Melbourne 24x7x365 Emergency Crypto-Ransomware
Computer Malware Detection and Remediation Support

Ransomware : Your Feared Information Technology Disaster
Ransomware has become an escalating cyber pandemic that represents an existential danger for businesses poorly prepared for an attack. Different iterations of ransomware like the Dharma, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for many years and still cause harm. Recent versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, as well as additional as yet unnamed newcomers, not only do encryption of on-line information but also infiltrate any configured system restores and backups. Files synchronized to the cloud can also be corrupted. In a poorly architected data protection solution, it can render automated restore operations impossible and effectively knocks the entire system back to square one.

Restoring applications and data following a crypto-ransomware event becomes a sprint against time as the targeted organization fights to stop the spread, remove the virus, and restore business-critical operations. Since crypto-ransomware requires time to move laterally, penetrations are usually launched during nights and weekends, when successful penetrations typically take more time to uncover. This compounds the difficulty of promptly mobilizing and organizing a qualified response team.

Progent has an assortment of solutions for protecting organizations from ransomware penetrations. Among these are team member education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of next-generation security gateways with machine learning capabilities from SentinelOne to detect and suppress new cyber threats quickly. Progent also offers the services of expert ransomware recovery consultants with the track record and perseverance to re-deploy a compromised network as soon as possible.

Progent's Ransomware Recovery Support Services
After a ransomware event, sending the ransom in cryptocurrency does not ensure that cyber hackers will respond with the needed codes to unencrypt all your data. Kaspersky ascertained that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The other path is to setup from scratch the mission-critical parts of your Information Technology environment. Absent access to full system backups, this requires a broad complement of skill sets, top notch team management, and the capability to work continuously until the job is complete.

For twenty years, Progent has made available certified expert IT services for businesses across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in accounting and ERP application software. This breadth of experience provides Progent the skills to rapidly ascertain critical systems and organize the remaining components of your computer network system following a crypto-ransomware attack and configure them into an operational system.

Progent's ransomware team of experts deploys best of breed project management systems to orchestrate the complicated restoration process. Progent understands the urgency of working quickly and in unison with a customer's management and Information Technology team members to assign priority to tasks and to get essential systems back on-line as soon as possible.

Client Case Study: A Successful Ransomware Intrusion Restoration
A client contacted Progent after their organization was crashed by the Ryuk ransomware. Ryuk is believed to have been launched by Northern Korean government sponsored cybercriminals, possibly adopting algorithms exposed from the United States NSA organization. Ryuk seeks specific companies with little ability to sustain operational disruption and is among the most profitable iterations of crypto-ransomware. Major targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business headquartered in the Chicago metro area and has about 500 workers. The Ryuk attack had brought down all business operations and manufacturing processes. Most of the client's data protection had been directly accessible at the start of the intrusion and were damaged. The client was evaluating paying the ransom (in excess of $200,000) and praying for the best, but in the end made the decision to use Progent.

Progent worked with the customer to rapidly understand and prioritize the most important services that had to be addressed in order to resume business functions:

• Active Directory
• Microsoft Exchange Email
• Financials/MRP

In less than 48 hours, Progent was able to re-build Active Directory to its pre-penetration state. Progent then completed reinstallations and hard drive recovery on the most important applications. All Microsoft Exchange Server schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to collect non-encrypted OST data files (Outlook Off-Line Folder Files) on team workstations and laptops in order to recover email data. A recent off-line backup of the customer's accounting/MRP software made it possible to return these required services back online. Although major work remained to recover completely from the Ryuk damage, the most important systems were returned to operations rapidly:

During the following few weeks key milestones in the restoration process were made through close collaboration between Progent engineers and the client:

• Internal web applications were restored without losing any data.
• The MailStore Exchange Server containing more than 4 million archived emails was spun up and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory modules were fully restored.
• A new Palo Alto 850 security appliance was set up.
• Ninety percent of the user workstations were being used by staff.

Conclusion
A probable business-ending catastrophe was dodged through the efforts of hard-working experts, a wide array of technical expertise, and tight teamwork. Although in retrospect the ransomware penetration detailed here could have been shut down with up-to-date cyber security solutions and security best practices, team education, and well thought out security procedures for data protection and keeping systems up to date with security patches, the reality is that state-sponsored cybercriminals from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware attack, feel confident that Progent's team of experts has substantial experience in crypto-ransomware virus blocking, cleanup, and data disaster recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Melbourne a range of remote monitoring and security assessment services to help you to reduce your vulnerability to ransomware. These services utilize next-generation machine learning capability to uncover zero-day strains of ransomware that can evade traditional signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to achieve leading-edge IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your system scales easily without holding you back. For a low and predictable monthly price, Progent's experienced IT team can be your complete technology safety net. Basic plans include remote monitoring and management, cybersecurity, automatic monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management technology to keep your IT system running at peak levels by checking the state of critical assets that power your information system. When ProSight LAN Watch detects a problem, an alert is sent automatically to your specified IT staff and your assigned Progent consultant so any looming issues can be addressed before they can impact productivity. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for managing your client-server infrastructure by providing tools for performing common time-consuming tasks. These include health monitoring, patch management, automated remediation, endpoint configuration, backup and restore, anti-virus response, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it transmits an alert to your specified IT personnel and your assigned Progent consultant so that emerging problems can be fixed before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for smaller organizations to map out, track, reconfigure and debug their networking hardware like routers, firewalls, and wireless controllers plus servers, endpoints and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that network diagrams are always current, captures and manages the configuration information of almost all devices on your network, tracks performance, and generates notices when issues are discovered. By automating tedious management processes, ProSight WAN Watch can cut hours off common chores like making network diagrams, expanding your network, locating devices that need important updates, or isolating performance bottlenecks. Learn more details about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time and in-depth management reporting plug-ins designed to integrate with the industry's top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as spotty support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has partnered with leading backup/restore software providers to create ProSight Data Protection Services, a portfolio of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup processes and enable non-disruptive backup and rapid recovery of critical files, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps you protect against data loss caused by equipment failures, natural calamities, fire, malware such as ransomware, user mistakes, ill-intentioned employees, or application glitches. Managed services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of top data security companies to provide web-based management and world-class protection for all your email traffic. The powerful architecture of Progent's Email Guard integrates a Cloud Protection Layer with a local gateway appliance to provide complete protection against spam, viruses, Dos Attacks, DHAs, and other email-based malware. The Cloud Protection Layer acts as a preliminary barricade and blocks most unwanted email from reaching your network firewall. This decreases your vulnerability to inbound threats and conserves system bandwidth and storage space. Email Guard's onsite security gateway device adds a further level of inspection for incoming email. For outbound email, the on-premises security gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The local gateway can also help Exchange Server to monitor and safeguard internal email that originates and ends within your corporate firewall. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication services incorporate Cisco's Duo technology to defend against password theft through the use of two-factor authentication. Duo supports one-tap identity confirmation on iOS, Android, and other out-of-band devices. Using Duo 2FA, when you log into a secured online account and give your password you are requested to verify your identity via a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A broad selection of devices can be utilized for this added means of authentication such as an iPhone or Android or wearable, a hardware/software token, a landline phone, etc. You may register several validation devices. To learn more about Duo identity authentication services, visit Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Support Desk managed services permit your IT team to outsource Call Center services to Progent or split activity for Help Desk services transparently between your internal support team and Progent's extensive roster of certified IT support engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a smooth extension of your internal IT support team. User access to the Help Desk, delivery of support, problem escalation, trouble ticket generation and tracking, efficiency metrics, and management of the service database are consistent regardless of whether issues are taken care of by your in-house network support staff, by Progent, or by a combination. Find out more about Progent's outsourced/co-managed Help Center services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection service that incorporates next generation behavior-based analysis technology to guard endpoints and physical and virtual servers against modern malware assaults such as ransomware and file-less exploits, which routinely get by traditional signature-based anti-virus products. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and provides a unified platform to automate the entire malware attack lifecycle including blocking, identification, containment, cleanup, and forensics. Top features include one-click rollback with Windows VSS and automatic system-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, find and safeguard information about your IT infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates or domains. By cleaning up and organizing your IT documentation, you can eliminate as much as half of time wasted looking for critical information about your network. ProSight IT Asset Management features a centralized repository for holding and sharing all documents required for managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and relating IT data. Whether you're making enhancements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer organizations of any size a flexible and affordable alternative for evaluating, testing, scheduling, applying, and tracking updates to your ever-evolving information network. Besides optimizing the protection and functionality of your computer network, Progent's patch management services free up time for your IT staff to focus on more strategic projects and tasks that derive the highest business value from your information network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected Tier III data center on a fast virtual host configured and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the OS software, and the applications. Because the environment is virtualized, it can be ported immediately to a different hosting environment without requiring a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not locked into one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoint devices against new malware attacks such as ransomware and file-less exploits, which easily evade legacy signature-based AV tools. ProSight ASM safeguards local and cloud-based resources and offers a single platform to address the complete threat progression including filtering, identification, mitigation, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection managed services deliver ultra-affordable in-depth security for physical and virtual servers, workstations, mobile devices, and Exchange email. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and responding to security threats from all attack vectors. ProSight ESP provides firewall protection, intrusion alerts, device control, and web filtering through leading-edge tools packaged within one agent managed from a unified console. Progent's security and virtualization experts can assist your business to design and implement a ProSight ESP environment that meets your organization's unique needs and that allows you demonstrate compliance with government and industry information security standards. Progent will help you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that call for immediate action. Progent's consultants can also assist your company to set up and verify a backup and restore solution like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.