24x7 Harrisburg Immediate Ransomware
Computer Malware Assessment and Restoration Support

Ransomware : Your Worst IT Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level danger for organizations vulnerable to an assault. Different versions of ransomware like the CrySIS, WannaCry, Locky, SamSam and MongoLock cryptoworms have been circulating for a long time and continue to inflict destruction. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, as well as more as yet unnamed viruses, not only encrypt on-line critical data but also infiltrate many accessible system protection. Files synched to the cloud can also be ransomed. In a poorly architected environment, this can render automatic restore operations useless and effectively knocks the entire system back to zero.

Restoring applications and information after a crypto-ransomware outage becomes a sprint against the clock as the targeted business tries its best to contain, clear the virus, and restore enterprise-critical activity. Due to the fact that ransomware takes time to spread, penetrations are frequently launched during weekends and nights, when successful attacks may take more time to identify. This compounds the difficulty of promptly assembling and orchestrating a capable response team.

Progent offers an assortment of help services for securing organizations from crypto-ransomware penetrations. Among these are user training to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of the latest generation security appliances with machine learning technology from SentinelOne to identify and extinguish new cyber threats intelligently. Progent also provides the services of seasoned ransomware recovery consultants with the skills and perseverance to restore a compromised system as rapidly as possible.

Progent's Ransomware Recovery Services
Following a ransomware attack, sending the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will return the needed codes to decipher any of your data. Kaspersky ascertained that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The fallback is to piece back together the mission-critical elements of your Information Technology environment. Without access to full data backups, this calls for a wide complement of skills, top notch project management, and the capability to work 24x7 until the task is complete.

For two decades, Progent has provided expert Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained advanced certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in accounting and ERP application software. This breadth of experience gives Progent the capability to quickly identify critical systems and re-organize the surviving pieces of your network system after a ransomware event and assemble them into an operational network.

Progent's recovery team of experts uses best of breed project management tools to orchestrate the complicated restoration process. Progent understands the importance of acting quickly and in concert with a client's management and Information Technology team members to assign priority to tasks and to get the most important systems back on-line as soon as humanly possible.

Client Story: A Successful Crypto-Ransomware Intrusion Response
A small business sought out Progent after their network system was penetrated by Ryuk ransomware. Ryuk is thought to have been launched by North Korean government sponsored cybercriminals, suspected of using techniques leaked from the United States NSA organization. Ryuk goes after specific companies with limited room for disruption and is one of the most lucrative iterations of ransomware malware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business based in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had disabled all company operations and manufacturing capabilities. The majority of the client's system backups had been directly accessible at the beginning of the attack and were damaged. The client was evaluating paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but ultimately utilized Progent.

Progent worked together with the client to rapidly identify and assign priority to the mission critical areas that had to be addressed to make it possible to resume departmental operations:

• Windows Active Directory
• Microsoft Exchange Server
• Accounting/MRP

In less than two days, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then completed rebuilding and storage recovery on needed systems. All Exchange schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Off-Line Folder Files) on user PCs in order to recover mail data. A not too old offline backup of the customer's accounting/MRP software made it possible to return these essential applications back servicing users. Although a lot of work still had to be done to recover totally from the Ryuk damage, core systems were recovered rapidly:

Over the next month key milestones in the restoration project were completed in tight cooperation between Progent team members and the client:

• In-house web applications were brought back up with no loss of information.
• The MailStore Server exceeding four million archived messages was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control modules were 100 percent restored.
• A new Palo Alto 850 firewall was brought on-line.
• 90% of the user workstations were functioning as before the incident.

Conclusion
A possible enterprise-killing catastrophe was dodged through the efforts of dedicated professionals, a wide spectrum of knowledge, and tight teamwork. Although upon completion of forensics the ransomware penetration detailed here should have been identified and prevented with up-to-date cyber security technology and best practices, user and IT administrator education, and appropriate incident response procedures for data backup and proper patching controls, the reality is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's team of experts has extensive experience in ransomware virus blocking, cleanup, and information systems recovery.

To review or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers companies in Harrisburg a portfolio of online monitoring and security evaluation services to help you to minimize the threat from ransomware. These services incorporate next-generation artificial intelligence technology to uncover zero-day variants of ransomware that can escape detection by traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent handles the daily monitoring and management for you, so your network scales easily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's experienced IT team can be your complete technology safety net. Basic packages include remote monitoring and management, cybersecurity, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management (RMM) techniques to keep your IT system running at peak levels by checking the health of critical assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alert is transmitted automatically to your specified IT staff and your assigned Progent consultant so all potential problems can be addressed before they can disrupt your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for monitoring and managing your client-server infrastructure by offering tools for performing common time-consuming jobs. These include health checking, patch management, automated repairs, endpoint deployment, backup and recovery, A/V protection, remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and debugging support. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it transmits an alert to your specified IT staff and your Progent consultant so potential issues can be taken care of before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller businesses to map out, monitor, reconfigure and debug their connectivity hardware like routers, firewalls, and access points as well as servers, printers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology maps are kept current, captures and manages the configuration information of virtually all devices connected to your network, tracks performance, and sends alerts when potential issues are detected. By automating complex management activities, WAN Watch can knock hours off ordinary tasks like making network diagrams, expanding your network, locating appliances that require important updates, or isolating performance bottlenecks. Learn more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of in-depth reporting plug-ins designed to integrate with the top ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues like inconsistent support follow-up or endpoints with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore software companies to produce ProSight Data Protection Services (DPS), a selection of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and monitor your data backup processes and allow non-disruptive backup and fast restoration of important files, apps, system images, plus Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss caused by equipment breakdown, natural calamities, fire, cyber attacks such as ransomware, user mistakes, malicious insiders, or application glitches. Managed backup services available in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of top data security vendors to deliver centralized control and comprehensive security for all your email traffic. The hybrid structure of Progent's Email Guard managed service combines cloud-based filtering with a local security gateway device to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The cloud filter acts as a first line of defense and blocks the vast majority of threats from reaching your security perimeter. This reduces your exposure to inbound attacks and conserves network bandwidth and storage. Email Guard's onsite gateway appliance adds a deeper level of inspection for incoming email. For outgoing email, the local gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email that stays within your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication (2FA). Duo supports one-tap identity verification with iOS, Google Android, and other out-of-band devices. With 2FA, whenever you sign into a secured online account and enter your password you are asked to verify your identity via a device that only you have and that is accessed using a different network channel. A broad range of out-of-band devices can be used for this second means of ID validation such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You may designate multiple verification devices. For more information about Duo identity validation services, refer to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Help Desk: Help Desk Managed Services
  Progent's Support Desk services enable your information technology staff to outsource Support Desk services to Progent or split responsibilities for Help Desk services seamlessly between your in-house network support group and Progent's extensive roster of certified IT service engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a transparent supplement to your corporate support staff. User access to the Service Desk, provision of technical assistance, problem escalation, ticket generation and tracking, performance measurement, and management of the support database are cohesive regardless of whether incidents are taken care of by your core network support organization, by Progent, or a mix of the two. Find out more about Progent's outsourced/shared Help Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior analysis technology to guard endpoints and physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which routinely get by legacy signature-matching anti-virus products. Progent ASM services safeguard on-premises and cloud resources and offers a unified platform to address the entire malware attack lifecycle including blocking, detection, containment, cleanup, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against new attacks. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, retrieve and protect information about your network infrastructure, processes, business apps, and services. You can quickly find passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates or domains. By updating and managing your IT infrastructure documentation, you can save as much as half of time thrown away searching for critical information about your IT network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents required for managing your business network like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT information. Whether you're planning enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you require when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for patch management provide businesses of any size a flexible and cost-effective alternative for assessing, testing, scheduling, applying, and documenting updates to your dynamic information system. Besides maximizing the protection and reliability of your IT network, Progent's patch management services free up time for your IT staff to concentrate on line-of-business initiatives and tasks that deliver the highest business value from your information network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a protected Tier III data center on a fast virtual host configured and maintained by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the customer owns the data, the operating system software, and the applications. Because the system is virtualized, it can be moved easily to a different hosting solution without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior-based analysis technology to guard physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which easily evade traditional signature-matching AV tools. ProSight Active Security Monitoring protects local and cloud-based resources and offers a unified platform to address the entire threat lifecycle including blocking, detection, mitigation, cleanup, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection managed services deliver economical multi-layer security for physical servers and VMs, desktops, smartphones, and Exchange email. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and responding to security assaults from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, endpoint control, and web filtering via cutting-edge technologies packaged within a single agent managed from a single control. Progent's data protection and virtualization consultants can help you to design and configure a ProSight ESP deployment that meets your company's unique needs and that helps you prove compliance with legal and industry data security regulations. Progent will assist you define and implement policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that call for urgent attention. Progent's consultants can also assist your company to set up and verify a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.