24-7 Greensboro Critical Crypto
Infection Assessment and Remediation Consulting

Crypto-Ransomware : Your Feared IT Catastrophe
Ransomware has become an escalating cyberplague that poses an existential threat for businesses vulnerable to an attack. Multiple generations of ransomware like the CrySIS, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for a long time and still inflict damage. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, along with frequent as yet unnamed viruses, not only encrypt online files but also infect many available system backups. Files synched to off-site disaster recovery sites can also be ransomed. In a poorly designed data protection solution, this can make any restore operations useless and basically knocks the entire system back to zero.

Recovering applications and data after a ransomware attack becomes a sprint against time as the targeted organization fights to stop lateral movement, cleanup the virus, and restore mission-critical activity. Because crypto-ransomware needs time to move laterally, assaults are often sprung during nights and weekends, when penetrations are likely to take more time to detect. This compounds the difficulty of promptly marshalling and orchestrating a capable mitigation team.

Progent has an assortment of solutions for protecting enterprises from ransomware events. These include team training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of the latest generation security gateways with AI technology from SentinelOne to detect and disable new cyber attacks automatically. Progent in addition provides the services of seasoned crypto-ransomware recovery engineers with the track record and commitment to reconstruct a compromised environment as rapidly as possible.

Progent's Ransomware Restoration Services
Subsequent to a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will return the codes to decipher any or all of your data. Kaspersky determined that seventeen percent of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to setup from scratch the key elements of your IT environment. Absent access to complete information backups, this requires a broad range of skill sets, well-coordinated team management, and the capability to work 24x7 until the recovery project is finished.

For two decades, Progent has made available expert Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have earned high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of experience gives Progent the capability to efficiently understand necessary systems and integrate the remaining pieces of your Information Technology environment after a ransomware event and configure them into a functioning network.

Progent's ransomware group utilizes state-of-the-art project management tools to coordinate the sophisticated restoration process. Progent understands the urgency of working quickly and in concert with a client's management and IT team members to assign priority to tasks and to put the most important systems back on line as soon as possible.

Customer Case Study: A Successful Crypto-Ransomware Penetration Response
A client sought out Progent after their network was penetrated by Ryuk ransomware virus. Ryuk is believed to have been launched by Northern Korean government sponsored criminal gangs, suspected of using technology leaked from the U.S. National Security Agency. Ryuk seeks specific companies with little or no room for operational disruption and is among the most profitable iterations of ransomware malware. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in the Chicago metro area with about 500 employees. The Ryuk attack had shut down all company operations and manufacturing capabilities. The majority of the client's system backups had been on-line at the start of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (exceeding $200K) and hoping for the best, but in the end reached out to Progent.

Progent worked together with the customer to rapidly assess and assign priority to the key applications that needed to be restored in order to continue business functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Accounting and Manufacturing Software

Within two days, Progent was able to recover Active Directory to its pre-virus state. Progent then accomplished reinstallations and storage recovery on needed systems. All Exchange Server ties and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble non-encrypted OST files (Outlook Email Offline Folder Files) on staff desktop computers in order to recover email data. A recent offline backup of the client's accounting systems made them able to recover these vital applications back online for users. Although a lot of work remained to recover completely from the Ryuk virus, essential systems were restored rapidly:

Throughout the next couple of weeks important milestones in the recovery project were completed through tight collaboration between Progent consultants and the client:

• Self-hosted web applications were restored with no loss of information.
• The MailStore Server exceeding four million historical messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory capabilities were fully functional.
• A new Palo Alto Networks 850 security appliance was installed.
• Most of the desktops and laptops were functioning as before the incident.

Conclusion
A probable business-ending disaster was dodged due to hard-working experts, a broad spectrum of technical expertise, and tight teamwork. Although upon completion of forensics the crypto-ransomware virus incident detailed here should have been shut down with advanced cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and well thought out incident response procedures for backup and proper patching controls, the fact is that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware incident, remember that Progent's team of experts has extensive experience in ransomware virus blocking, removal, and data restoration.

To read or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide businesses in Greensboro a variety of online monitoring and security evaluation services designed to assist you to minimize the threat from ransomware. These services utilize next-generation machine learning technology to uncover zero-day strains of ransomware that can evade legacy signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to achieve leading-edge network resilience. Progent handles the necessary monitoring and maintenance for you, so your system expands readily without holding you back. For a low and predictable monthly price, Progent's experienced IT team can be your dependable technology safety net. Entry-level plans include remote monitoring and management (RMM), cybersecurity, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management technology to help keep your IT system running at peak levels by checking the health of vital computers that power your information system. When ProSight LAN Watch detects an issue, an alarm is sent immediately to your specified IT management staff and your assigned Progent engineering consultant so any potential issues can be resolved before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for monitoring and managing your client-server infrastructure by providing an environment for performing common time-consuming jobs. These include health checking, update management, automated remediation, endpoint setup, backup and restore, anti-virus response, remote access, built-in and custom scripts, asset inventory, endpoint profile reports, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alert to your specified IT management personnel and your Progent technical consultant so potential issues can be taken care of before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for smaller organizations to diagram, monitor, optimize and debug their networking appliances such as routers, firewalls, and load balancers plus servers, printers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, WAN Watch ensures that infrastructure topology maps are always updated, copies and displays the configuration of almost all devices connected to your network, monitors performance, and sends notices when issues are detected. By automating complex management and troubleshooting processes, WAN Watch can cut hours off common tasks such as making network diagrams, reconfiguring your network, finding devices that need critical software patches, or isolating performance issues. Find out more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time and in-depth reporting plug-ins created to integrate with the top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-up or endpoints with missing patches. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has partnered with leading backup software companies to produce ProSight Data Protection Services (DPS), a selection of management offerings that provide backup-as-a-service. ProSight DPS services manage and track your backup operations and allow transparent backup and rapid restoration of critical files, applications, images, and virtual machines. ProSight DPS lets you protect against data loss resulting from hardware failures, natural disasters, fire, cyber attacks like ransomware, human mistakes, malicious insiders, or software glitches. Managed backup services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of top information security vendors to deliver centralized control and comprehensive security for all your email traffic. The powerful architecture of Progent's Email Guard managed service combines cloud-based filtering with an on-premises security gateway appliance to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's Cloud Protection Layer acts as a first line of defense and blocks most unwanted email from making it to your network firewall. This decreases your exposure to inbound threats and conserves network bandwidth and storage. Email Guard's onsite gateway appliance adds a deeper level of analysis for inbound email. For outbound email, the on-premises security gateway offers anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to monitor and protect internal email that stays inside your corporate firewall. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans incorporate Cisco's Duo cloud technology to defend against password theft by using two-factor authentication. Duo supports single-tap identity confirmation on Apple iOS, Android, and other personal devices. With Duo 2FA, whenever you log into a protected online account and enter your password you are requested to confirm who you are on a unit that only you possess and that uses a separate network channel. A wide selection of out-of-band devices can be used as this second means of authentication including a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can designate multiple validation devices. To learn more about ProSight Duo two-factor identity authentication services, see Duo MFA two-factor authentication services.

• Outsourced/Co-managed Service Desk: Help Desk Managed Services
  Progent's Call Desk managed services allow your information technology staff to offload Call Center services to Progent or divide activity for Help Desk services seamlessly between your in-house network support team and Progent's extensive roster of IT service technicians, engineers and subject matter experts. Progent's Co-managed Service Desk offers a seamless supplement to your core IT support staff. Client interaction with the Service Desk, delivery of support services, issue escalation, trouble ticket generation and tracking, efficiency measurement, and maintenance of the support database are cohesive whether issues are resolved by your in-house network support group, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Service Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior machine learning technology to defend endpoints as well as physical and virtual servers against new malware attacks such as ransomware and email phishing, which routinely escape legacy signature-based anti-virus tools. Progent ASM services protect local and cloud-based resources and offers a single platform to manage the entire threat lifecycle including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered attacks. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, find and safeguard data about your IT infrastructure, processes, applications, and services. You can quickly find passwords or IP addresses and be warned about impending expirations of SSLs or domains. By updating and managing your IT documentation, you can save as much as 50% of time wasted looking for vital information about your network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and associating IT information. Whether you're planning enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the information you require the instant you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management provide businesses of any size a flexible and affordable alternative for evaluating, testing, scheduling, implementing, and tracking updates to your ever-evolving IT network. In addition to optimizing the protection and functionality of your computer environment, Progent's patch management services allow your IT team to concentrate on line-of-business initiatives and activities that derive maximum business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's IT support experts. With Progent's ProSight Virtual Hosting service model, the client owns the data, the OS platforms, and the apps. Since the environment is virtualized, it can be moved easily to an alternate hardware environment without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior analysis tools to guard physical and virtual endpoint devices against modern malware attacks like ransomware and file-less exploits, which easily get by legacy signature-matching AV tools. ProSight ASM safeguards on-premises and cloud resources and provides a unified platform to automate the complete threat progression including blocking, detection, containment, remediation, and forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection services offer ultra-affordable in-depth security for physical and virtual servers, workstations, smartphones, and Exchange Server. ProSight ESP uses contextual security and advanced machine learning for round-the-clock monitoring and responding to security assaults from all vectors. ProSight ESP provides firewall protection, intrusion alarms, endpoint control, and web filtering through leading-edge technologies incorporated within one agent managed from a unified console. Progent's data protection and virtualization consultants can assist you to plan and configure a ProSight ESP environment that addresses your organization's specific needs and that helps you prove compliance with legal and industry information security regulations. Progent will assist you specify and configure policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that call for urgent attention. Progent can also assist your company to install and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.