24x7x365 São Paulo Emergency Ransomware
Infection Assessment and Remediation Consultants

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become an escalating cyberplague that poses an existential threat for businesses of all sizes poorly prepared for an assault. Versions of crypto-ransomware such as CryptoLocker, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for many years and still inflict damage. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with frequent as yet unnamed viruses, not only encrypt online data but also infiltrate many accessible system protection mechanisms. Information synched to the cloud can also be ransomed. In a poorly architected environment, this can make any restoration hopeless and effectively sets the entire system back to square one.

Getting back on-line applications and data following a ransomware intrusion becomes a sprint against time as the victim struggles to stop lateral movement, eradicate the ransomware, and restore enterprise-critical operations. Due to the fact that crypto-ransomware requires time to replicate, attacks are frequently launched on weekends, when successful attacks typically take more time to identify. This compounds the difficulty of rapidly mobilizing and coordinating a knowledgeable mitigation team.

Progent makes available a range of solutions for securing businesses from ransomware events. These include staff education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of the latest generation security solutions with machine learning technology from SentinelOne to detect and disable day-zero cyber threats rapidly. Progent also can provide the assistance of veteran ransomware recovery engineers with the track record and commitment to restore a compromised environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Following a ransomware invasion, paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will respond with the keys to unencrypt all your information. Kaspersky ascertained that 17% of ransomware victims never restored their data after having paid the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to piece back together the critical parts of your Information Technology environment. Without the availability of complete data backups, this requires a broad range of IT skills, top notch project management, and the ability to work non-stop until the task is done.

For two decades, Progent has offered expert IT services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained high-level industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial systems and ERP application software. This breadth of experience provides Progent the capability to efficiently identify important systems and integrate the surviving components of your IT environment after a crypto-ransomware attack and assemble them into an operational system.

Progent's recovery group deploys state-of-the-art project management tools to orchestrate the sophisticated restoration process. Progent understands the importance of acting quickly and together with a client's management and IT team members to prioritize tasks and to put key systems back online as fast as humanly possible.

Customer Story: A Successful Ransomware Incident Restoration
A client engaged Progent after their company was taken over by the Ryuk crypto-ransomware. Ryuk is believed to have been deployed by Northern Korean state cybercriminals, suspected of adopting techniques exposed from America's NSA organization. Ryuk attacks specific businesses with limited room for operational disruption and is one of the most lucrative iterations of crypto-ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in the Chicago metro area with around 500 employees. The Ryuk attack had shut down all business operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the time of the attack and were destroyed. The client was actively seeking loans for paying the ransom demand (in excess of $200,000) and praying for good luck, but ultimately called Progent.

Progent worked hand in hand the customer to quickly assess and assign priority to the mission critical services that needed to be recovered in order to continue departmental operations:

• Active Directory (AD)
• Email
• Financials/MRP

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-virus state. Progent then helped perform reinstallations and storage recovery of needed systems. All Exchange Server schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to locate intact OST data files (Outlook Off-Line Folder Files) on team desktop computers and laptops in order to recover mail messages. A recent offline backup of the customer's accounting/ERP software made them able to return these vital applications back online. Although significant work remained to recover totally from the Ryuk attack, the most important systems were restored rapidly:

Over the next couple of weeks key milestones in the recovery process were achieved in tight cooperation between Progent engineers and the customer:

• Internal web sites were returned to operation with no loss of information.
• The MailStore Exchange Server exceeding four million historical emails was restored to operations and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory Control capabilities were completely restored.
• A new Palo Alto 850 firewall was brought on-line.
• Nearly all of the desktop computers were being used by staff.

Conclusion
A probable business-killing disaster was evaded due to hard-working professionals, a wide array of knowledge, and close collaboration. Although in hindsight the ransomware incident detailed here could have been identified and blocked with up-to-date cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and properly executed security procedures for information backup and applying software patches, the fact is that government-sponsored hackers from China, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware incursion, feel confident that Progent's roster of professionals has substantial experience in crypto-ransomware virus blocking, cleanup, and data restoration.

To review or download a PDF version of this case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in São Paulo a range of remote monitoring and security assessment services designed to help you to minimize your vulnerability to crypto-ransomware. These services utilize modern AI technology to detect new strains of ransomware that can get past traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve leading-edge network resilience. Progent handles the necessary monitoring and management for you, so your network scales readily without holding you back. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Basic packages include remote monitoring and management (RMM), security, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) technology to help keep your network operating efficiently by checking the state of critical computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your specified IT management staff and your assigned Progent engineering consultant so all looming issues can be resolved before they can disrupt productivity. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for monitoring and managing your client-server infrastructure by providing an environment for performing common tedious tasks. These can include health checking, update management, automated remediation, endpoint configuration, backup and recovery, A/V defense, remote access, built-in and custom scripts, asset inventory, endpoint profile reports, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alert to your specified IT management personnel and your Progent technical consultant so emerging problems can be taken care of before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to map out, track, reconfigure and debug their connectivity hardware like routers and switches, firewalls, and load balancers plus servers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management technology, WAN Watch ensures that network diagrams are kept current, captures and manages the configuration information of almost all devices on your network, monitors performance, and sends alerts when potential issues are discovered. By automating complex management and troubleshooting activities, ProSight WAN Watch can knock hours off ordinary chores such as network mapping, expanding your network, locating appliances that require critical software patches, or identifying the cause of performance problems. Learn more about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of in-depth reporting utilities designed to work with the top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues like spotty support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software providers to produce ProSight Data Protection Services (DPS), a portfolio of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS products manage and track your data backup processes and allow transparent backup and fast recovery of important files/folders, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks such as ransomware, human mistakes, malicious employees, or application bugs. Managed backup services in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of leading data security vendors to provide centralized control and world-class security for your inbound and outbound email. The hybrid architecture of Email Guard managed service integrates a Cloud Protection Layer with a local gateway appliance to provide complete protection against spam, viruses, Dos Attacks, DHAs, and other email-borne threats. Email Guard's cloud filter acts as a preliminary barricade and keeps the vast majority of unwanted email from reaching your network firewall. This decreases your vulnerability to external threats and conserves network bandwidth and storage. Email Guard's onsite gateway device adds a deeper layer of analysis for incoming email. For outgoing email, the onsite security gateway offers AV and anti-spam filtering, DLP, and email encryption. The onsite security gateway can also help Exchange Server to monitor and safeguard internal email traffic that stays inside your security perimeter. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA service plans incorporate Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication (2FA). Duo enables one-tap identity verification with Apple iOS, Android, and other out-of-band devices. Using Duo 2FA, when you sign into a protected application and enter your password you are asked to verify your identity on a device that only you possess and that is accessed using a separate network channel. A wide range of out-of-band devices can be utilized for this second means of authentication such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You may designate several validation devices. To find out more about ProSight Duo two-factor identity validation services, refer to Cisco Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Center: Help Desk Managed Services
  Progent's Help Desk services allow your information technology group to outsource Call Center services to Progent or split activity for support services transparently between your internal network support group and Progent's nationwide roster of IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a transparent supplement to your in-house support team. End user interaction with the Help Desk, delivery of technical assistance, escalation, ticket creation and tracking, performance measurement, and maintenance of the support database are cohesive regardless of whether issues are resolved by your internal network support resources, by Progent's team, or by a combination. Learn more about Progent's outsourced/co-managed Help Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior machine learning tools to defend endpoints and physical and virtual servers against modern malware attacks such as ransomware and email phishing, which easily get by traditional signature-based anti-virus products. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and provides a unified platform to automate the complete malware attack progression including blocking, detection, containment, cleanup, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered attacks. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, find and protect information related to your network infrastructure, procedures, applications, and services. You can quickly find passwords or serial numbers and be alerted about impending expirations of SSL certificates or domains. By cleaning up and managing your network documentation, you can save up to 50% of time wasted searching for critical information about your IT network. ProSight IT Asset Management includes a common location for holding and sharing all documents required for managing your business network such as recommended procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and relating IT data. Whether you're making improvements, performing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the data you require the instant you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of all sizes a versatile and affordable alternative for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your ever-evolving IT network. Besides optimizing the security and reliability of your IT network, Progent's patch management services permit your IT team to focus on more strategic projects and tasks that derive the highest business value from your network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host configured and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the OS platforms, and the apps. Since the system is virtualized, it can be ported immediately to an alternate hosting environment without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoints against modern malware assaults like ransomware and email phishing, which easily get by traditional signature-matching AV products. ProSight Active Security Monitoring safeguards local and cloud resources and provides a single platform to automate the entire threat lifecycle including protection, infiltration detection, containment, remediation, and post-attack forensics. Key features include one-click rollback with Windows VSS and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer economical multi-layer security for physical servers and virtual machines, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and responding to security assaults from all vectors. ProSight ESP offers two-way firewall protection, intrusion alarms, device management, and web filtering via cutting-edge technologies packaged within one agent managed from a unified control. Progent's security and virtualization consultants can help you to design and implement a ProSight ESP deployment that addresses your organization's unique needs and that allows you demonstrate compliance with legal and industry information protection regulations. Progent will help you define and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that require immediate attention. Progent's consultants can also assist you to install and verify a backup and restore system such as ProSight Data Protection Services so you can get back in business rapidly from a destructive security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange email filtering.