 24x7 until the recovery project is completed.

For decades, Progent has offered certified expert Information Technology services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded top certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized industry certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial systems and ERP software solutions. This breadth of experience affords Progent the ability to quickly ascertain critical systems and re-organize the surviving parts of your IT system following a ransomware attack and rebuild them into an operational system.

Progent's ransomware group has top notch project management tools to orchestrate the sophisticated restoration process. Progent understands the urgency of acting rapidly and in concert with a client's management and IT resources to assign priority to tasks and to put key systems back on line as fast as possible.

Customer Case Study: A Successful Ransomware Intrusion Restoration
A business escalated to Progent after their network was brought down by Ryuk ransomware virus. Ryuk is thought to have been launched by North Korean state criminal gangs, possibly using technology leaked from America's NSA organization. Ryuk targets specific businesses with little or no ability to sustain operational disruption and is one of the most profitable iterations of crypto-ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in Chicago with around 500 employees. The Ryuk attack had brought down all essential operations and manufacturing capabilities. Most of the client's data backups had been online at the start of the attack and were encrypted. The client was actively seeking loans for paying the ransom (more than $200K) and hoping for good luck, but ultimately brought in Progent.

Progent worked with the client to rapidly determine and assign priority to the mission critical areas that had to be restored to make it possible to continue company operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• Financials/MRP

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then performed reinstallations and hard drive recovery on needed systems. All Microsoft Exchange Server data and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to find local OST data files (Microsoft Outlook Off-Line Data Files) on team PCs and laptops to recover mail messages. A not too old offline backup of the businesses accounting/MRP software made them able to restore these vital applications back on-line. Although major work needed to be completed to recover totally from the Ryuk event, essential systems were recovered quickly:

Over the following month critical milestones in the recovery process were accomplished through tight cooperation between Progent engineers and the customer:

• Internal web sites were restored with no loss of information.
• The MailStore Server with over four million historical messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control functions were completely functional.
• A new Palo Alto 850 security appliance was brought on-line.
• 90% of the desktops and laptops were back into operation.

Conclusion
A probable enterprise-killing disaster was averted through the efforts of hard-working experts, a wide range of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware penetration detailed here would have been identified and stopped with advanced cyber security solutions and security best practices, user and IT administrator training, and appropriate security procedures for data backup and keeping systems up to date with security patches, the reality remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware penetration, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, cleanup, and file recovery.

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Raleigh a portfolio of remote monitoring and security assessment services to assist you to reduce your vulnerability to ransomware. These services utilize next-generation artificial intelligence technology to detect zero-day strains of ransomware that can evade legacy signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your system expands readily without becoming an obstacle. For a low and predictable monthly price, Progent's experienced IT group can be your complete technology safety net. Entry-level plans include remote monitoring and management, cybersecurity, automatic monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) technology to keep your IT system running efficiently by checking the health of critical assets that drive your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted immediately to your designated IT management personnel and your Progent engineering consultant so all potential problems can be addressed before they can disrupt your network. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for managing your client-server infrastructure by offering tools for performing common tedious tasks. These can include health monitoring, update management, automated repairs, endpoint configuration, backup and restore, A/V response, remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alert to your designated IT management staff and your Progent consultant so that potential problems can be fixed before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to map out, track, enhance and troubleshoot their connectivity hardware like switches, firewalls, and wireless controllers as well as servers, client computers and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are kept current, captures and manages the configuration information of virtually all devices connected to your network, monitors performance, and generates notices when problems are detected. By automating time-consuming network management activities, ProSight WAN Watch can knock hours off ordinary tasks such as network mapping, reconfiguring your network, locating devices that need important software patches, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time and in-depth reporting utilities created to integrate with the industry's leading ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize key issues like spotty support follow-through or machines with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with advanced backup software providers to create ProSight Data Protection Services (DPS), a portfolio of subscription-based management offerings that provide backup-as-a-service (BaaS). ProSight DPS products automate and track your data backup processes and enable non-disruptive backup and rapid restoration of vital files, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps you recover from data loss resulting from equipment failures, natural calamities, fire, malware like ransomware, user error, malicious insiders, or software glitches. Managed backup services in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to determine which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of leading information security companies to provide web-based control and world-class security for your inbound and outbound email. The powerful structure of Email Guard integrates cloud-based filtering with an on-premises security gateway appliance to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based threats. The cloud filter serves as a first line of defense and blocks the vast majority of threats from making it to your security perimeter. This decreases your exposure to external attacks and saves network bandwidth and storage space. Email Guard's onsite gateway appliance provides a deeper level of analysis for inbound email. For outbound email, the local security gateway offers AV and anti-spam protection, DLP, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends within your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to protect against compromised passwords by using two-factor authentication (2FA). Duo supports single-tap identity verification on iOS, Google Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a secured online account and give your password you are asked to confirm who you are via a device that only you possess and that is accessed using a different network channel. A broad selection of devices can be used as this added means of ID validation such as an iPhone or Android or wearable, a hardware token, a landline phone, etc. You may designate multiple validation devices. To learn more about Duo identity authentication services, go to Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Support Center managed services permit your IT group to offload Call Center services to Progent or divide activity for Service Desk support transparently between your internal network support team and Progent's nationwide pool of certified IT service engineers and subject matter experts. Progent's Shared Service Desk provides a transparent supplement to your internal network support organization. User access to the Service Desk, delivery of technical assistance, problem escalation, ticket generation and updates, performance measurement, and management of the service database are consistent whether issues are resolved by your in-house IT support group, by Progent's team, or both. Read more about Progent's outsourced/co-managed Call Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes next generation behavior-based machine learning technology to defend endpoint devices and physical and virtual servers against modern malware assaults like ransomware and file-less exploits, which easily escape traditional signature-based AV tools. Progent ASM services protect local and cloud resources and offers a unified platform to manage the complete malware attack progression including protection, infiltration detection, containment, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows VSS and real-time network-wide immunization against newly discovered threats. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, find and protect data about your network infrastructure, processes, business apps, and services. You can instantly find passwords or serial numbers and be warned automatically about impending expirations of SSL certificates or warranties. By updating and managing your IT documentation, you can eliminate as much as 50% of time wasted searching for critical information about your network. ProSight IT Asset Management includes a common repository for holding and collaborating on all documents related to managing your business network like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT information. Whether you're making enhancements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the data you require as soon as you need it. Read more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of all sizes a flexible and affordable solution for evaluating, testing, scheduling, applying, and documenting updates to your ever-evolving IT system. Besides optimizing the security and functionality of your computer network, Progent's software/firmware update management services allow your in-house IT staff to concentrate on more strategic initiatives and tasks that deliver the highest business value from your information network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected Tier III data center on a high-performance virtual host set up and maintained by Progent's IT support experts. Under the ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the applications. Because the environment is virtualized, it can be moved easily to an alternate hosting environment without a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior machine learning tools to defend physical and virtual endpoint devices against new malware assaults such as ransomware and file-less exploits, which routinely escape legacy signature-based AV tools. ProSight Active Security Monitoring safeguards local and cloud-based resources and provides a single platform to automate the complete threat progression including protection, infiltration detection, mitigation, remediation, and forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services deliver economical multi-layer protection for physical servers and virtual machines, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and responding to cyber assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, endpoint management, and web filtering through cutting-edge technologies incorporated within a single agent accessible from a unified console. Progent's security and virtualization experts can assist you to design and implement a ProSight ESP deployment that addresses your organization's specific requirements and that allows you demonstrate compliance with legal and industry information protection standards. Progent will assist you define and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that require urgent attention. Progent's consultants can also help your company to set up and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange filtering.