24/7/365 Skokie Immediate Crypto
Computer Virus Detection and Recovery Consulting

Ransomware : Your Crippling IT Catastrophe
Ransomware has become a modern cyberplague that poses an existential danger for businesses of all sizes poorly prepared for an attack. Multiple generations of ransomware such as CrySIS, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been around for years and still cause destruction. More recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, plus daily unnamed viruses, not only encrypt on-line data but also infect all accessible system protection mechanisms. Information synchronized to off-site disaster recovery sites can also be held hostage. In a vulnerable environment, it can make any restoration hopeless and basically sets the datacenter back to square one.

Recovering services and information following a ransomware event becomes a race against the clock as the targeted organization struggles to stop lateral movement, clear the crypto-ransomware, and resume mission-critical activity. Because crypto-ransomware requires time to replicate, attacks are often launched on weekends and holidays, when penetrations tend to take longer to uncover. This multiplies the difficulty of rapidly assembling and coordinating a knowledgeable response team.

Progent makes available a variety of solutions for protecting businesses from crypto-ransomware penetrations. These include team member training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of modern security gateways with artificial intelligence technology from SentinelOne to discover and suppress day-zero threats rapidly. Progent in addition offers the services of experienced ransomware recovery engineers with the track record and perseverance to rebuild a compromised system as rapidly as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware invasion, paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the needed codes to decipher any of your information. Kaspersky estimated that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The other path is to piece back together the essential parts of your IT environment. Without access to complete data backups, this requires a broad range of skills, professional project management, and the capability to work non-stop until the task is over.

For decades, Progent has made available expert IT services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP applications. This breadth of experience provides Progent the ability to efficiently determine important systems and consolidate the remaining pieces of your computer network environment after a ransomware attack and configure them into an operational system.

Progent's recovery team deploys state-of-the-art project management applications to coordinate the complicated recovery process. Progent knows the importance of working quickly and together with a client's management and Information Technology team members to assign priority to tasks and to put the most important applications back on line as fast as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Attack Response
A customer sought out Progent after their network system was attacked by the Ryuk crypto-ransomware. Ryuk is believed to have been launched by Northern Korean government sponsored cybercriminals, suspected of using technology leaked from the United States NSA organization. Ryuk targets specific organizations with little ability to sustain disruption and is among the most profitable incarnations of ransomware. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business located in the Chicago metro area and has about 500 workers. The Ryuk attack had shut down all essential operations and manufacturing processes. The majority of the client's data backups had been online at the start of the intrusion and were damaged. The client was taking steps for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but in the end reached out to Progent.

Progent worked hand in hand the client to rapidly identify and assign priority to the essential applications that needed to be restored to make it possible to restart departmental operations:

• Windows Active Directory
• Email
• Accounting/MRP

Within 2 days, Progent was able to recover Active Directory to its pre-penetration state. Progent then helped perform rebuilding and storage recovery on needed systems. All Exchange ties and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to assemble intact OST data files (Outlook Off-Line Folder Files) on team desktop computers in order to recover email data. A not too old offline backup of the businesses accounting software made them able to restore these required applications back online for users. Although major work remained to recover completely from the Ryuk virus, the most important systems were recovered rapidly:

Throughout the following few weeks key milestones in the recovery process were made through close cooperation between Progent consultants and the client:

• Self-hosted web sites were returned to operation with no loss of data.
• The MailStore Server containing more than 4 million historical messages was restored to operations and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were 100% functional.
• A new Palo Alto Networks 850 firewall was deployed.
• Nearly all of the desktop computers were operational.

Conclusion
A probable business-killing disaster was dodged through the efforts of results-oriented professionals, a wide range of technical expertise, and tight teamwork. Although upon completion of forensics the ransomware virus penetration described here could have been identified and blocked with modern cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and appropriate incident response procedures for information backup and proper patching controls, the fact remains that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incursion, feel confident that Progent's team of professionals has a proven track record in crypto-ransomware virus blocking, remediation, and data recovery.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers companies in Skokie a portfolio of online monitoring and security evaluation services designed to help you to minimize your vulnerability to ransomware. These services utilize modern AI capability to detect zero-day strains of ransomware that can evade legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to achieve advanced IT resilience. Progent handles the necessary monitoring and management for you, so your network scales readily without holding you back. For an affordable and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Entry-level plans include remote monitoring and management (RMM), security, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-in-class solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management technology to keep your IT system running efficiently by checking the health of critical computers that power your business network. When ProSight LAN Watch uncovers a problem, an alert is sent automatically to your specified IT staff and your Progent consultant so any looming issues can be resolved before they can disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your client-server infrastructure by offering tools for performing common time-consuming jobs. These include health monitoring, patch management, automated remediation, endpoint deployment, backup and restore, A/V response, remote access, built-in and custom scripts, asset inventory, endpoint status reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your designated IT management staff and your Progent technical consultant so potential issues can be fixed before they interfere with your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for smaller businesses to map, monitor, reconfigure and troubleshoot their networking appliances such as routers and switches, firewalls, and wireless controllers plus servers, printers, endpoints and other networked devices. Using state-of-the-art RMM technology, WAN Watch makes sure that infrastructure topology maps are kept updated, captures and displays the configuration information of virtually all devices on your network, monitors performance, and generates notices when issues are discovered. By automating time-consuming network management activities, WAN Watch can knock hours off ordinary tasks such as network mapping, reconfiguring your network, finding appliances that need important updates, or identifying the cause of performance bottlenecks. Learn more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time reporting tools designed to integrate with the top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues like spotty support follow-through or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with advanced backup technology companies to create ProSight Data Protection Services, a portfolio of offerings that deliver backup-as-a-service. ProSight DPS services manage and track your data backup processes and allow transparent backup and fast restoration of critical files/folders, apps, images, and virtual machines. ProSight DPS lets your business protect against data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks like ransomware, user error, malicious employees, or application bugs. Managed services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading data security companies to provide web-based management and world-class security for all your email traffic. The powerful architecture of Progent's Email Guard integrates cloud-based filtering with an on-premises gateway device to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's cloud filter acts as a first line of defense and keeps most unwanted email from reaching your security perimeter. This reduces your vulnerability to inbound threats and conserves system bandwidth and storage space. Email Guard's on-premises gateway appliance adds a further level of analysis for incoming email. For outgoing email, the on-premises gateway offers AV and anti-spam filtering, protection against data leaks, and email encryption. The local security gateway can also help Microsoft Exchange Server to monitor and protect internal email that originates and ends inside your security perimeter. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication services utilize Cisco's Duo technology to protect against stolen passwords through the use of two-factor authentication (2FA). Duo supports single-tap identity confirmation on iOS, Google Android, and other out-of-band devices. Using Duo 2FA, whenever you log into a protected application and give your password you are asked to verify who you are via a unit that only you have and that is accessed using a different ("out-of-band") network channel. A broad selection of out-of-band devices can be utilized for this added form of ID validation such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You may register several verification devices. To learn more about ProSight Duo two-factor identity validation services, refer to Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Help Desk managed services permit your information technology team to outsource Support Desk services to Progent or split activity for Service Desk support transparently between your in-house support staff and Progent's extensive pool of certified IT service technicians, engineers and subject matter experts. Progent's Co-managed Service Desk provides a seamless extension of your core IT support resources. Client interaction with the Help Desk, delivery of support, escalation, trouble ticket generation and tracking, efficiency measurement, and maintenance of the support database are cohesive whether issues are taken care of by your internal support group, by Progent, or both. Find out more about Progent's outsourced/shared Service Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection solution that incorporates next generation behavior analysis technology to guard endpoints as well as servers and VMs against new malware attacks such as ransomware and email phishing, which routinely escape legacy signature-based AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and offers a single platform to address the entire threat lifecycle including protection, infiltration detection, containment, remediation, and post-attack forensics. Top capabilities include one-click rollback using Windows VSS and automatic system-wide immunization against newly discovered attacks. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, find and safeguard data about your network infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be warned automatically about upcoming expirations of SSLs or warranties. By cleaning up and managing your IT infrastructure documentation, you can eliminate up to half of time spent searching for critical information about your network. ProSight IT Asset Management features a centralized location for holding and collaborating on all documents required for managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and associating IT information. Whether you're planning improvements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the information you require when you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer businesses of all sizes a flexible and cost-effective solution for evaluating, testing, scheduling, implementing, and tracking updates to your ever-evolving IT system. Besides optimizing the security and reliability of your IT environment, Progent's patch management services permit your IT team to focus on line-of-business initiatives and activities that deliver the highest business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a protected Tier III data center on a high-performance virtual host configured and maintained by Progent's IT support professionals. With Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the operating system software, and the applications. Because the system is virtualized, it can be ported easily to an alternate hosting solution without requiring a time-consuming and difficult configuration process. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior-based machine learning technology to defend physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which routinely evade traditional signature-based AV products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a single platform to address the complete threat lifecycle including protection, detection, containment, cleanup, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver economical multi-layer protection for physical servers and virtual machines, workstations, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and responding to cyber assaults from all attack vectors. ProSight ESP delivers firewall protection, intrusion alerts, device management, and web filtering through cutting-edge technologies packaged within a single agent accessible from a single control. Progent's data protection and virtualization experts can assist your business to plan and configure a ProSight ESP deployment that meets your organization's unique needs and that helps you prove compliance with government and industry information security regulations. Progent will assist you define and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that call for urgent action. Progent's consultants can also help your company to install and verify a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange email filtering.