24/7 Durham Critical Ransomware
Computer Virus Assessment and Remediation Consulting

Ransomware : Your Feared IT Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that represents an existential threat for businesses of all sizes vulnerable to an attack. Different versions of crypto-ransomware such as CrySIS, Fusob, Locky, Syskey and MongoLock cryptoworms have been around for many years and still inflict damage. Modern variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, as well as additional unnamed malware, not only do encryption of on-line files but also infect many accessible system protection. Information synched to cloud environments can also be corrupted. In a poorly designed system, it can render any restoration hopeless and effectively sets the entire system back to square one.

Restoring programs and information after a ransomware event becomes a race against the clock as the targeted business fights to contain, eradicate the crypto-ransomware, and restore enterprise-critical activity. Because crypto-ransomware needs time to spread, attacks are usually launched during weekends and nights, when penetrations typically take longer to uncover. This compounds the difficulty of rapidly marshalling and organizing an experienced mitigation team.

Progent makes available a variety of help services for securing enterprises from crypto-ransomware events. These include team member education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of modern security appliances with AI technology from SentinelOne to discover and suppress new threats rapidly. Progent in addition offers the assistance of seasoned ransomware recovery engineers with the track record and perseverance to reconstruct a compromised system as urgently as possible.

Progent's Ransomware Restoration Support Services
Soon after a ransomware invasion, even paying the ransom in cryptocurrency does not guarantee that cyber hackers will provide the keys to decrypt any of your data. Kaspersky determined that 17% of ransomware victims never recovered their information even after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to setup from scratch the vital components of your IT environment. Without the availability of essential system backups, this requires a wide range of skill sets, well-coordinated project management, and the willingness to work 24x7 until the task is completed.

For twenty years, Progent has made available professional Information Technology services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of experience affords Progent the ability to knowledgably ascertain necessary systems and re-organize the surviving components of your Information Technology environment after a ransomware penetration and configure them into an operational network.

Progent's ransomware group uses top notch project management tools to orchestrate the complicated recovery process. Progent appreciates the importance of acting rapidly and in unison with a customer's management and IT team members to assign priority to tasks and to put key systems back on line as fast as possible.

Business Case Study: A Successful Ransomware Incident Restoration
A small business hired Progent after their network was taken over by the Ryuk ransomware virus. Ryuk is thought to have been launched by North Korean state sponsored hackers, suspected of adopting algorithms leaked from the United States NSA organization. Ryuk attacks specific companies with limited ability to sustain operational disruption and is among the most profitable examples of ransomware. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer based in Chicago with about 500 workers. The Ryuk event had brought down all business operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the beginning of the intrusion and were damaged. The client was evaluating paying the ransom (in excess of $200,000) and praying for good luck, but in the end brought in Progent.

Progent worked together with the customer to rapidly assess and assign priority to the essential areas that needed to be restored in order to restart departmental operations:

• Microsoft Active Directory
• Electronic Messaging
• Financials/MRP

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then initiated reinstallations and storage recovery of needed servers. All Exchange ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to locate local OST data files (Microsoft Outlook Off-Line Folder Files) on various workstations to recover email messages. A recent off-line backup of the customer's accounting/MRP software made them able to restore these essential programs back online for users. Although a large amount of work was left to recover fully from the Ryuk virus, critical systems were recovered quickly:

Over the following few weeks critical milestones in the recovery process were accomplished in tight collaboration between Progent engineers and the client:

• In-house web applications were brought back up without losing any data.
• The MailStore Exchange Server exceeding 4 million historical messages was spun up and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory functions were fully functional.
• A new Palo Alto 850 security appliance was installed.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A possible enterprise-killing disaster was avoided by hard-working experts, a broad array of knowledge, and close teamwork. Although in post mortem the ransomware virus incident detailed here should have been identified and prevented with modern cyber security technology solutions and recognized best practices, user and IT administrator education, and appropriate security procedures for data protection and applying software patches, the fact is that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus blocking, remediation, and information systems restoration.

To review or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Durham a range of online monitoring and security evaluation services designed to assist you to minimize the threat from crypto-ransomware. These services include next-generation machine learning capability to uncover zero-day strains of ransomware that are able to escape detection by legacy signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent takes care of the daily monitoring and management for you, so your system scales smoothly without becoming an obstacle. For a low and predictable monthly price, Progent's experienced IT group can be your complete technology safety net. Basic packages include RMM, cybersecurity, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management techniques to help keep your IT system operating efficiently by checking the health of vital computers that power your information system. When ProSight LAN Watch detects an issue, an alarm is sent automatically to your designated IT staff and your assigned Progent engineering consultant so all looming problems can be resolved before they have a chance to impact productivity. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for managing your client-server infrastructure by offering an environment for performing common tedious jobs. These can include health monitoring, update management, automated repairs, endpoint deployment, backup and recovery, A/V protection, remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and debugging help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alert to your designated IT management staff and your Progent technical consultant so emerging issues can be taken care of before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller organizations to diagram, monitor, enhance and troubleshoot their networking hardware like routers, firewalls, and access points as well as servers, printers, client computers and other networked devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch ensures that network maps are always current, captures and displays the configuration information of virtually all devices connected to your network, monitors performance, and sends notices when issues are discovered. By automating time-consuming network management activities, WAN Watch can cut hours off ordinary chores such as making network diagrams, expanding your network, locating devices that need important software patches, or resolving performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time reporting tools designed to work with the top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore software providers to create ProSight Data Protection Services, a selection of subscription-based management outsourcing plans that provide backup-as-a-service. ProSight DPS products manage and monitor your backup operations and enable transparent backup and rapid recovery of important files, apps, system images, plus VMs. ProSight DPS lets your business recover from data loss caused by hardware breakdown, natural disasters, fire, malware such as ransomware, user mistakes, malicious employees, or application glitches. Managed backup services in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of top data security vendors to provide web-based management and world-class protection for all your email traffic. The powerful structure of Progent's Email Guard combines a Cloud Protection Layer with a local security gateway device to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The Cloud Protection Layer acts as a preliminary barricade and keeps most unwanted email from reaching your network firewall. This reduces your vulnerability to inbound threats and conserves network bandwidth and storage. Email Guard's on-premises security gateway appliance provides a deeper level of analysis for inbound email. For outgoing email, the local security gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The onsite security gateway can also assist Microsoft Exchange Server to track and safeguard internal email traffic that originates and ends inside your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. Using 2FA, when you sign into a protected application and enter your password you are asked to verify who you are on a device that only you have and that uses a separate network channel. A wide selection of out-of-band devices can be used for this second means of ID validation including a smartphone or watch, a hardware/software token, a landline telephone, etc. You may register multiple validation devices. For details about ProSight Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Help Desk services permit your information technology team to offload Support Desk services to Progent or split activity for support services seamlessly between your in-house network support resources and Progent's nationwide pool of IT service engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a smooth supplement to your internal IT support organization. End user interaction with the Help Desk, delivery of support services, problem escalation, ticket generation and tracking, efficiency metrics, and maintenance of the service database are consistent whether issues are taken care of by your corporate support resources, by Progent, or a mix of the two. Learn more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes next generation behavior machine learning technology to defend endpoints as well as physical and virtual servers against new malware assaults like ransomware and file-less exploits, which routinely evade traditional signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and offers a single platform to manage the entire threat progression including protection, detection, containment, cleanup, and post-attack forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, find and safeguard information related to your IT infrastructure, processes, business apps, and services. You can quickly find passwords or IP addresses and be warned automatically about upcoming expirations of SSLs ,domains or warranties. By updating and managing your IT documentation, you can save up to half of time wasted trying to find vital information about your network. ProSight IT Asset Management includes a centralized location for holding and sharing all documents required for managing your network infrastructure like recommended procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT data. Whether you're planning enhancements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need when you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer organizations of all sizes a versatile and affordable solution for assessing, validating, scheduling, implementing, and documenting updates to your ever-evolving IT network. Besides maximizing the protection and functionality of your IT network, Progent's patch management services allow your IT staff to concentrate on line-of-business initiatives and activities that deliver the highest business value from your information network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host configured and managed by Progent's network support experts. Under the ProSight Virtual Hosting service model, the customer owns the data, the OS platforms, and the apps. Because the system is virtualized, it can be moved easily to a different hardware solution without a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior machine learning technology to guard physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which routinely escape traditional signature-matching anti-virus products. ProSight ASM safeguards local and cloud-based resources and provides a unified platform to address the complete threat lifecycle including protection, infiltration detection, containment, remediation, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection services offer affordable in-depth protection for physical and virtual servers, desktops, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and responding to security assaults from all vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, endpoint control, and web filtering through leading-edge technologies incorporated within one agent managed from a unified console. Progent's data protection and virtualization consultants can assist you to plan and configure a ProSight ESP environment that addresses your company's specific requirements and that allows you prove compliance with legal and industry information protection regulations. Progent will assist you define and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that require immediate action. Progent can also help you to set up and verify a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange filtering.