24/7 Guarulhos Immediate Crypto-Ransomware
Infection Detection and Remediation Help

Ransomware : Your Worst IT Nightmare
Crypto-Ransomware has become a modern cyberplague that poses an extinction-level threat for organizations unprepared for an assault. Multiple generations of crypto-ransomware like the Dharma, Fusob, Locky, NotPetya and MongoLock cryptoworms have been replicating for many years and still inflict harm. More recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, plus more as yet unnamed viruses, not only encrypt on-line files but also infiltrate many available system backup. Data synchronized to the cloud can also be ransomed. In a vulnerable environment, it can make any restore operations hopeless and effectively knocks the entire system back to zero.

Getting back online applications and information following a crypto-ransomware intrusion becomes a sprint against the clock as the victim tries its best to contain, remove the crypto-ransomware, and restore business-critical activity. Since crypto-ransomware takes time to replicate, attacks are frequently sprung on weekends, when successful attacks in many cases take longer to notice. This multiplies the difficulty of rapidly marshalling and coordinating a qualified response team.

Progent offers an assortment of solutions for protecting businesses from ransomware events. Among these are team member education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of modern security gateways with artificial intelligence technology from SentinelOne to discover and disable new cyber threats quickly. Progent in addition offers the services of experienced ransomware recovery engineers with the talent and commitment to reconstruct a compromised network as soon as possible.

Progent's Ransomware Restoration Support Services
After a ransomware attack, sending the ransom in cryptocurrency does not provide any assurance that merciless criminals will return the needed codes to unencrypt any or all of your data. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their files even after having paid the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The alternative is to setup from scratch the essential parts of your Information Technology environment. Absent access to essential information backups, this requires a broad complement of IT skills, top notch team management, and the ability to work 24x7 until the task is done.

For twenty years, Progent has offered expert IT services for businesses throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have been awarded advanced certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-renowned certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in accounting and ERP software solutions. This breadth of expertise gives Progent the ability to rapidly determine necessary systems and re-organize the surviving parts of your IT environment following a crypto-ransomware penetration and configure them into an operational network.

Progent's ransomware team of experts deploys state-of-the-art project management applications to coordinate the complicated restoration process. Progent appreciates the urgency of working rapidly and in concert with a customer's management and IT team members to assign priority to tasks and to put the most important systems back on-line as fast as humanly possible.

Business Case Study: A Successful Ransomware Attack Recovery
A client escalated to Progent after their network was penetrated by the Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean state sponsored cybercriminals, suspected of using strategies exposed from the United States National Security Agency. Ryuk targets specific businesses with little or no ability to sustain disruption and is among the most profitable examples of crypto-ransomware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in the Chicago metro area and has around 500 employees. The Ryuk penetration had shut down all business operations and manufacturing processes. Most of the client's system backups had been online at the start of the attack and were damaged. The client was evaluating paying the ransom demand (exceeding $200,000) and hoping for the best, but in the end made the decision to use Progent.

Progent worked hand in hand the customer to rapidly understand and prioritize the key elements that needed to be recovered to make it possible to restart company operations:

• Windows Active Directory
• Microsoft Exchange Server
• Accounting/MRP

Within two days, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then accomplished rebuilding and storage recovery on critical applications. All Microsoft Exchange Server ties and configuration information were usable, which greatly helped the restore of Exchange. Progent was also able to find intact OST files (Outlook Email Offline Data Files) on staff workstations and laptops to recover email data. A not too old off-line backup of the client's manufacturing software made them able to return these required applications back online. Although a large amount of work still had to be done to recover fully from the Ryuk event, the most important services were recovered rapidly:

Throughout the next few weeks critical milestones in the restoration process were made through tight collaboration between Progent team members and the customer:

• Self-hosted web sites were restored without losing any information.
• The MailStore Exchange Server exceeding 4 million archived messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory capabilities were fully functional.
• A new Palo Alto Networks 850 firewall was deployed.
• Nearly all of the user desktops were fully operational.

Conclusion
A potential business-ending catastrophe was averted due to top-tier professionals, a broad spectrum of subject matter expertise, and tight teamwork. Although in retrospect the ransomware virus incident described here should have been shut down with up-to-date security technology solutions and best practices, user and IT administrator training, and well designed security procedures for information protection and keeping systems up to date with security patches, the reality is that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware incident, remember that Progent's team of experts has proven experience in ransomware virus blocking, removal, and information systems restoration.

To read or download a PDF version of this customer story, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Guarulhos a range of online monitoring and security assessment services to assist you to reduce your vulnerability to ransomware. These services utilize next-generation artificial intelligence capability to uncover new strains of ransomware that are able to get past traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to achieve leading-edge IT resilience. Progent handles the daily monitoring and management for you, so your system expands readily without becoming an obstacle. For an affordable and predictable monthly price, Progent's experienced IT team can be your dependable technology safety net. Basic packages include remote monitoring and management (RMM), security, automatic monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to help keep your network running at peak levels by tracking the health of vital assets that power your information system. When ProSight LAN Watch detects a problem, an alert is transmitted immediately to your designated IT personnel and your assigned Progent engineering consultant so that all looming issues can be resolved before they have a chance to impact your network. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your client-server infrastructure by offering an environment for performing common tedious tasks. These can include health monitoring, patch management, automated remediation, endpoint configuration, backup and recovery, A/V protection, remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alarm to your specified IT staff and your assigned Progent consultant so potential problems can be fixed before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for smaller businesses to map, monitor, reconfigure and troubleshoot their networking appliances such as routers and switches, firewalls, and wireless controllers plus servers, printers, endpoints and other devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology diagrams are kept updated, copies and manages the configuration information of virtually all devices connected to your network, monitors performance, and sends alerts when problems are discovered. By automating tedious management processes, ProSight WAN Watch can knock hours off common chores such as making network diagrams, reconfiguring your network, locating appliances that require important software patches, or isolating performance issues. Find out more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time and in-depth reporting utilities designed to integrate with the industry's leading ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize critical issues like spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore technology providers to create ProSight Data Protection Services (DPS), a family of management offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and monitor your backup processes and allow non-disruptive backup and rapid restoration of vital files, applications, images, and VMs. ProSight DPS helps you protect against data loss caused by hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, user error, ill-intentioned employees, or application bugs. Managed services available in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of leading data security companies to deliver web-based control and world-class protection for your email traffic. The hybrid architecture of Progent's Email Guard managed service combines cloud-based filtering with an on-premises gateway device to provide complete protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne threats. The cloud filter serves as a first line of defense and keeps the vast majority of unwanted email from making it to your network firewall. This reduces your vulnerability to external attacks and conserves network bandwidth and storage. Email Guard's onsite gateway appliance adds a deeper layer of inspection for incoming email. For outgoing email, the local security gateway offers AV and anti-spam protection, DLP, and email encryption. The onsite gateway can also help Microsoft Exchange Server to track and safeguard internal email traffic that originates and ends within your corporate firewall. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication. Duo enables one-tap identity confirmation on Apple iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a protected online account and enter your password you are requested to confirm who you are on a unit that only you have and that is accessed using a different network channel. A wide selection of out-of-band devices can be utilized for this added means of authentication including an iPhone or Android or watch, a hardware token, a landline telephone, etc. You can designate multiple validation devices. To find out more about ProSight Duo identity validation services, visit Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Call Desk: Support Desk Managed Services
  Progent's Call Desk services allow your IT staff to offload Call Center services to Progent or divide responsibilities for Help Desk services seamlessly between your in-house network support resources and Progent's extensive roster of IT support engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a seamless extension of your internal network support staff. Client interaction with the Help Desk, delivery of support, problem escalation, ticket creation and updates, performance measurement, and maintenance of the support database are consistent whether incidents are taken care of by your internal IT support group, by Progent's team, or both. Find out more about Progent's outsourced/co-managed Service Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates next generation behavior machine learning technology to guard endpoint devices as well as servers and VMs against new malware assaults like ransomware and email phishing, which routinely get by legacy signature-matching AV tools. Progent ASM services protect local and cloud resources and offers a unified platform to manage the entire threat progression including blocking, detection, mitigation, remediation, and post-attack forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new attacks. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, retrieve and safeguard data related to your IT infrastructure, procedures, business apps, and services. You can instantly find passwords or serial numbers and be alerted automatically about impending expirations of SSL certificates ,domains or warranties. By cleaning up and organizing your network documentation, you can save up to half of time wasted searching for critical information about your network. ProSight IT Asset Management features a common repository for holding and collaborating on all documents required for managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT information. Whether you're planning improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the data you need when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide organizations of all sizes a flexible and affordable alternative for assessing, testing, scheduling, implementing, and documenting software and firmware updates to your ever-evolving IT network. Besides maximizing the security and functionality of your computer environment, Progent's patch management services free up time for your IT staff to focus on line-of-business initiatives and tasks that derive the highest business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a protected Tier III data center on a fast virtual machine host set up and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the apps. Since the system is virtualized, it can be ported immediately to a different hardware solution without a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, you are not tied a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior-based machine learning technology to defend physical and virtual endpoints against new malware attacks such as ransomware and file-less exploits, which easily get by traditional signature-matching AV tools. ProSight ASM protects local and cloud-based resources and offers a single platform to automate the complete threat lifecycle including protection, infiltration detection, mitigation, cleanup, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver economical in-depth protection for physical servers and virtual machines, workstations, smartphones, and Exchange email. ProSight ESP uses contextual security and modern behavior analysis for continuously monitoring and reacting to cyber threats from all vectors. ProSight ESP delivers firewall protection, penetration alerts, endpoint management, and web filtering through cutting-edge technologies packaged within a single agent managed from a single control. Progent's data protection and virtualization experts can assist your business to plan and configure a ProSight ESP deployment that addresses your company's unique requirements and that allows you demonstrate compliance with legal and industry data security regulations. Progent will assist you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that call for immediate action. Progent can also help you to set up and verify a backup and restore solution like ProSight Data Protection Services so you can recover rapidly from a potentially disastrous cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange filtering.