Vitória 24/7 Urgent CryptoLocker
Computer Malware Detection and Remediation Services

Ransomware : Your Feared IT Nightmare
Crypto-Ransomware has become a modern cyber pandemic that poses an enterprise-level danger for businesses of all sizes vulnerable to an assault. Different iterations of crypto-ransomware such as Dharma, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for many years and still cause havoc. The latest variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, as well as more unnamed viruses, not only do encryption of online information but also infiltrate most configured system protection. Information synchronized to off-site disaster recovery sites can also be corrupted. In a poorly architected environment, this can render any recovery hopeless and effectively knocks the entire system back to square one.

Getting back on-line services and data after a crypto-ransomware intrusion becomes a race against the clock as the targeted organization struggles to stop the spread, clear the virus, and restore mission-critical activity. Because crypto-ransomware requires time to replicate, assaults are usually launched during nights and weekends, when attacks tend to take longer to identify. This multiplies the difficulty of rapidly marshalling and organizing a qualified mitigation team.

Progent offers a range of solutions for protecting enterprises from crypto-ransomware attacks. Among these are team education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of modern security gateways with artificial intelligence capabilities from SentinelOne to detect and disable new cyber threats intelligently. Progent in addition provides the assistance of expert ransomware recovery professionals with the track record and perseverance to re-deploy a compromised environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Help
After a ransomware event, paying the ransom demands in cryptocurrency does not ensure that distant criminals will return the needed keys to decrypt all your data. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to piece back together the vital parts of your Information Technology environment. Without the availability of full system backups, this requires a broad range of IT skills, well-coordinated team management, and the capability to work continuously until the task is complete.

For two decades, Progent has offered certified expert Information Technology services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded high-level certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in accounting and ERP application software. This breadth of expertise provides Progent the capability to knowledgably ascertain critical systems and organize the remaining parts of your computer network system after a ransomware attack and rebuild them into a functioning network.

Progent's recovery group utilizes powerful project management applications to orchestrate the sophisticated restoration process. Progent knows the urgency of working swiftly and in concert with a customer's management and IT team members to assign priority to tasks and to get essential systems back on-line as fast as humanly possible.

Client Story: A Successful Ransomware Intrusion Recovery
A small business engaged Progent after their network was attacked by the Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state criminal gangs, possibly using algorithms leaked from America's National Security Agency. Ryuk seeks specific organizations with little or no ability to sustain operational disruption and is among the most lucrative iterations of ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing business located in the Chicago metro area and has around 500 staff members. The Ryuk penetration had shut down all essential operations and manufacturing capabilities. The majority of the client's backups had been online at the beginning of the intrusion and were encrypted. The client considered paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but ultimately called Progent.

Progent worked with the client to rapidly get our arms around and prioritize the critical services that had to be recovered in order to continue company functions:

• Microsoft Active Directory
• Exchange Server
• MRP System

Within two days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then performed reinstallations and storage recovery of the most important servers. All Exchange data and attributes were intact, which greatly helped the rebuild of Exchange. Progent was also able to find local OST data files (Outlook Email Off-Line Data Files) on user desktop computers and laptops to recover mail data. A not too old off-line backup of the customer's financials/ERP software made it possible to restore these vital services back available to users. Although significant work remained to recover fully from the Ryuk damage, the most important systems were recovered quickly:

During the following month important milestones in the recovery project were completed in close collaboration between Progent team members and the customer:

• Self-hosted web applications were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server with over four million archived emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory functions were 100% functional.
• A new Palo Alto 850 security appliance was installed.
• Most of the desktops and laptops were back into operation.

Conclusion
A possible business extinction catastrophe was avoided due to dedicated professionals, a broad array of subject matter expertise, and close collaboration. Although in hindsight the ransomware attack detailed here should have been shut down with up-to-date cyber security systems and recognized best practices, team training, and appropriate security procedures for information backup and proper patching controls, the fact is that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware attack, remember that Progent's roster of experts has extensive experience in crypto-ransomware virus blocking, removal, and data disaster recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Vitória a variety of online monitoring and security evaluation services to help you to minimize the threat from ransomware. These services incorporate next-generation AI technology to uncover zero-day strains of ransomware that are able to get past traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to achieve advanced IT resilience. Progent handles the necessary monitoring and management for you, so your network scales readily without holding you back. For an affordable and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Basic packages include RMM, security, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management (RMM) technology to keep your IT system operating at peak levels by tracking the health of vital computers that power your information system. When ProSight LAN Watch uncovers a problem, an alarm is transmitted automatically to your specified IT management personnel and your Progent engineering consultant so that all potential issues can be addressed before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven solution for monitoring and managing your client-server infrastructure by offering an environment for performing common time-consuming tasks. These include health checking, patch management, automated remediation, endpoint setup, backup and restore, A/V protection, remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alert to your designated IT management personnel and your Progent technical consultant so emerging problems can be fixed before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for smaller organizations to map, monitor, enhance and troubleshoot their connectivity appliances such as routers and switches, firewalls, and wireless controllers plus servers, printers, client computers and other devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch ensures that network diagrams are kept updated, copies and manages the configuration of virtually all devices connected to your network, tracks performance, and generates alerts when problems are discovered. By automating time-consuming management and troubleshooting activities, ProSight WAN Watch can cut hours off common chores like network mapping, reconfiguring your network, finding devices that need important updates, or identifying the cause of performance issues. Learn more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of real-time management reporting plug-ins designed to integrate with the industry's top ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues like inconsistent support follow-through or machines with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with leading backup/restore software providers to produce ProSight Data Protection Services (DPS), a family of offerings that provide backup-as-a-service (BaaS). ProSight DPS services automate and monitor your data backup operations and allow transparent backup and fast restoration of critical files, apps, system images, plus VMs. ProSight DPS lets your business protect against data loss resulting from equipment failures, natural calamities, fire, malware like ransomware, human mistakes, ill-intentioned employees, or software glitches. Managed services in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of top information security companies to deliver web-based management and world-class protection for all your inbound and outbound email. The hybrid architecture of Progent's Email Guard integrates cloud-based filtering with a local security gateway appliance to offer advanced defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne threats. Email Guard's cloud filter acts as a preliminary barricade and keeps the vast majority of unwanted email from making it to your network firewall. This reduces your vulnerability to inbound threats and saves system bandwidth and storage. Email Guard's on-premises gateway appliance adds a deeper layer of inspection for inbound email. For outbound email, the on-premises security gateway offers anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to track and safeguard internal email traffic that stays within your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity confirmation on Apple iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you log into a protected application and enter your password you are asked to verify your identity on a device that only you possess and that uses a different ("out-of-band") network channel. A broad selection of devices can be used as this added means of ID validation including an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You may register several validation devices. For more information about ProSight Duo identity authentication services, go to Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Call Desk: Help Desk Managed Services
  Progent's Support Desk services enable your IT staff to offload Help Desk services to Progent or divide responsibilities for Help Desk services transparently between your internal network support resources and Progent's extensive pool of certified IT support engineers and subject matter experts. Progent's Shared Service Desk provides a transparent supplement to your in-house network support team. User interaction with the Help Desk, delivery of support, problem escalation, ticket creation and updates, performance metrics, and maintenance of the service database are cohesive whether incidents are taken care of by your core IT support group, by Progent's team, or both. Read more about Progent's outsourced/shared Service Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior analysis tools to defend endpoint devices as well as servers and VMs against new malware assaults such as ransomware and email phishing, which easily evade traditional signature-matching AV products. Progent ASM services protect local and cloud resources and provides a unified platform to address the entire threat progression including blocking, identification, mitigation, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, retrieve and safeguard information about your network infrastructure, processes, applications, and services. You can quickly find passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates or domains. By cleaning up and managing your network documentation, you can save as much as 50% of time thrown away trying to find critical information about your IT network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents related to managing your business network such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're planning enhancements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the data you need as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management offer organizations of any size a versatile and affordable alternative for evaluating, validating, scheduling, applying, and tracking software and firmware updates to your ever-evolving IT network. Besides maximizing the protection and reliability of your IT environment, Progent's patch management services free up time for your in-house IT team to concentrate on more strategic initiatives and activities that deliver the highest business value from your network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual host configured and managed by Progent's IT support experts. With Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system platforms, and the apps. Since the system is virtualized, it can be moved easily to an alternate hardware solution without a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which easily escape traditional signature-based AV tools. ProSight Active Security Monitoring protects on-premises and cloud-based resources and offers a unified platform to automate the complete malware attack lifecycle including filtering, infiltration detection, mitigation, remediation, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable in-depth security for physical servers and VMs, workstations, smartphones, and Microsoft Exchange. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and reacting to security threats from all vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, endpoint control, and web filtering via cutting-edge tools incorporated within a single agent managed from a single console. Progent's data protection and virtualization experts can assist you to design and configure a ProSight ESP environment that meets your organization's unique needs and that allows you achieve and demonstrate compliance with government and industry information protection regulations. Progent will help you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for urgent action. Progent can also help you to set up and verify a backup and restore solution like ProSight Data Protection Services so you can recover rapidly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange filtering.