24x7x365 Fort Myers Immediate Ransomware
Infection Assessment and Recovery Consulting

Crypto-Ransomware : Your Worst IT Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that represents an existential threat for organizations vulnerable to an assault. Multiple generations of ransomware such as Reveton, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for many years and still cause damage. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, plus additional as yet unnamed viruses, not only encrypt online data but also infect most accessible system protection. Data synched to cloud environments can also be corrupted. In a poorly architected system, it can render automatic restore operations useless and effectively sets the network back to zero.

Recovering applications and information after a ransomware outage becomes a race against the clock as the targeted business fights to stop the spread, clear the ransomware, and resume enterprise-critical activity. Due to the fact that crypto-ransomware takes time to spread, penetrations are usually sprung during nights and weekends, when successful attacks typically take longer to discover. This multiplies the difficulty of promptly assembling and coordinating a qualified response team.

Progent has an assortment of solutions for securing enterprises from ransomware events. These include team training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of next-generation security appliances with AI capabilities from SentinelOne to detect and suppress day-zero cyber attacks intelligently. Progent in addition provides the services of seasoned ransomware recovery engineers with the talent and perseverance to re-deploy a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Following a ransomware event, even paying the ransom demands in cryptocurrency does not guarantee that merciless criminals will respond with the keys to unencrypt any of your data. Kaspersky estimated that 17% of crypto-ransomware victims never restored their data even after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The alternative is to setup from scratch the mission-critical parts of your Information Technology environment. Absent the availability of full information backups, this calls for a wide complement of IT skills, well-coordinated team management, and the capability to work 24x7 until the task is complete.

For twenty years, Progent has made available certified expert IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of experience provides Progent the ability to rapidly identify necessary systems and consolidate the surviving parts of your IT environment following a ransomware event and assemble them into an operational system.

Progent's security team of experts has best of breed project management systems to coordinate the complicated recovery process. Progent knows the urgency of working quickly and in concert with a customer's management and Information Technology team members to assign priority to tasks and to get the most important applications back on-line as fast as humanly possible.

Client Case Study: A Successful Ransomware Virus Response
A small business contacted Progent after their organization was penetrated by the Ryuk ransomware. Ryuk is thought to have been created by North Korean government sponsored criminal gangs, suspected of using technology exposed from the U.S. National Security Agency. Ryuk seeks specific organizations with little or no room for disruption and is one of the most profitable examples of ransomware malware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business based in the Chicago metro area with about 500 employees. The Ryuk event had shut down all essential operations and manufacturing processes. Most of the client's data backups had been online at the start of the attack and were encrypted. The client was taking steps for paying the ransom (exceeding $200K) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked with the customer to quickly assess and assign priority to the essential services that needed to be restored in order to resume business functions:

• Windows Active Directory
• Microsoft Exchange
• Financials/MRP

Within 2 days, Progent was able to recover Active Directory services to its pre-attack state. Progent then accomplished setup and hard drive recovery on the most important applications. All Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Outlook Email Offline Data Files) on user desktop computers and laptops in order to recover mail messages. A not too old off-line backup of the customer's accounting/ERP software made them able to recover these required services back servicing users. Although significant work remained to recover totally from the Ryuk attack, core systems were recovered rapidly:

Throughout the following couple of weeks critical milestones in the recovery process were made in close cooperation between Progent engineers and the client:

• Internal web applications were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server exceeding 4 million historical messages was spun up and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/AR/Inventory Control modules were 100 percent functional.
• A new Palo Alto Networks 850 security appliance was brought online.
• 90% of the user workstations were functioning as before the incident.

Conclusion
A likely business extinction disaster was averted with results-oriented experts, a wide array of IT skills, and tight teamwork. Although in retrospect the ransomware penetration described here should have been shut down with up-to-date cyber security technology solutions and recognized best practices, user training, and appropriate incident response procedures for information protection and keeping systems up to date with security patches, the fact remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's roster of professionals has a proven track record in ransomware virus blocking, mitigation, and information systems restoration.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Fort Myers a variety of online monitoring and security evaluation services designed to assist you to minimize the threat from ransomware. These services incorporate modern AI technology to uncover zero-day variants of ransomware that are able to escape detection by legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your network scales smoothly without holding you back. For a low and predictable monthly subscription, Progent's experienced IT group can be your complete technology safety net. Entry-level packages include remote monitoring and management (RMM), security, automatic monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management (RMM) technology to keep your network running at peak levels by tracking the state of vital assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alert is transmitted automatically to your designated IT staff and your Progent engineering consultant so any potential problems can be addressed before they have a chance to disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your client-server infrastructure by providing an environment for performing common tedious tasks. These include health monitoring, patch management, automated remediation, endpoint setup, backup and restore, A/V defense, secure remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your specified IT personnel and your assigned Progent technical consultant so that potential problems can be taken care of before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it simple and affordable for small and mid-sized businesses to diagram, track, enhance and debug their connectivity appliances like switches, firewalls, and wireless controllers as well as servers, client computers and other devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that network diagrams are kept updated, captures and manages the configuration of virtually all devices connected to your network, tracks performance, and sends notices when potential issues are detected. By automating time-consuming management and troubleshooting processes, WAN Watch can knock hours off ordinary chores like making network diagrams, reconfiguring your network, locating appliances that require critical updates, or resolving performance issues. Find out more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time management reporting plug-ins created to integrate with the industry's top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as inconsistent support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software companies to create ProSight Data Protection Services (DPS), a family of offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup operations and allow non-disruptive backup and rapid restoration of vital files/folders, applications, images, plus virtual machines. ProSight DPS helps you avoid data loss caused by equipment breakdown, natural calamities, fire, malware like ransomware, user error, malicious employees, or software glitches. Managed services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can help you to determine which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the infrastructure of leading information security vendors to deliver centralized control and world-class protection for all your inbound and outbound email. The powerful structure of Progent's Email Guard managed service integrates cloud-based filtering with a local security gateway device to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's Cloud Protection Layer acts as a first line of defense and keeps the vast majority of threats from making it to your network firewall. This decreases your vulnerability to inbound attacks and conserves network bandwidth and storage. Email Guard's on-premises security gateway appliance provides a further layer of analysis for inbound email. For outgoing email, the onsite gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also assist Microsoft Exchange Server to track and protect internal email traffic that stays within your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo technology to protect against password theft by using two-factor authentication (2FA). Duo enables one-tap identity verification on Apple iOS, Android, and other personal devices. Using Duo 2FA, whenever you log into a protected online account and enter your password you are requested to verify who you are via a device that only you possess and that is accessed using a different network channel. A wide selection of devices can be utilized as this added means of authentication such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You can designate multiple validation devices. For more information about Duo identity authentication services, go to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Desk: Support Desk Managed Services
  Progent's Help Desk services enable your IT group to outsource Support Desk services to Progent or divide activity for Help Desk services transparently between your internal network support resources and Progent's nationwide pool of IT support technicians, engineers and subject matter experts. Progent's Shared Service Desk offers a seamless extension of your in-house support resources. End user access to the Help Desk, provision of support, problem escalation, ticket creation and tracking, efficiency measurement, and management of the service database are cohesive whether incidents are resolved by your corporate IT support group, by Progent, or a mix of the two. Learn more about Progent's outsourced/shared Help Center services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that utilizes cutting edge behavior machine learning tools to guard endpoints as well as servers and VMs against new malware assaults like ransomware and file-less exploits, which easily escape legacy signature-based anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and offers a single platform to manage the complete malware attack progression including blocking, infiltration detection, mitigation, cleanup, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and safeguard data about your network infrastructure, procedures, business apps, and services. You can quickly find passwords or serial numbers and be alerted about impending expirations of SSLs or warranties. By updating and organizing your IT infrastructure documentation, you can eliminate as much as 50% of time wasted searching for vital information about your IT network. ProSight IT Asset Management features a common repository for holding and sharing all documents related to managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT data. Whether you're making enhancements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you require when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer businesses of any size a flexible and affordable alternative for assessing, testing, scheduling, applying, and documenting updates to your ever-evolving information system. In addition to optimizing the security and reliability of your computer environment, Progent's patch management services allow your in-house IT staff to focus on line-of-business initiatives and tasks that derive maximum business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual machine host configured and maintained by Progent's network support experts. Under the ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the applications. Since the system is virtualized, it can be moved easily to a different hosting solution without a lengthy and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior analysis tools to guard physical and virtual endpoints against new malware attacks like ransomware and email phishing, which routinely get by legacy signature-matching AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud resources and offers a unified platform to address the complete threat progression including filtering, infiltration detection, mitigation, remediation, and forensics. Key features include single-click rollback with Windows VSS and automatic system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable in-depth security for physical servers and VMs, desktops, mobile devices, and Exchange Server. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and reacting to security threats from all attack vectors. ProSight ESP offers two-way firewall protection, penetration alerts, device control, and web filtering via cutting-edge technologies incorporated within one agent accessible from a unified control. Progent's security and virtualization consultants can help your business to design and implement a ProSight ESP environment that meets your organization's unique requirements and that allows you demonstrate compliance with government and industry data security standards. Progent will help you define and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that call for urgent attention. Progent can also help your company to install and verify a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange email filtering.