24x7 Fort Wayne Emergency Ransomware
Virus Identification and Repair Consulting

Crypto-Ransomware : Your Feared IT Disaster
Ransomware has become an escalating cyber pandemic that represents an existential threat for organizations unprepared for an attack. Different iterations of crypto-ransomware such as CryptoLocker, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for years and continue to cause harm. The latest versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as more unnamed malware, not only encrypt on-line data files but also infect most configured system backup. Information synchronized to off-site disaster recovery sites can also be encrypted. In a vulnerable environment, this can render any restoration useless and basically knocks the entire system back to square one.

Getting back on-line services and information following a crypto-ransomware outage becomes a race against the clock as the targeted organization fights to contain, remove the crypto-ransomware, and resume business-critical activity. Since ransomware needs time to move laterally, assaults are often sprung during weekends and nights, when successful penetrations tend to take more time to uncover. This multiplies the difficulty of promptly marshalling and organizing a capable response team.

Progent provides an assortment of support services for protecting organizations from ransomware attacks. Among these are team member training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of modern security solutions with machine learning capabilities from SentinelOne to detect and suppress day-zero cyber attacks rapidly. Progent also provides the services of expert crypto-ransomware recovery engineers with the track record and commitment to rebuild a breached system as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a ransomware attack, sending the ransom in cryptocurrency does not guarantee that criminal gangs will provide the needed codes to decrypt any of your data. Kaspersky Labs determined that 17% of ransomware victims never restored their files after having paid the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The fallback is to setup from scratch the key parts of your Information Technology environment. Without access to full information backups, this calls for a broad complement of skill sets, professional project management, and the willingness to work 24x7 until the job is over.

For two decades, Progent has made available certified expert Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded advanced industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial management and ERP application software. This breadth of experience gives Progent the ability to knowledgably determine important systems and consolidate the surviving pieces of your network system after a crypto-ransomware penetration and rebuild them into a functioning system.

Progent's ransomware group utilizes best of breed project management systems to orchestrate the complex recovery process. Progent understands the importance of acting swiftly and in concert with a client's management and Information Technology resources to prioritize tasks and to put the most important services back online as soon as humanly possible.

Business Case Study: A Successful Ransomware Penetration Recovery
A small business hired Progent after their organization was taken over by Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean state sponsored hackers, suspected of using strategies exposed from the U.S. National Security Agency. Ryuk attacks specific organizations with limited room for operational disruption and is among the most lucrative examples of ransomware viruses. Headline victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing business headquartered in the Chicago metro area with about 500 staff members. The Ryuk event had paralyzed all business operations and manufacturing capabilities. The majority of the client's data backups had been on-line at the start of the attack and were destroyed. The client was actively seeking loans for paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for the best, but ultimately utilized Progent.

Progent worked together with the customer to rapidly determine and assign priority to the most important systems that needed to be addressed in order to continue company functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Accounting/MRP

In less than 2 days, Progent was able to restore Windows Active Directory to its pre-penetration state. Progent then accomplished rebuilding and storage recovery of the most important servers. All Exchange data and attributes were usable, which facilitated the restore of Exchange. Progent was also able to locate non-encrypted OST files (Microsoft Outlook Offline Folder Files) on user PCs to recover mail messages. A not too old off-line backup of the client's manufacturing software made it possible to recover these essential services back online for users. Although a large amount of work still had to be done to recover fully from the Ryuk event, critical services were recovered rapidly:

Throughout the following few weeks key milestones in the restoration project were achieved through close collaboration between Progent consultants and the client:

• Self-hosted web sites were restored with no loss of data.
• The MailStore Server with over four million archived emails was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control capabilities were fully recovered.
• A new Palo Alto 850 firewall was set up and programmed.
• 90% of the desktop computers were operational.

Conclusion
A probable enterprise-killing catastrophe was evaded with hard-working experts, a wide array of subject matter expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware penetration detailed here could have been disabled with advanced security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team training, and well designed incident response procedures for data backup and applying software patches, the fact is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incident, remember that Progent's roster of experts has substantial experience in crypto-ransomware virus defense, mitigation, and data recovery.

To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Fort Wayne a portfolio of online monitoring and security assessment services designed to help you to reduce the threat from crypto-ransomware. These services utilize modern artificial intelligence technology to uncover zero-day strains of ransomware that are able to evade legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve advanced IT resilience. Progent handles the necessary monitoring and management for you, so your system expands readily without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Basic plans include remote monitoring and management (RMM), security, monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management technology to keep your network operating efficiently by checking the state of critical assets that power your business network. When ProSight LAN Watch uncovers a problem, an alarm is transmitted automatically to your specified IT management personnel and your Progent engineering consultant so any looming problems can be resolved before they can impact productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based solution for managing your client-server infrastructure by providing an environment for streamlining common time-consuming tasks. These include health checking, update management, automated remediation, endpoint configuration, backup and recovery, anti-virus protection, remote access, standard and custom scripts, resource inventory, endpoint status reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your specified IT management personnel and your assigned Progent consultant so potential problems can be taken care of before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for small and mid-sized businesses to map out, monitor, optimize and debug their connectivity hardware such as routers, firewalls, and wireless controllers as well as servers, printers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are kept updated, copies and displays the configuration information of virtually all devices on your network, monitors performance, and sends notices when potential issues are discovered. By automating tedious management activities, WAN Watch can knock hours off ordinary tasks like making network diagrams, reconfiguring your network, finding devices that require critical updates, or identifying the cause of performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of real-time reporting tools created to work with the industry's top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues like inconsistent support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore software providers to produce ProSight Data Protection Services (DPS), a selection of subscription-based offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and track your data backup operations and enable non-disruptive backup and rapid recovery of critical files/folders, applications, images, and virtual machines. ProSight DPS lets your business recover from data loss caused by hardware failures, natural disasters, fire, malware like ransomware, user error, ill-intentioned insiders, or software glitches. Managed services in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent consultant can help you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of leading information security vendors to provide web-based management and world-class protection for your email traffic. The powerful structure of Progent's Email Guard combines cloud-based filtering with an on-premises gateway device to provide advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's cloud filter serves as a preliminary barricade and keeps the vast majority of unwanted email from reaching your security perimeter. This decreases your exposure to external threats and saves system bandwidth and storage. Email Guard's onsite security gateway appliance adds a deeper layer of inspection for inbound email. For outbound email, the on-premises gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also help Exchange Server to monitor and protect internal email traffic that stays inside your corporate firewall. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication (2FA). Duo supports single-tap identity confirmation on Apple iOS, Google Android, and other personal devices. With 2FA, when you sign into a secured online account and enter your password you are asked to confirm your identity via a device that only you possess and that uses a different ("out-of-band") network channel. A wide range of devices can be used for this second means of authentication including an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You may designate several validation devices. To find out more about ProSight Duo identity validation services, go to Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Call Desk: Call Center Managed Services
  Progent's Support Center managed services permit your IT group to offload Help Desk services to Progent or divide activity for support services seamlessly between your internal network support group and Progent's extensive roster of IT support engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a transparent supplement to your core support staff. Client interaction with the Service Desk, provision of support services, problem escalation, trouble ticket creation and updates, efficiency measurement, and maintenance of the support database are consistent whether issues are taken care of by your in-house network support resources, by Progent's team, or by a combination. Learn more about Progent's outsourced/co-managed Service Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior-based machine learning tools to guard endpoint devices and servers and VMs against new malware assaults like ransomware and email phishing, which easily escape traditional signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and provides a single platform to address the complete malware attack progression including blocking, detection, containment, remediation, and forensics. Top features include single-click rollback with Windows VSS and real-time system-wide immunization against new attacks. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, update, retrieve and protect information about your IT infrastructure, procedures, business apps, and services. You can instantly find passwords or IP addresses and be alerted automatically about upcoming expirations of SSLs ,domains or warranties. By updating and organizing your network documentation, you can save up to half of time thrown away trying to find vital information about your IT network. ProSight IT Asset Management includes a centralized repository for storing and collaborating on all documents related to managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT information. Whether you're making improvements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the information you require the instant you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer businesses of all sizes a versatile and affordable alternative for assessing, validating, scheduling, applying, and documenting software and firmware updates to your ever-evolving IT system. Besides optimizing the protection and reliability of your computer environment, Progent's patch management services permit your in-house IT team to concentrate on more strategic projects and tasks that derive maximum business value from your network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a protected Tier III data center on a fast virtual machine host configured and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the OS software, and the apps. Because the system is virtualized, it can be moved easily to a different hosting environment without a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior-based machine learning technology to guard physical and virtual endpoints against modern malware assaults such as ransomware and file-less exploits, which easily evade legacy signature-matching AV tools. ProSight ASM protects local and cloud-based resources and offers a unified platform to automate the entire threat lifecycle including filtering, identification, mitigation, cleanup, and post-attack forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection managed services offer economical multi-layer security for physical and virtual servers, workstations, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced machine learning for round-the-clock monitoring and responding to security threats from all vectors. ProSight ESP provides two-way firewall protection, penetration alarms, device control, and web filtering through cutting-edge tools packaged within one agent accessible from a unified control. Progent's security and virtualization consultants can assist your business to design and configure a ProSight ESP environment that meets your organization's specific requirements and that allows you demonstrate compliance with legal and industry information security regulations. Progent will assist you define and implement policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that call for urgent attention. Progent's consultants can also assist you to set up and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.