24/7 Mission Viejo Critical Crypto-Ransomware
Malware Damage Assessment and Remediation Support

Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become a too-frequent cyberplague that presents an enterprise-level danger for businesses vulnerable to an attack. Versions of crypto-ransomware like the CrySIS, Fusob, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and still cause damage. Recent strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with frequent unnamed malware, not only do encryption of online data but also infiltrate all available system protection mechanisms. Information replicated to the cloud can also be encrypted. In a vulnerable data protection solution, it can render automated restore operations useless and effectively knocks the datacenter back to zero.

Retrieving services and information after a ransomware intrusion becomes a race against the clock as the victim fights to contain, eradicate the crypto-ransomware, and resume business-critical operations. Because ransomware takes time to move laterally, assaults are frequently launched at night, when successful penetrations in many cases take longer to recognize. This multiplies the difficulty of rapidly mobilizing and orchestrating an experienced mitigation team.

Progent makes available an assortment of help services for securing businesses from crypto-ransomware events. Among these are user education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of the latest generation security appliances with artificial intelligence technology from SentinelOne to detect and quarantine zero-day threats automatically. Progent in addition provides the services of seasoned ransomware recovery engineers with the talent and commitment to reconstruct a breached environment as soon as possible.

Progent's Ransomware Restoration Help
Following a ransomware invasion, even paying the ransom demands in cryptocurrency does not ensure that merciless criminals will provide the needed codes to unencrypt any of your data. Kaspersky Labs estimated that seventeen percent of ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The fallback is to re-install the essential components of your Information Technology environment. Without access to complete data backups, this requires a wide range of IT skills, well-coordinated project management, and the ability to work continuously until the job is complete.

For two decades, Progent has provided expert IT services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned advanced industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have garnered internationally-recognized certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of expertise provides Progent the capability to rapidly ascertain critical systems and integrate the remaining pieces of your IT environment after a ransomware attack and rebuild them into a functioning system.

Progent's security group utilizes powerful project management systems to coordinate the complex restoration process. Progent knows the urgency of working quickly and together with a customer's management and IT team members to prioritize tasks and to get essential services back on line as soon as humanly possible.

Customer Case Study: A Successful Crypto-Ransomware Penetration Recovery
A client engaged Progent after their network system was taken over by the Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state hackers, suspected of adopting technology leaked from America's National Security Agency. Ryuk targets specific companies with little or no tolerance for operational disruption and is one of the most lucrative incarnations of crypto-ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company located in the Chicago metro area with around 500 workers. The Ryuk intrusion had disabled all business operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the start of the attack and were destroyed. The client considered paying the ransom (more than $200K) and wishfully thinking for good luck, but ultimately reached out to Progent.

Progent worked with the customer to rapidly get our arms around and prioritize the key services that needed to be restored in order to restart business functions:

• Active Directory (AD)
• Microsoft Exchange Email
• Financials/MRP

Within 2 days, Progent was able to recover Active Directory services to its pre-virus state. Progent then helped perform reinstallations and storage recovery on needed servers. All Microsoft Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to locate local OST data files (Outlook Offline Data Files) on team PCs to recover email data. A not too old off-line backup of the businesses financials/MRP systems made them able to recover these essential services back online for users. Although major work remained to recover totally from the Ryuk virus, core services were returned to operations rapidly:

Throughout the next couple of weeks key milestones in the recovery project were completed in close cooperation between Progent team members and the customer:

• Internal web sites were brought back up without losing any information.
• The MailStore Server exceeding four million historical emails was restored to operations and available for users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory modules were completely restored.
• A new Palo Alto 850 firewall was set up and programmed.
• Most of the desktops and laptops were functioning as before the incident.

Conclusion
A potential business extinction catastrophe was evaded with top-tier experts, a broad spectrum of knowledge, and close teamwork. Although upon completion of forensics the crypto-ransomware penetration detailed here would have been identified and disabled with up-to-date cyber security technology solutions and recognized best practices, staff training, and well thought out security procedures for data backup and keeping systems up to date with security patches, the fact is that government-sponsored cybercriminals from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware attack, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, remediation, and file recovery.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers companies in Mission Viejo a range of online monitoring and security evaluation services designed to assist you to reduce the threat from crypto-ransomware. These services incorporate modern artificial intelligence technology to uncover zero-day strains of ransomware that are able to evade legacy signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve leading-edge IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your network scales readily without holding you back. For an affordable and predictable monthly price, Progent's full-service IT group can be your dependable technology safety net. Basic packages include remote monitoring and management (RMM), cybersecurity, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management (RMM) techniques to keep your network operating at peak levels by checking the health of critical computers that power your business network. When ProSight LAN Watch uncovers a problem, an alert is transmitted immediately to your specified IT management staff and your Progent consultant so all potential problems can be addressed before they can disrupt your network. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for managing your client-server infrastructure by offering an environment for performing common tedious jobs. These include health monitoring, update management, automated remediation, endpoint setup, backup and recovery, anti-virus defense, secure remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it transmits an alert to your designated IT management personnel and your assigned Progent technical consultant so potential problems can be fixed before they interfere with productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized organizations to map out, track, enhance and troubleshoot their networking hardware such as switches, firewalls, and load balancers plus servers, printers, endpoints and other networked devices. Incorporating state-of-the-art RMM technology, ProSight WAN Watch ensures that infrastructure topology maps are kept current, captures and displays the configuration information of almost all devices connected to your network, monitors performance, and generates alerts when problems are discovered. By automating complex network management processes, WAN Watch can cut hours off ordinary tasks such as network mapping, reconfiguring your network, finding appliances that require critical updates, or isolating performance problems. Learn more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time and in-depth reporting tools designed to work with the industry's leading ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues like inconsistent support follow-up or endpoints with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with leading backup technology companies to create ProSight Data Protection Services (DPS), a portfolio of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS products manage and track your data backup processes and enable non-disruptive backup and rapid restoration of critical files, apps, system images, plus virtual machines. ProSight DPS helps your business avoid data loss caused by equipment failures, natural calamities, fire, cyber attacks like ransomware, human mistakes, malicious employees, or software bugs. Managed backup services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of leading data security vendors to provide web-based control and comprehensive security for all your email traffic. The powerful structure of Email Guard integrates a Cloud Protection Layer with an on-premises gateway device to offer advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's Cloud Protection Layer serves as a preliminary barricade and blocks the vast majority of unwanted email from making it to your network firewall. This reduces your exposure to external attacks and saves system bandwidth and storage space. Email Guard's onsite security gateway device provides a further layer of analysis for incoming email. For outbound email, the onsite gateway offers AV and anti-spam protection, DLP, and email encryption. The onsite security gateway can also help Exchange Server to track and protect internal email traffic that stays inside your corporate firewall. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication. Duo enables single-tap identity verification with Apple iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you sign into a protected online account and give your password you are requested to verify your identity on a unit that only you have and that is accessed using a different network channel. A wide selection of devices can be used for this second form of ID validation such as a smartphone or watch, a hardware/software token, a landline telephone, etc. You can register several verification devices. For details about ProSight Duo two-factor identity validation services, see Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Call Desk managed services permit your IT staff to offload Support Desk services to Progent or split activity for Help Desk services seamlessly between your internal support group and Progent's nationwide pool of certified IT service technicians, engineers and subject matter experts. Progent's Co-managed Service Desk offers a seamless extension of your in-house IT support group. User access to the Service Desk, delivery of support, escalation, ticket creation and tracking, efficiency measurement, and maintenance of the support database are consistent regardless of whether incidents are resolved by your core network support resources, by Progent's team, or both. Read more about Progent's outsourced/shared Service Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior-based analysis tools to guard endpoints and physical and virtual servers against new malware attacks such as ransomware and email phishing, which easily escape traditional signature-based AV products. Progent ASM services protect on-premises and cloud resources and provides a single platform to automate the complete threat progression including filtering, identification, containment, cleanup, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, retrieve and protect information about your network infrastructure, processes, applications, and services. You can quickly locate passwords or serial numbers and be warned about upcoming expirations of SSLs or domains. By updating and managing your network documentation, you can eliminate up to half of time wasted looking for critical information about your network. ProSight IT Asset Management features a common location for holding and collaborating on all documents related to managing your business network like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT information. Whether you're making improvements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a flexible and cost-effective alternative for evaluating, validating, scheduling, implementing, and documenting updates to your dynamic information system. In addition to optimizing the security and reliability of your computer environment, Progent's patch management services allow your IT staff to concentrate on line-of-business projects and tasks that deliver maximum business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be moved immediately to a different hosting solution without requiring a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior analysis tools to guard physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which routinely get by traditional signature-matching anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a single platform to automate the entire malware attack progression including filtering, identification, containment, cleanup, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable in-depth security for physical and virtual servers, desktops, mobile devices, and Exchange email. ProSight ESP uses contextual security and modern behavior analysis for continuously monitoring and responding to cyber assaults from all vectors. ProSight ESP provides two-way firewall protection, penetration alarms, device control, and web filtering through cutting-edge tools packaged within one agent accessible from a single console. Progent's data protection and virtualization consultants can assist you to plan and implement a ProSight ESP deployment that addresses your company's specific needs and that allows you prove compliance with legal and industry information security regulations. Progent will assist you define and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that require immediate action. Progent's consultants can also help you to install and test a backup and restore system like ProSight Data Protection Services so you can get back in business quickly from a destructive cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange filtering.