24x7 Curitiba Critical Crypto
Computer Malware Damage Assessment and Repair Services

Ransomware : Your Feared IT Nightmare
Crypto-Ransomware has become a too-frequent cyberplague that presents an extinction-level danger for businesses poorly prepared for an attack. Versions of ransomware like the CrySIS, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and still cause damage. The latest variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Egregor, along with more unnamed malware, not only encrypt online files but also infect any available system restores and backups. Information synchronized to the cloud can also be encrypted. In a poorly designed environment, this can render automated recovery impossible and effectively knocks the network back to zero.

Getting back on-line programs and information after a ransomware event becomes a sprint against the clock as the targeted business fights to contain, eradicate the ransomware, and restore mission-critical activity. Due to the fact that ransomware needs time to spread, assaults are usually launched during nights and weekends, when successful attacks typically take longer to detect. This compounds the difficulty of quickly assembling and organizing a capable mitigation team.

Progent offers an assortment of help services for securing enterprises from crypto-ransomware events. Among these are staff education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of the latest generation security solutions with AI technology from SentinelOne to detect and disable zero-day threats intelligently. Progent also offers the assistance of expert ransomware recovery engineers with the skills and commitment to re-deploy a breached system as urgently as possible.

Progent's Crypto-Ransomware Restoration Support Services
Following a ransomware invasion, sending the ransom in cryptocurrency does not guarantee that cyber criminals will respond with the keys to unencrypt all your files. Kaspersky Labs estimated that seventeen percent of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to piece back together the key components of your Information Technology environment. Without the availability of full data backups, this calls for a broad range of skill sets, well-coordinated team management, and the ability to work continuously until the job is completed.

For two decades, Progent has made available professional IT services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have been awarded top industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of expertise affords Progent the capability to efficiently determine important systems and integrate the surviving pieces of your Information Technology environment following a ransomware event and rebuild them into an operational network.

Progent's recovery team has top notch project management systems to orchestrate the complicated recovery process. Progent understands the importance of acting swiftly and together with a customer's management and IT staff to prioritize tasks and to put the most important applications back online as fast as possible.

Customer Story: A Successful Crypto-Ransomware Attack Restoration
A business engaged Progent after their company was brought down by Ryuk crypto-ransomware. Ryuk is generally considered to have been launched by North Korean government sponsored criminal gangs, possibly using approaches leaked from the United States NSA organization. Ryuk goes after specific organizations with little tolerance for operational disruption and is one of the most profitable instances of ransomware malware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in the Chicago metro area and has about 500 workers. The Ryuk event had frozen all company operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the beginning of the attack and were encrypted. The client was taking steps for paying the ransom (more than $200,000) and hoping for good luck, but ultimately reached out to Progent.

Progent worked together with the client to rapidly assess and assign priority to the key applications that needed to be restored to make it possible to resume business operations:

• Active Directory
• Microsoft Exchange Server
• MRP System

In less than two days, Progent was able to re-build Active Directory services to its pre-virus state. Progent then charged ahead with reinstallations and hard drive recovery on essential applications. All Exchange ties and attributes were intact, which facilitated the restore of Exchange. Progent was also able to collect non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on user workstations to recover email information. A not too old offline backup of the businesses manufacturing systems made it possible to return these essential services back servicing users. Although a large amount of work needed to be completed to recover fully from the Ryuk event, critical services were recovered rapidly:

Over the following month important milestones in the restoration project were made through close collaboration between Progent team members and the customer:

• In-house web applications were restored without losing any information.
• The MailStore Server containing more than 4 million historical messages was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control functions were 100% recovered.
• A new Palo Alto 850 security appliance was deployed.
• Nearly all of the desktop computers were being used by staff.

Conclusion
A possible business disaster was averted through the efforts of dedicated experts, a broad range of knowledge, and close teamwork. Although in analyzing the event afterwards the ransomware virus attack described here should have been prevented with modern cyber security technology solutions and security best practices, user training, and well designed security procedures for backup and applying software patches, the reality remains that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware penetration, remember that Progent's team of professionals has substantial experience in ransomware virus blocking, cleanup, and file restoration.

To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Curitiba a portfolio of remote monitoring and security evaluation services designed to help you to reduce the threat from crypto-ransomware. These services utilize next-generation AI capability to detect new strains of ransomware that are able to evade legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the necessary monitoring and maintenance for you, so your system scales easily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT team can be your complete technology safety net. Basic packages include remote monitoring and management (RMM), cybersecurity, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates state-of-the-art remote monitoring and management techniques to help keep your network running efficiently by checking the state of critical assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alert is transmitted automatically to your specified IT management staff and your Progent consultant so that any looming problems can be resolved before they have a chance to impact productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for monitoring and managing your client-server infrastructure by providing tools for performing common tedious jobs. These can include health monitoring, update management, automated remediation, endpoint setup, backup and restore, A/V protection, secure remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alert to your designated IT management staff and your assigned Progent technical consultant so that potential issues can be fixed before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller businesses to map, monitor, enhance and troubleshoot their connectivity appliances such as routers, firewalls, and access points as well as servers, endpoints and other networked devices. Using state-of-the-art RMM technology, WAN Watch ensures that infrastructure topology maps are kept updated, copies and displays the configuration of virtually all devices connected to your network, monitors performance, and sends alerts when potential issues are detected. By automating time-consuming management activities, ProSight WAN Watch can knock hours off ordinary chores such as making network diagrams, expanding your network, locating appliances that require critical updates, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of in-depth reporting plug-ins designed to work with the industry's top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-up or machines with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup technology providers to produce ProSight Data Protection Services (DPS), a selection of subscription-based offerings that provide backup-as-a-service (BaaS). ProSight DPS products manage and monitor your backup operations and enable transparent backup and rapid recovery of vital files/folders, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business protect against data loss resulting from hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, human mistakes, malicious insiders, or software glitches. Managed services in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of leading information security companies to provide centralized control and comprehensive security for your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with a local security gateway device to offer complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's Cloud Protection Layer acts as a first line of defense and keeps the vast majority of unwanted email from reaching your network firewall. This reduces your vulnerability to external attacks and conserves system bandwidth and storage. Email Guard's onsite gateway device provides a further level of inspection for incoming email. For outgoing email, the onsite security gateway offers AV and anti-spam filtering, DLP, and email encryption. The onsite security gateway can also help Exchange Server to track and safeguard internal email traffic that stays within your corporate firewall. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA service plans incorporate Cisco's Duo technology to defend against compromised passwords by using two-factor authentication. Duo supports one-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. Using Duo 2FA, whenever you sign into a secured online account and enter your password you are requested to confirm who you are on a unit that only you have and that uses a different network channel. A wide selection of devices can be utilized for this added form of authentication including an iPhone or Android or watch, a hardware/software token, a landline telephone, etc. You may designate several verification devices. To learn more about Duo two-factor identity authentication services, refer to Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Center: Help Desk Managed Services
  Progent's Call Desk services allow your IT team to offload Support Desk services to Progent or divide responsibilities for Service Desk support seamlessly between your internal network support resources and Progent's extensive roster of IT service engineers and subject matter experts. Progent's Shared Help Desk Service provides a smooth supplement to your internal IT support organization. User interaction with the Service Desk, delivery of support, problem escalation, trouble ticket generation and updates, performance metrics, and maintenance of the service database are consistent whether incidents are taken care of by your corporate IT support group, by Progent's team, or by a combination. Read more about Progent's outsourced/shared Call Center services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes cutting edge behavior-based analysis technology to defend endpoint devices and physical and virtual servers against new malware assaults like ransomware and email phishing, which routinely evade legacy signature-based anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and offers a single platform to automate the complete malware attack progression including blocking, detection, mitigation, cleanup, and post-attack forensics. Top features include one-click rollback with Windows VSS and automatic network-wide immunization against newly discovered attacks. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, update, retrieve and safeguard data about your IT infrastructure, procedures, applications, and services. You can quickly find passwords or serial numbers and be alerted automatically about impending expirations of SSLs or warranties. By cleaning up and organizing your IT documentation, you can eliminate as much as 50% of time spent looking for critical information about your network. ProSight IT Asset Management includes a centralized location for storing and collaborating on all documents related to managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and associating IT information. Whether you're making enhancements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the knowledge you need the instant you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management offer businesses of any size a versatile and affordable solution for evaluating, testing, scheduling, applying, and tracking software and firmware updates to your ever-evolving information network. In addition to optimizing the protection and reliability of your computer network, Progent's software/firmware update management services free up time for your in-house IT team to concentrate on line-of-business projects and activities that derive maximum business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual machine host configured and managed by Progent's IT support experts. Under the ProSight Virtual Hosting model, the customer owns the data, the OS platforms, and the applications. Because the system is virtualized, it can be ported immediately to a different hardware environment without requiring a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior analysis technology to defend physical and virtual endpoint devices against modern malware assaults like ransomware and file-less exploits, which easily evade legacy signature-based anti-virus tools. ProSight ASM protects local and cloud-based resources and provides a unified platform to address the complete malware attack progression including filtering, detection, mitigation, remediation, and forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable multi-layer security for physical servers and VMs, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced machine learning for continuously monitoring and reacting to cyber threats from all attack vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, endpoint management, and web filtering via leading-edge tools incorporated within one agent managed from a single console. Progent's data protection and virtualization consultants can assist you to design and configure a ProSight ESP deployment that addresses your organization's specific requirements and that helps you achieve and demonstrate compliance with legal and industry data security standards. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that call for immediate action. Progent can also help your company to install and verify a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover quickly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange filtering.