Houston 24-Hour Urgent Crypto
Computer Malware Detection and Restoration Consultants

Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become an escalating cyber pandemic that represents an existential threat for businesses of all sizes unprepared for an assault. Versions of ransomware such as Reveton, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for a long time and still cause havoc. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, along with more unnamed newcomers, not only do encryption of on-line information but also infect any available system restores and backups. Data replicated to the cloud can also be ransomed. In a poorly designed system, this can render any restore operations impossible and basically knocks the datacenter back to square one.

Restoring services and data following a ransomware event becomes a race against the clock as the victim struggles to contain the damage, clear the virus, and restore enterprise-critical activity. Due to the fact that ransomware takes time to move laterally, attacks are often sprung on weekends and holidays, when successful attacks are likely to take more time to identify. This compounds the difficulty of quickly marshalling and orchestrating a qualified response team.

Progent makes available an assortment of solutions for protecting organizations from ransomware attacks. These include team training to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of modern security solutions with artificial intelligence technology from SentinelOne to identify and quarantine zero-day cyber threats rapidly. Progent in addition offers the services of veteran crypto-ransomware recovery professionals with the skills and commitment to reconstruct a compromised network as urgently as possible.

Progent's Ransomware Recovery Help
Soon after a crypto-ransomware event, even paying the ransom in cryptocurrency does not ensure that merciless criminals will respond with the keys to decipher any or all of your files. Kaspersky Labs determined that 17% of ransomware victims never restored their files even after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to re-install the key components of your Information Technology environment. Without the availability of essential data backups, this calls for a wide range of skill sets, well-coordinated team management, and the willingness to work non-stop until the task is over.

For two decades, Progent has provided expert IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained top industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of expertise provides Progent the skills to rapidly identify critical systems and re-organize the remaining parts of your computer network environment following a ransomware event and assemble them into an operational network.

Progent's security team of experts uses state-of-the-art project management systems to coordinate the complex recovery process. Progent appreciates the importance of working quickly and in concert with a client's management and IT resources to assign priority to tasks and to get key applications back on line as soon as humanly possible.

Case Study: A Successful Ransomware Intrusion Restoration
A client sought out Progent after their network was brought down by Ryuk crypto-ransomware. Ryuk is generally considered to have been created by Northern Korean state sponsored cybercriminals, possibly adopting technology exposed from the United States National Security Agency. Ryuk targets specific organizations with limited ability to sustain operational disruption and is among the most profitable incarnations of crypto-ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer located in Chicago with about 500 employees. The Ryuk intrusion had frozen all essential operations and manufacturing processes. Most of the client's data backups had been on-line at the start of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom (more than $200,000) and praying for good luck, but ultimately called Progent.

Progent worked hand in hand the client to quickly understand and assign priority to the most important services that had to be restored in order to resume company operations:

• Active Directory
• Microsoft Exchange
• MRP System

Within 2 days, Progent was able to rebuild Active Directory to its pre-intrusion state. Progent then helped perform rebuilding and storage recovery on the most important applications. All Exchange Server ties and configuration information were intact, which accelerated the restore of Exchange. Progent was able to find local OST data files (Outlook Off-Line Folder Files) on various workstations and laptops to recover mail information. A recent offline backup of the businesses financials/ERP systems made them able to return these required programs back available to users. Although major work remained to recover totally from the Ryuk virus, core systems were restored quickly:

During the next couple of weeks important milestones in the restoration process were accomplished in tight collaboration between Progent team members and the client:

• Self-hosted web sites were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server with over four million archived messages was brought online and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control functions were fully recovered.
• A new Palo Alto 850 firewall was set up.
• Ninety percent of the user PCs were being used by staff.

Conclusion
A potential enterprise-killing catastrophe was averted through the efforts of results-oriented experts, a wide spectrum of subject matter expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration detailed here could have been identified and prevented with current security technology solutions and recognized best practices, team education, and well designed incident response procedures for information backup and applying software patches, the reality is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's roster of experts has substantial experience in ransomware virus defense, remediation, and data recovery.

To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Houston a variety of remote monitoring and security evaluation services to assist you to reduce your vulnerability to crypto-ransomware. These services utilize next-generation AI capability to detect zero-day strains of ransomware that can escape detection by legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve leading-edge network resilience. Progent takes care of the necessary monitoring and management for you, so your system expands readily without holding you back. For an affordable and predictable monthly price, Progent's experienced IT team can be your complete technology safety net. Basic packages include remote monitoring and management (RMM), security, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management techniques to help keep your network running efficiently by checking the health of critical assets that power your business network. When ProSight LAN Watch uncovers an issue, an alert is transmitted automatically to your specified IT management staff and your Progent consultant so that all looming issues can be resolved before they can impact productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for monitoring and managing your network, server, and desktop devices by providing an environment for performing common tedious jobs. These include health monitoring, patch management, automated remediation, endpoint deployment, backup and restore, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alarm to your specified IT management staff and your assigned Progent consultant so potential problems can be fixed before they interfere with your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for small and mid-sized businesses to diagram, monitor, optimize and troubleshoot their networking appliances like routers, firewalls, and wireless controllers as well as servers, client computers and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that infrastructure topology diagrams are always updated, copies and displays the configuration of virtually all devices connected to your network, tracks performance, and sends alerts when problems are detected. By automating complex management activities, WAN Watch can cut hours off ordinary tasks such as network mapping, expanding your network, finding devices that need important software patches, or isolating performance problems. Find out more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time management reporting utilities designed to integrate with the industry's leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues such as spotty support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore technology providers to produce ProSight Data Protection Services, a portfolio of offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and track your backup operations and allow transparent backup and fast recovery of vital files/folders, apps, system images, and virtual machines. ProSight DPS lets you recover from data loss resulting from hardware breakdown, natural disasters, fire, malware such as ransomware, user error, ill-intentioned employees, or application glitches. Managed services available in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can help you to identify which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top data security companies to provide centralized control and comprehensive protection for your inbound and outbound email. The hybrid structure of Email Guard combines cloud-based filtering with a local security gateway appliance to provide advanced protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The Cloud Protection Layer serves as a first line of defense and blocks most threats from reaching your security perimeter. This reduces your vulnerability to external threats and conserves system bandwidth and storage space. Email Guard's onsite security gateway appliance adds a deeper layer of inspection for incoming email. For outgoing email, the on-premises security gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The on-premises gateway can also help Exchange Server to monitor and safeguard internal email traffic that stays inside your security perimeter. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a protected application and enter your password you are asked to confirm who you are via a device that only you have and that uses a different network channel. A wide range of devices can be utilized for this second means of authentication including a smartphone or wearable, a hardware token, a landline telephone, etc. You may register several verification devices. To learn more about ProSight Duo two-factor identity authentication services, refer to Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Center: Call Center Managed Services
  Progent's Support Center managed services enable your information technology group to offload Help Desk services to Progent or divide responsibilities for Help Desk services seamlessly between your in-house network support resources and Progent's nationwide roster of IT support engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a seamless extension of your core support staff. User interaction with the Help Desk, delivery of support services, problem escalation, ticket creation and updates, performance measurement, and management of the service database are cohesive regardless of whether issues are taken care of by your corporate support organization, by Progent's team, or both. Find out more about Progent's outsourced/shared Help Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior-based analysis technology to guard endpoint devices and servers and VMs against new malware attacks like ransomware and file-less exploits, which easily evade traditional signature-matching anti-virus products. Progent ASM services safeguard local and cloud-based resources and offers a unified platform to address the entire threat lifecycle including protection, infiltration detection, containment, remediation, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, find and safeguard information about your IT infrastructure, procedures, business apps, and services. You can quickly locate passwords or serial numbers and be alerted about upcoming expirations of SSL certificates or domains. By cleaning up and managing your IT documentation, you can eliminate up to 50% of time wasted looking for critical information about your IT network. ProSight IT Asset Management features a common location for holding and collaborating on all documents related to managing your business network such as standard operating procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT data. Whether you're planning enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you require the instant you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management offer businesses of all sizes a versatile and affordable solution for evaluating, testing, scheduling, implementing, and documenting software and firmware updates to your dynamic information system. In addition to optimizing the protection and functionality of your IT environment, Progent's patch management services permit your in-house IT team to concentrate on more strategic initiatives and tasks that deliver maximum business value from your information network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual machine host set up and managed by Progent's IT support experts. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be moved easily to an alternate hosting solution without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior analysis technology to guard physical and virtual endpoint devices against new malware assaults such as ransomware and file-less exploits, which routinely evade traditional signature-matching anti-virus tools. ProSight ASM protects on-premises and cloud-based resources and provides a unified platform to manage the complete malware attack lifecycle including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer affordable in-depth security for physical servers and virtual machines, workstations, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and reacting to security threats from all attack vectors. ProSight ESP provides firewall protection, penetration alerts, device management, and web filtering through cutting-edge technologies incorporated within one agent accessible from a single control. Progent's data protection and virtualization experts can assist you to plan and configure a ProSight ESP deployment that addresses your company's specific requirements and that allows you demonstrate compliance with government and industry information protection standards. Progent will assist you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require urgent attention. Progent's consultants can also help you to install and verify a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business rapidly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange email filtering.