24/7 Recife Emergency Crypto
Computer Malware Identification and Removal Consulting

Ransomware : Your Crippling IT Disaster
Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level threat for businesses of all sizes vulnerable to an assault. Different iterations of ransomware like the CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been circulating for many years and still cause harm. Recent variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Egregor, plus additional unnamed malware, not only encrypt on-line data files but also infiltrate many available system restores and backups. Files replicated to off-site disaster recovery sites can also be encrypted. In a poorly architected system, this can render automated recovery useless and effectively sets the datacenter back to square one.

Retrieving programs and information following a crypto-ransomware intrusion becomes a sprint against the clock as the targeted organization fights to contain the damage, clear the virus, and resume business-critical activity. Because crypto-ransomware takes time to replicate, assaults are usually sprung during nights and weekends, when successful penetrations in many cases take more time to uncover. This compounds the difficulty of rapidly mobilizing and coordinating a knowledgeable response team.

Progent has a range of solutions for protecting enterprises from ransomware attacks. These include staff training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to deployment of next-generation security gateways with machine learning technology from SentinelOne to detect and disable day-zero threats rapidly. Progent in addition offers the assistance of veteran ransomware recovery engineers with the talent and commitment to reconstruct a compromised system as soon as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware invasion, paying the ransom demands in cryptocurrency does not guarantee that distant criminals will return the codes to decipher all your data. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their data after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to piece back together the vital elements of your IT environment. Absent the availability of full system backups, this requires a wide range of skills, top notch project management, and the capability to work 24x7 until the job is completed.

For decades, Progent has offered expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have been awarded high-level certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in financial management and ERP application software. This breadth of expertise gives Progent the ability to rapidly identify important systems and integrate the surviving pieces of your IT system after a ransomware penetration and assemble them into a functioning system.

Progent's security team of experts uses top notch project management systems to orchestrate the complicated recovery process. Progent knows the importance of acting swiftly and in unison with a client's management and IT team members to assign priority to tasks and to put essential systems back online as soon as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Intrusion Response
A business sought out Progent after their organization was attacked by Ryuk crypto-ransomware. Ryuk is thought to have been created by Northern Korean state sponsored cybercriminals, suspected of adopting approaches leaked from the U.S. National Security Agency. Ryuk seeks specific businesses with little or no ability to sustain operational disruption and is one of the most profitable instances of ransomware viruses. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturer headquartered in the Chicago metro area and has about 500 employees. The Ryuk event had frozen all business operations and manufacturing capabilities. Most of the client's information backups had been online at the beginning of the intrusion and were destroyed. The client was taking steps for paying the ransom (more than $200K) and praying for good luck, but in the end called Progent.

Progent worked hand in hand the customer to quickly understand and assign priority to the most important applications that had to be addressed in order to continue company functions:

• Active Directory (AD)
• Email
• MRP System

In less than two days, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then performed rebuilding and hard drive recovery on needed applications. All Exchange ties and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to collect local OST files (Microsoft Outlook Off-Line Folder Files) on user desktop computers and laptops in order to recover email information. A not too old offline backup of the businesses accounting/ERP software made it possible to return these vital applications back servicing users. Although a lot of work needed to be completed to recover completely from the Ryuk damage, core systems were returned to operations quickly:

Over the next month important milestones in the restoration project were made through close collaboration between Progent team members and the customer:

• Internal web applications were restored without losing any data.
• The MailStore Exchange Server containing more than 4 million archived messages was restored to operations and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory modules were completely restored.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Most of the user desktops were fully operational.

Conclusion
A probable business-ending disaster was dodged with top-tier professionals, a broad range of subject matter expertise, and close teamwork. Although upon completion of forensics the ransomware virus penetration detailed here would have been disabled with modern security technology solutions and recognized best practices, team training, and appropriate incident response procedures for data backup and keeping systems up to date with security patches, the fact remains that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incident, remember that Progent's roster of experts has substantial experience in crypto-ransomware virus blocking, mitigation, and file restoration.

To review or download a PDF version of this customer story, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Recife a variety of remote monitoring and security evaluation services designed to assist you to reduce the threat from ransomware. These services include next-generation artificial intelligence capability to detect zero-day variants of ransomware that are able to get past legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to achieve advanced IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your network scales smoothly without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT group can be your dependable technology safety net. Entry-level plans include remote monitoring and management (RMM), cybersecurity, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management (RMM) techniques to help keep your IT system running at peak levels by tracking the health of critical computers that drive your business network. When ProSight LAN Watch detects an issue, an alarm is sent immediately to your specified IT management staff and your Progent consultant so any potential problems can be resolved before they can disrupt productivity. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for monitoring and managing your client-server infrastructure by offering an environment for performing common time-consuming jobs. These include health checking, patch management, automated repairs, endpoint deployment, backup and recovery, A/V defense, remote access, standard and custom scripts, resource inventory, endpoint status reports, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alert to your specified IT staff and your assigned Progent technical consultant so that potential issues can be fixed before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and affordable for smaller businesses to diagram, monitor, enhance and debug their connectivity appliances such as routers and switches, firewalls, and access points as well as servers, printers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network diagrams are kept updated, copies and displays the configuration information of almost all devices on your network, monitors performance, and generates notices when potential issues are detected. By automating time-consuming management and troubleshooting processes, ProSight WAN Watch can knock hours off ordinary tasks such as making network diagrams, reconfiguring your network, finding appliances that require important updates, or identifying the cause of performance problems. Find out more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of in-depth management reporting tools created to work with the leading ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-through or machines with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup/restore technology companies to create ProSight Data Protection Services (DPS), a family of offerings that provide backup-as-a-service. ProSight DPS services manage and track your data backup operations and enable non-disruptive backup and rapid restoration of critical files/folders, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets your business protect against data loss caused by hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, human mistakes, malicious employees, or application bugs. Managed services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of top data security vendors to provide centralized control and comprehensive security for all your inbound and outbound email. The powerful structure of Progent's Email Guard integrates cloud-based filtering with an on-premises gateway device to offer complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based malware. The Cloud Protection Layer acts as a first line of defense and blocks the vast majority of unwanted email from making it to your security perimeter. This decreases your vulnerability to external attacks and saves network bandwidth and storage. Email Guard's onsite gateway device adds a further level of analysis for inbound email. For outbound email, the local security gateway offers anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to track and safeguard internal email that stays inside your security perimeter. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA services utilize Cisco's Duo cloud technology to protect against compromised passwords by using two-factor authentication. Duo supports single-tap identity confirmation with Apple iOS, Google Android, and other personal devices. With 2FA, when you sign into a secured online account and enter your password you are requested to verify your identity on a device that only you possess and that is accessed using a separate network channel. A broad selection of devices can be used for this second means of authentication such as a smartphone or watch, a hardware token, a landline phone, etc. You may register several verification devices. To find out more about ProSight Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Center: Call Center Managed Services
  Progent's Help Desk managed services enable your IT team to outsource Help Desk services to Progent or split activity for support services seamlessly between your in-house network support resources and Progent's extensive roster of certified IT support engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service provides a smooth supplement to your internal IT support team. End user access to the Service Desk, provision of support, issue escalation, trouble ticket creation and tracking, efficiency measurement, and management of the support database are consistent whether issues are taken care of by your internal IT support resources, by Progent, or a mix of the two. Learn more about Progent's outsourced/co-managed Service Desk services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes next generation behavior machine learning tools to defend endpoints and physical and virtual servers against modern malware assaults like ransomware and email phishing, which easily escape traditional signature-based AV products. Progent Active Security Monitoring services safeguard local and cloud-based resources and offers a single platform to manage the complete malware attack progression including protection, infiltration detection, containment, cleanup, and forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, retrieve and safeguard data about your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or IP addresses and be warned about impending expirations of SSL certificates or domains. By updating and organizing your IT documentation, you can eliminate up to half of time wasted searching for vital information about your network. ProSight IT Asset Management features a centralized location for holding and collaborating on all documents related to managing your business network like recommended procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT data. Whether you're making improvements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the information you need when you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide businesses of any size a flexible and affordable solution for evaluating, validating, scheduling, applying, and tracking updates to your ever-evolving IT network. Besides maximizing the security and functionality of your computer environment, Progent's patch management services allow your IT staff to focus on line-of-business initiatives and activities that deliver the highest business value from your information network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual machine host set up and managed by Progent's network support professionals. Under the ProSight Virtual Hosting service model, the client owns the data, the OS software, and the applications. Since the environment is virtualized, it can be ported immediately to a different hardware solution without a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that incorporates SentinelOne's next generation behavior-based machine learning technology to defend physical and virtual endpoint devices against new malware attacks such as ransomware and file-less exploits, which easily evade legacy signature-matching anti-virus tools. ProSight Active Security Monitoring protects local and cloud-based resources and provides a single platform to automate the entire malware attack progression including blocking, identification, mitigation, cleanup, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection services deliver economical in-depth protection for physical servers and virtual machines, desktops, smartphones, and Exchange email. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to cyber threats from all attack vectors. ProSight ESP offers two-way firewall protection, penetration alarms, device control, and web filtering through cutting-edge technologies packaged within a single agent accessible from a single console. Progent's security and virtualization consultants can assist you to design and implement a ProSight ESP environment that meets your company's specific needs and that allows you achieve and demonstrate compliance with legal and industry information protection regulations. Progent will assist you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for urgent attention. Progent can also help your company to install and verify a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover quickly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange filtering.