El Paso 24-7 Emergency Crypto
Virus Identification and Remediation Help

Crypto-Ransomware : Your Feared Information Technology Nightmare
Ransomware has become an escalating cyberplague that represents an extinction-level danger for businesses of all sizes unprepared for an assault. Different iterations of crypto-ransomware like the CrySIS, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for years and still inflict havoc. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, along with daily unnamed malware, not only encrypt online data files but also infiltrate most accessible system restores and backups. Files synched to the cloud can also be held hostage. In a vulnerable environment, this can render any restoration impossible and basically knocks the network back to zero.

Getting back on-line applications and information after a ransomware outage becomes a race against the clock as the targeted organization tries its best to contain the damage, remove the ransomware, and resume business-critical activity. Due to the fact that ransomware requires time to replicate, assaults are often launched during weekends and nights, when attacks typically take more time to detect. This compounds the difficulty of promptly marshalling and coordinating an experienced response team.

Progent makes available an assortment of services for protecting organizations from ransomware attacks. These include staff education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of next-generation security solutions with artificial intelligence capabilities from SentinelOne to identify and extinguish new cyber attacks quickly. Progent in addition can provide the services of seasoned crypto-ransomware recovery consultants with the track record and perseverance to re-deploy a breached system as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a crypto-ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will respond with the needed codes to unencrypt any or all of your information. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never restored their files even after having paid the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The alternative is to setup from scratch the vital elements of your IT environment. Absent access to full information backups, this calls for a broad range of skills, professional project management, and the willingness to work non-stop until the job is finished.

For decades, Progent has made available certified expert Information Technology services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained top industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in accounting and ERP software solutions. This breadth of expertise affords Progent the ability to rapidly understand necessary systems and consolidate the remaining components of your network environment after a crypto-ransomware attack and assemble them into a functioning network.

Progent's recovery group deploys powerful project management tools to orchestrate the complex restoration process. Progent knows the urgency of working quickly and together with a client's management and Information Technology team members to assign priority to tasks and to get the most important services back online as fast as possible.

Client Story: A Successful Ransomware Attack Recovery
A customer hired Progent after their network was penetrated by the Ryuk ransomware. Ryuk is thought to have been created by North Korean government sponsored criminal gangs, possibly using technology leaked from America's National Security Agency. Ryuk seeks specific organizations with little ability to sustain operational disruption and is one of the most lucrative instances of ransomware viruses. Major victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing business located in Chicago and has about 500 employees. The Ryuk attack had brought down all essential operations and manufacturing processes. The majority of the client's backups had been on-line at the beginning of the intrusion and were encrypted. The client was taking steps for paying the ransom demand (in excess of $200,000) and praying for the best, but ultimately reached out to Progent.

Progent worked together with the client to rapidly identify and prioritize the essential applications that needed to be restored in order to restart business functions:

• Active Directory
• Microsoft Exchange
• MRP System

In less than two days, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then performed setup and storage recovery on mission critical applications. All Exchange data and attributes were usable, which greatly helped the restore of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Off-Line Data Files) on user workstations to recover email data. A recent offline backup of the customer's financials/MRP software made it possible to restore these required services back on-line. Although a lot of work still had to be done to recover completely from the Ryuk virus, essential systems were restored quickly:

Throughout the following couple of weeks important milestones in the restoration process were achieved in tight cooperation between Progent consultants and the customer:

• Internal web sites were brought back up with no loss of information.
• The MailStore Exchange Server containing more than 4 million archived emails was brought online and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/AR/Inventory Control functions were fully operational.
• A new Palo Alto Networks 850 security appliance was installed.
• 90% of the user desktops and notebooks were being used by staff.

Conclusion
A likely business-killing catastrophe was evaded by results-oriented experts, a wide range of technical expertise, and tight teamwork. Although in hindsight the ransomware virus attack detailed here would have been identified and blocked with modern security systems and NIST Cybersecurity Framework best practices, staff education, and appropriate security procedures for information protection and applying software patches, the fact is that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, removal, and file disaster recovery.

To read or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in El Paso a variety of online monitoring and security assessment services to help you to reduce the threat from ransomware. These services incorporate next-generation machine learning technology to uncover new variants of crypto-ransomware that can get past legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve leading-edge IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your system expands easily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Basic packages include remote monitoring and management, cybersecurity, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) techniques to keep your network running efficiently by tracking the health of vital computers that drive your business network. When ProSight LAN Watch detects a problem, an alert is transmitted automatically to your specified IT management personnel and your Progent consultant so that all looming problems can be resolved before they can impact your network. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your client-server infrastructure by providing tools for performing common time-consuming tasks. These can include health checking, patch management, automated remediation, endpoint deployment, backup and restore, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alarm to your specified IT personnel and your assigned Progent consultant so that emerging issues can be taken care of before they interfere with your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized businesses to map, monitor, reconfigure and troubleshoot their connectivity appliances such as routers and switches, firewalls, and wireless controllers plus servers, printers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology diagrams are kept current, captures and displays the configuration of virtually all devices connected to your network, tracks performance, and generates notices when problems are detected. By automating time-consuming management and troubleshooting activities, ProSight WAN Watch can cut hours off common tasks like network mapping, reconfiguring your network, locating devices that need important software patches, or resolving performance issues. Learn more about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of in-depth management reporting tools created to work with the industry's leading ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues like inconsistent support follow-up or machines with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has partnered with leading backup/restore technology companies to produce ProSight Data Protection Services (DPS), a selection of management offerings that provide backup-as-a-service (BaaS). ProSight DPS services manage and track your backup processes and enable non-disruptive backup and fast restoration of important files/folders, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business recover from data loss resulting from equipment breakdown, natural calamities, fire, malware such as ransomware, human mistakes, ill-intentioned insiders, or software bugs. Managed backup services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to identify which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of leading information security companies to provide web-based management and world-class security for your inbound and outbound email. The powerful architecture of Email Guard managed service combines cloud-based filtering with a local gateway device to offer complete protection against spam, viruses, Dos Attacks, DHAs, and other email-based malware. The Cloud Protection Layer serves as a first line of defense and keeps the vast majority of threats from reaching your security perimeter. This decreases your exposure to external threats and conserves system bandwidth and storage space. Email Guard's on-premises security gateway device adds a deeper level of inspection for incoming email. For outbound email, the onsite gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The local security gateway can also assist Exchange Server to track and protect internal email traffic that stays inside your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to protect against password theft through the use of two-factor authentication. Duo enables one-tap identity verification on iOS, Android, and other out-of-band devices. Using Duo 2FA, when you log into a protected online account and enter your password you are requested to verify your identity via a unit that only you possess and that uses a separate network channel. A broad range of out-of-band devices can be utilized as this second form of authentication such as a smartphone or watch, a hardware token, a landline phone, etc. You can designate several validation devices. To learn more about ProSight Duo two-factor identity authentication services, go to Cisco Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Help Desk: Call Center Managed Services
  Progent's Support Desk services enable your information technology staff to offload Help Desk services to Progent or divide activity for Service Desk support seamlessly between your internal support group and Progent's extensive roster of IT service technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a transparent extension of your corporate support team. End user access to the Service Desk, provision of support services, escalation, ticket creation and updates, efficiency measurement, and maintenance of the support database are consistent regardless of whether incidents are resolved by your in-house support group, by Progent, or both. Read more about Progent's outsourced/shared Service Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that incorporates cutting edge behavior analysis tools to defend endpoint devices as well as servers and VMs against new malware attacks like ransomware and file-less exploits, which routinely escape traditional signature-matching anti-virus tools. Progent ASM services safeguard local and cloud resources and offers a single platform to address the complete malware attack lifecycle including filtering, infiltration detection, mitigation, remediation, and forensics. Key features include one-click rollback with Windows VSS and real-time system-wide immunization against newly discovered attacks. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, retrieve and safeguard data related to your network infrastructure, processes, applications, and services. You can quickly find passwords or serial numbers and be warned automatically about impending expirations of SSL certificates or domains. By cleaning up and managing your IT documentation, you can save as much as 50% of time wasted trying to find critical information about your IT network. ProSight IT Asset Management includes a centralized location for holding and sharing all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT information. Whether you're making enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the information you require the instant you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a versatile and cost-effective alternative for assessing, validating, scheduling, applying, and documenting updates to your ever-evolving IT network. In addition to optimizing the protection and reliability of your computer network, Progent's software/firmware update management services free up time for your in-house IT team to concentrate on line-of-business projects and tasks that deliver maximum business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a secure Tier III data center on a high-performance virtual host configured and maintained by Progent's IT support experts. With Progent's ProSight Virtual Hosting service model, the client owns the data, the operating system platforms, and the apps. Because the environment is virtualized, it can be ported immediately to an alternate hosting solution without requiring a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, you are not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior-based machine learning tools to defend physical and virtual endpoint devices against new malware assaults like ransomware and file-less exploits, which easily evade traditional signature-based anti-virus tools. ProSight ASM protects local and cloud-based resources and offers a unified platform to manage the entire malware attack lifecycle including filtering, identification, containment, remediation, and post-attack forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services offer affordable multi-layer security for physical servers and VMs, workstations, smartphones, and Exchange Server. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and responding to security threats from all attack vectors. ProSight ESP provides firewall protection, penetration alerts, device control, and web filtering via leading-edge tools packaged within a single agent managed from a unified console. Progent's data protection and virtualization experts can help you to plan and configure a ProSight ESP deployment that meets your company's specific needs and that allows you demonstrate compliance with legal and industry information protection standards. Progent will help you define and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for immediate attention. Progent's consultants can also help you to set up and verify a backup and restore system such as ProSight Data Protection Services so you can get back in business rapidly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.