24x7x365 Austin Critical Ransomware
Computer Virus Damage Assessment and Recovery Support

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that represents an enterprise-level danger for organizations unprepared for an attack. Versions of crypto-ransomware such as CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for many years and still inflict damage. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Egregor, plus additional unnamed newcomers, not only encrypt on-line data but also infect any configured system backup. Files synchronized to off-site disaster recovery sites can also be ransomed. In a poorly designed environment, it can make automated restore operations impossible and basically knocks the datacenter back to square one.

Restoring services and information following a crypto-ransomware outage becomes a race against the clock as the targeted organization struggles to stop the spread, eradicate the ransomware, and resume mission-critical operations. Since crypto-ransomware takes time to replicate, attacks are often launched at night, when successful attacks typically take more time to discover. This compounds the difficulty of promptly mobilizing and organizing a knowledgeable response team.

Progent makes available a range of solutions for protecting businesses from crypto-ransomware events. Among these are user education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of modern security gateways with AI capabilities from SentinelOne to discover and suppress zero-day threats automatically. Progent in addition offers the services of experienced crypto-ransomware recovery professionals with the track record and perseverance to restore a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
After a ransomware penetration, paying the ransom in cryptocurrency does not guarantee that cyber criminals will return the codes to decipher all your data. Kaspersky determined that 17% of crypto-ransomware victims never recovered their data after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to setup from scratch the mission-critical elements of your IT environment. Without access to full information backups, this calls for a broad range of IT skills, well-coordinated team management, and the willingness to work non-stop until the recovery project is finished.

For decades, Progent has provided expert Information Technology services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have earned advanced certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of expertise affords Progent the ability to knowledgably understand critical systems and organize the remaining components of your IT system following a crypto-ransomware penetration and configure them into an operational network.

Progent's recovery team of experts deploys best of breed project management applications to coordinate the sophisticated restoration process. Progent knows the importance of working rapidly and in concert with a client's management and Information Technology resources to prioritize tasks and to get the most important services back on line as soon as humanly possible.

Case Study: A Successful Ransomware Penetration Restoration
A customer escalated to Progent after their network system was penetrated by Ryuk ransomware virus. Ryuk is believed to have been created by North Korean government sponsored criminal gangs, possibly adopting techniques exposed from the U.S. NSA organization. Ryuk attacks specific organizations with little room for disruption and is one of the most lucrative iterations of ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in Chicago and has around 500 employees. The Ryuk penetration had disabled all essential operations and manufacturing capabilities. The majority of the client's data backups had been online at the start of the attack and were encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200,000) and praying for good luck, but ultimately brought in Progent.

Progent worked with the client to rapidly understand and prioritize the mission critical services that needed to be restored in order to resume business operations:

• Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

In less than two days, Progent was able to recover Active Directory services to its pre-attack state. Progent then completed reinstallations and hard drive recovery of essential systems. All Microsoft Exchange Server ties and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to collect local OST files (Microsoft Outlook Offline Data Files) on various desktop computers in order to recover mail messages. A not too old off-line backup of the client's accounting software made them able to return these required applications back online for users. Although significant work still had to be done to recover fully from the Ryuk attack, critical systems were restored quickly:

During the next few weeks critical milestones in the restoration process were accomplished through tight cooperation between Progent engineers and the customer:

• In-house web sites were returned to operation without losing any information.
• The MailStore Server exceeding 4 million historical messages was brought online and available for users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory functions were fully operational.
• A new Palo Alto Networks 850 firewall was deployed.
• Nearly all of the desktops and laptops were functioning as before the incident.

Conclusion
A possible enterprise-killing disaster was dodged with dedicated experts, a broad spectrum of technical expertise, and tight collaboration. Although in hindsight the ransomware virus penetration described here would have been stopped with modern cyber security technology and recognized best practices, user and IT administrator education, and well designed incident response procedures for data protection and proper patching controls, the fact remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware penetration, remember that Progent's team of experts has extensive experience in crypto-ransomware virus defense, removal, and file disaster recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Austin a range of online monitoring and security evaluation services to assist you to minimize the threat from ransomware. These services utilize next-generation machine learning technology to uncover zero-day variants of ransomware that can escape detection by legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent handles the necessary monitoring and management for you, so your system scales easily without becoming an obstacle. For an affordable and predictable monthly price, Progent's experienced IT team can be your dependable technology safety net. Basic packages include RMM, cybersecurity, automatic monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management techniques to help keep your network operating efficiently by tracking the state of critical assets that power your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent automatically to your specified IT personnel and your Progent consultant so that any potential problems can be addressed before they have a chance to impact productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven platform for monitoring and managing your network, server, and desktop devices by providing an environment for performing common tedious jobs. These include health monitoring, patch management, automated repairs, endpoint setup, backup and recovery, A/V defense, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alarm to your designated IT staff and your assigned Progent technical consultant so potential issues can be taken care of before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller businesses to map out, track, optimize and debug their networking appliances like switches, firewalls, and wireless controllers plus servers, printers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, WAN Watch ensures that infrastructure topology maps are always updated, captures and displays the configuration of almost all devices connected to your network, monitors performance, and generates notices when problems are discovered. By automating time-consuming management and troubleshooting processes, ProSight WAN Watch can cut hours off ordinary chores like making network diagrams, reconfiguring your network, finding appliances that require critical software patches, or resolving performance bottlenecks. Learn more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of real-time and in-depth reporting utilities designed to integrate with the top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like inconsistent support follow-up or machines with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has partnered with leading backup technology providers to create ProSight Data Protection Services (DPS), a family of management offerings that provide backup-as-a-service. ProSight DPS products manage and track your backup processes and allow non-disruptive backup and rapid restoration of important files, apps, images, plus VMs. ProSight DPS helps you recover from data loss caused by equipment failures, natural disasters, fire, malware such as ransomware, user mistakes, malicious employees, or software bugs. Managed services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of top information security companies to deliver centralized control and comprehensive security for all your inbound and outbound email. The hybrid structure of Email Guard managed service combines cloud-based filtering with an on-premises security gateway appliance to provide advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-based malware. The cloud filter acts as a preliminary barricade and keeps the vast majority of threats from making it to your network firewall. This reduces your vulnerability to inbound threats and saves system bandwidth and storage. Email Guard's onsite security gateway device adds a further layer of inspection for inbound email. For outbound email, the local gateway offers anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to track and safeguard internal email that originates and ends within your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo technology to protect against password theft by using two-factor authentication (2FA). Duo supports one-tap identity confirmation with Apple iOS, Google Android, and other personal devices. With 2FA, whenever you log into a secured application and enter your password you are requested to confirm who you are via a device that only you have and that uses a separate network channel. A wide range of devices can be used for this added form of authentication such as an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You may designate multiple validation devices. For more information about ProSight Duo two-factor identity authentication services, visit Cisco Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Service Center: Help Desk Managed Services
  Progent's Help Desk managed services permit your IT staff to offload Call Center services to Progent or divide responsibilities for Help Desk services seamlessly between your in-house support team and Progent's nationwide pool of IT service engineers and subject matter experts (SMEs). Progent's Shared Service Desk offers a transparent supplement to your corporate network support resources. User interaction with the Service Desk, delivery of support, escalation, ticket creation and tracking, performance metrics, and management of the service database are consistent regardless of whether issues are resolved by your internal network support organization, by Progent, or a mix of the two. Find out more about Progent's outsourced/co-managed Help Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates cutting edge behavior-based machine learning technology to guard endpoints as well as servers and VMs against modern malware assaults like ransomware and email phishing, which easily get by legacy signature-based anti-virus tools. Progent ASM services safeguard on-premises and cloud-based resources and offers a unified platform to automate the entire threat lifecycle including protection, infiltration detection, mitigation, remediation, and forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered threats. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, retrieve and safeguard data related to your IT infrastructure, procedures, business apps, and services. You can instantly find passwords or serial numbers and be alerted about upcoming expirations of SSLs or domains. By cleaning up and managing your IT infrastructure documentation, you can eliminate as much as half of time spent searching for vital information about your network. ProSight IT Asset Management includes a common location for holding and collaborating on all documents required for managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT information. Whether you're planning enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the information you require the instant you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer businesses of any size a flexible and affordable solution for evaluating, validating, scheduling, applying, and documenting updates to your ever-evolving information system. In addition to optimizing the protection and reliability of your computer environment, Progent's software/firmware update management services free up time for your in-house IT staff to concentrate on line-of-business projects and activities that derive the highest business value from your information network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host configured and maintained by Progent's network support experts. Under Progent's ProSight Virtual Hosting model, the client owns the data, the operating system software, and the apps. Since the system is virtualized, it can be moved easily to a different hardware environment without a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior machine learning tools to guard physical and virtual endpoints against new malware attacks like ransomware and email phishing, which easily evade traditional signature-matching AV products. ProSight ASM safeguards local and cloud resources and offers a unified platform to automate the complete malware attack lifecycle including filtering, detection, mitigation, remediation, and post-attack forensics. Top capabilities include single-click rollback using Windows VSS and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer affordable in-depth security for physical servers and VMs, workstations, smartphones, and Exchange email. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and responding to security assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, endpoint control, and web filtering through leading-edge tools incorporated within one agent managed from a single control. Progent's security and virtualization experts can assist you to design and implement a ProSight ESP deployment that meets your company's specific needs and that allows you prove compliance with legal and industry information protection standards. Progent will assist you define and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that require immediate action. Progent can also help your company to set up and test a backup and disaster recovery system like ProSight Data Protection Services so you can recover quickly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange filtering.