Salinas 24/7/365 Critical Crypto
Malware Damage Assessment and Removal Help

Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become a modern cyberplague that presents an enterprise-level danger for businesses vulnerable to an attack. Multiple generations of ransomware such as Dharma, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for many years and still cause destruction. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, along with more as yet unnamed newcomers, not only do encryption of online data but also infiltrate any accessible system backup. Information replicated to cloud environments can also be corrupted. In a poorly architected system, it can make automatic restore operations hopeless and effectively knocks the entire system back to square one.

Retrieving services and data following a ransomware event becomes a sprint against the clock as the victim tries its best to stop lateral movement, remove the crypto-ransomware, and restore mission-critical activity. Since crypto-ransomware requires time to spread, attacks are frequently sprung on weekends and holidays, when penetrations typically take more time to recognize. This compounds the difficulty of promptly marshalling and orchestrating a capable mitigation team.

Progent has a range of support services for securing organizations from crypto-ransomware attacks. These include user training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of next-generation security appliances with AI capabilities from SentinelOne to discover and disable new cyber threats automatically. Progent also can provide the services of expert ransomware recovery consultants with the track record and perseverance to reconstruct a compromised network as soon as possible.

Progent's Ransomware Recovery Support Services
Soon after a crypto-ransomware attack, paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will return the keys to unencrypt any or all of your data. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their files even after having paid the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The fallback is to piece back together the essential components of your IT environment. Absent access to complete data backups, this calls for a broad range of IT skills, well-coordinated project management, and the willingness to work non-stop until the recovery project is complete.

For two decades, Progent has offered professional Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial systems and ERP application software. This breadth of experience gives Progent the ability to rapidly determine necessary systems and organize the surviving pieces of your computer network system following a ransomware event and assemble them into an operational network.

Progent's ransomware team utilizes state-of-the-art project management systems to orchestrate the complicated restoration process. Progent knows the importance of acting quickly and in concert with a customer's management and IT resources to assign priority to tasks and to get critical applications back on-line as fast as humanly possible.

Case Study: A Successful Ransomware Incident Response
A customer escalated to Progent after their network was attacked by Ryuk ransomware. Ryuk is generally considered to have been created by Northern Korean state criminal gangs, suspected of using algorithms exposed from the United States NSA organization. Ryuk targets specific organizations with little ability to sustain operational disruption and is among the most profitable examples of ransomware malware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturer based in Chicago with about 500 workers. The Ryuk intrusion had frozen all essential operations and manufacturing capabilities. The majority of the client's backups had been online at the beginning of the attack and were encrypted. The client was pursuing financing for paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but in the end reached out to Progent.

Progent worked with the client to quickly get our arms around and assign priority to the mission critical elements that had to be addressed to make it possible to continue company functions:

• Active Directory
• Microsoft Exchange
• MRP System

In less than two days, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then charged ahead with setup and hard drive recovery on critical servers. All Exchange Server ties and attributes were usable, which facilitated the restore of Exchange. Progent was able to locate intact OST files (Outlook Off-Line Data Files) on various workstations to recover email information. A not too old offline backup of the customer's accounting/ERP systems made them able to return these essential applications back servicing users. Although significant work was left to recover fully from the Ryuk virus, critical systems were returned to operations quickly:

Over the following few weeks critical milestones in the recovery project were made in tight cooperation between Progent engineers and the customer:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server exceeding four million historical messages was brought on-line and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control modules were completely functional.
• A new Palo Alto Networks 850 security appliance was brought online.
• 90% of the user PCs were operational.

Conclusion
A possible business disaster was evaded through the efforts of dedicated experts, a broad array of IT skills, and close teamwork. Although in retrospect the crypto-ransomware attack described here could have been disabled with current cyber security systems and recognized best practices, user training, and well designed incident response procedures for data backup and proper patching controls, the fact is that government-sponsored cybercriminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's roster of professionals has proven experience in ransomware virus defense, cleanup, and data disaster recovery.

To review or download a PDF version of this customer case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Salinas a variety of online monitoring and security evaluation services to assist you to reduce your vulnerability to ransomware. These services include next-generation artificial intelligence technology to detect new variants of ransomware that are able to evade traditional signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to achieve advanced network resilience. Progent handles the necessary monitoring and management for you, so your network expands smoothly without holding you back. For a low and predictable monthly price, Progent's full-service IT group can be your complete technology safety net. Basic packages include remote monitoring and management, cybersecurity, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management technology to keep your IT system running at peak levels by checking the state of vital assets that drive your business network. When ProSight LAN Watch detects a problem, an alert is transmitted automatically to your specified IT personnel and your Progent engineering consultant so that any potential problems can be resolved before they have a chance to disrupt your network. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for managing your client-server infrastructure by offering an environment for performing common tedious tasks. These include health monitoring, update management, automated remediation, endpoint configuration, backup and restore, A/V response, remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alarm to your designated IT management staff and your assigned Progent consultant so emerging problems can be fixed before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized organizations to diagram, monitor, enhance and troubleshoot their connectivity appliances like routers and switches, firewalls, and wireless controllers plus servers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network diagrams are always updated, captures and displays the configuration information of almost all devices on your network, monitors performance, and sends notices when problems are discovered. By automating time-consuming management and troubleshooting processes, WAN Watch can knock hours off common chores such as network mapping, reconfiguring your network, locating appliances that require critical software patches, or identifying the cause of performance bottlenecks. Find out more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of in-depth reporting plug-ins created to integrate with the leading ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize key issues like inconsistent support follow-through or endpoints with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore software providers to produce ProSight Data Protection Services (DPS), a selection of offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and monitor your backup operations and enable non-disruptive backup and fast restoration of critical files, applications, system images, and VMs. ProSight DPS lets your business protect against data loss caused by hardware breakdown, natural calamities, fire, malware such as ransomware, human mistakes, ill-intentioned employees, or application glitches. Managed services in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to identify which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of leading data security vendors to provide centralized management and world-class security for all your inbound and outbound email. The powerful structure of Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway appliance to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's Cloud Protection Layer acts as a first line of defense and blocks the vast majority of threats from reaching your security perimeter. This decreases your exposure to inbound threats and conserves network bandwidth and storage. Email Guard's onsite gateway appliance adds a further layer of inspection for inbound email. For outgoing email, the local security gateway provides AV and anti-spam filtering, protection against data leaks, and email encryption. The local gateway can also assist Exchange Server to track and protect internal email that stays within your security perimeter. For more information, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo technology to defend against password theft through the use of two-factor authentication. Duo supports single-tap identity confirmation on Apple iOS, Android, and other personal devices. Using 2FA, when you log into a secured application and give your password you are asked to verify who you are on a device that only you have and that uses a different ("out-of-band") network channel. A broad range of out-of-band devices can be utilized for this second form of ID validation such as a smartphone or wearable, a hardware token, a landline telephone, etc. You may designate multiple verification devices. For more information about Duo two-factor identity validation services, visit Cisco Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Service Center: Call Center Managed Services
  Progent's Help Center services permit your information technology staff to outsource Help Desk services to Progent or split activity for support services transparently between your internal support staff and Progent's extensive roster of certified IT support technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a seamless extension of your internal network support staff. User access to the Help Desk, provision of support services, issue escalation, ticket creation and updates, performance metrics, and maintenance of the support database are consistent regardless of whether issues are resolved by your core network support staff, by Progent's team, or by a combination. Learn more about Progent's outsourced/shared Help Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes next generation behavior-based machine learning technology to defend endpoint devices as well as servers and VMs against modern malware assaults like ransomware and email phishing, which easily evade traditional signature-based anti-virus tools. Progent Active Security Monitoring services protect on-premises and cloud resources and provides a unified platform to manage the entire threat lifecycle including blocking, identification, containment, remediation, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against new threats. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, retrieve and safeguard data related to your IT infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be warned automatically about impending expirations of SSL certificates or domains. By updating and organizing your IT infrastructure documentation, you can save up to 50% of time wasted trying to find critical information about your network. ProSight IT Asset Management includes a centralized repository for storing and sharing all documents required for managing your network infrastructure like standard operating procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT data. Whether you're planning improvements, performing maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you require as soon as you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management offer organizations of any size a flexible and cost-effective solution for assessing, testing, scheduling, implementing, and tracking software and firmware updates to your dynamic information network. In addition to maximizing the security and functionality of your computer network, Progent's patch management services permit your in-house IT team to concentrate on line-of-business initiatives and activities that derive the highest business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a secure fault tolerant data center on a high-performance virtual host configured and managed by Progent's network support experts. With the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the applications. Since the system is virtualized, it can be ported easily to an alternate hosting environment without requiring a lengthy and difficult configuration process. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoints against modern malware attacks like ransomware and email phishing, which routinely get by legacy signature-based anti-virus tools. ProSight Active Security Monitoring safeguards local and cloud resources and provides a unified platform to address the entire malware attack progression including protection, detection, containment, cleanup, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver affordable in-depth security for physical servers and VMs, desktops, smartphones, and Exchange email. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and responding to cyber threats from all vectors. ProSight ESP offers firewall protection, intrusion alarms, endpoint control, and web filtering via leading-edge technologies packaged within one agent managed from a unified console. Progent's data protection and virtualization experts can help you to plan and implement a ProSight ESP environment that meets your organization's unique needs and that helps you demonstrate compliance with government and industry data protection standards. Progent will assist you define and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for immediate action. Progent's consultants can also help your company to set up and test a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.