24x7 Huntington Beach Immediate Crypto-Ransomware
Virus Detection and Removal Support

Ransomware : Your Worst IT Disaster
Ransomware has become an escalating cyber pandemic that presents an extinction-level threat for businesses of all sizes unprepared for an attack. Versions of ransomware like the CryptoLocker, WannaCry, Locky, SamSam and MongoLock cryptoworms have been circulating for a long time and still inflict destruction. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, plus frequent unnamed viruses, not only encrypt online data files but also infect many accessible system backups. Information synchronized to cloud environments can also be corrupted. In a vulnerable environment, it can render any recovery useless and basically knocks the entire system back to zero.

Recovering applications and data following a ransomware intrusion becomes a sprint against time as the victim tries its best to stop lateral movement, remove the virus, and restore business-critical activity. Since ransomware takes time to spread, attacks are frequently sprung on weekends, when successful penetrations typically take more time to detect. This compounds the difficulty of rapidly marshalling and coordinating a capable response team.

Progent provides a variety of help services for securing enterprises from ransomware events. These include staff training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of the latest generation security solutions with artificial intelligence technology from SentinelOne to detect and extinguish zero-day cyber attacks automatically. Progent also offers the assistance of veteran crypto-ransomware recovery engineers with the talent and commitment to reconstruct a breached network as rapidly as possible.

Progent's Ransomware Recovery Help
Following a ransomware invasion, even paying the ransom in cryptocurrency does not guarantee that merciless criminals will provide the keys to decrypt any of your data. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never restored their files even after having paid the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The other path is to setup from scratch the key elements of your Information Technology environment. Without access to complete data backups, this calls for a wide range of IT skills, top notch project management, and the ability to work 24x7 until the task is done.

For two decades, Progent has made available expert Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have attained advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial management and ERP applications. This breadth of expertise provides Progent the capability to efficiently ascertain necessary systems and re-organize the remaining parts of your network system after a ransomware attack and rebuild them into an operational system.

Progent's ransomware team uses powerful project management systems to orchestrate the sophisticated restoration process. Progent appreciates the importance of acting quickly and in unison with a customer's management and Information Technology team members to prioritize tasks and to get critical services back on-line as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Attack Recovery
A business engaged Progent after their network system was taken over by Ryuk ransomware virus. Ryuk is believed to have been developed by Northern Korean state cybercriminals, possibly using algorithms leaked from America's NSA organization. Ryuk seeks specific companies with little ability to sustain operational disruption and is among the most profitable iterations of crypto-ransomware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company located in the Chicago metro area and has about 500 workers. The Ryuk intrusion had disabled all essential operations and manufacturing capabilities. The majority of the client's backups had been directly accessible at the time of the attack and were damaged. The client was taking steps for paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but ultimately engaged Progent.

Progent worked with the client to rapidly get our arms around and assign priority to the critical applications that needed to be restored to make it possible to continue business operations:

• Windows Active Directory
• Email
• MRP System

In less than two days, Progent was able to re-build Active Directory services to its pre-attack state. Progent then assisted with reinstallations and storage recovery on essential systems. All Exchange data and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to collect intact OST files (Outlook Email Off-Line Folder Files) on user workstations to recover mail information. A not too old off-line backup of the client's financials/ERP software made them able to recover these required applications back available to users. Although major work still had to be done to recover fully from the Ryuk damage, essential systems were restored rapidly:

During the next couple of weeks important milestones in the restoration project were completed in close collaboration between Progent consultants and the customer:

• Self-hosted web applications were returned to operation with no loss of information.
• The MailStore Exchange Server with over four million archived messages was brought on-line and available for users.
• CRM/Orders/Invoices/AP/AR/Inventory capabilities were completely operational.
• A new Palo Alto Networks 850 firewall was deployed.
• Nearly all of the user desktops were operational.

Conclusion
A potential enterprise-killing catastrophe was averted through the efforts of hard-working professionals, a broad spectrum of IT skills, and close teamwork. Although upon completion of forensics the ransomware virus attack detailed here would have been stopped with current security systems and best practices, team education, and well designed incident response procedures for data backup and proper patching controls, the fact remains that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of professionals has substantial experience in ransomware virus blocking, remediation, and file restoration.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Huntington Beach a variety of online monitoring and security evaluation services to assist you to minimize your vulnerability to ransomware. These services include modern AI capability to detect new strains of ransomware that are able to get past legacy signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent handles the daily monitoring and maintenance for you, so your network expands readily without holding you back. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Entry-level packages include RMM, security, automatic monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management (RMM) technology to help keep your network operating efficiently by tracking the state of critical assets that drive your business network. When ProSight LAN Watch detects a problem, an alarm is transmitted immediately to your specified IT management staff and your Progent engineering consultant so any looming problems can be resolved before they have a chance to disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for monitoring and managing your client-server infrastructure by offering an environment for streamlining common tedious tasks. These can include health monitoring, patch management, automated remediation, endpoint setup, backup and restore, anti-virus defense, remote access, standard and custom scripts, asset inventory, endpoint status reporting, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alarm to your designated IT management staff and your Progent technical consultant so emerging problems can be taken care of before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it simple and affordable for smaller organizations to map out, monitor, optimize and debug their connectivity appliances like switches, firewalls, and access points as well as servers, endpoints and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network maps are always updated, copies and manages the configuration of almost all devices connected to your network, tracks performance, and sends notices when problems are discovered. By automating tedious management processes, WAN Watch can knock hours off ordinary chores like making network diagrams, expanding your network, finding appliances that require critical updates, or resolving performance problems. Find out more details about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time and in-depth reporting tools designed to integrate with the top ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as spotty support follow-up or machines with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with leading backup software providers to produce ProSight Data Protection Services (DPS), a selection of management outsourcing plans that provide backup-as-a-service. ProSight DPS products manage and track your backup operations and enable transparent backup and rapid restoration of vital files, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business protect against data loss caused by hardware failures, natural disasters, fire, malware such as ransomware, human mistakes, ill-intentioned employees, or application glitches. Managed backup services in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of top data security companies to provide web-based management and comprehensive protection for all your email traffic. The hybrid architecture of Email Guard combines cloud-based filtering with an on-premises security gateway device to provide complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's cloud filter serves as a preliminary barricade and blocks the vast majority of unwanted email from reaching your security perimeter. This decreases your exposure to inbound threats and conserves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a deeper layer of inspection for inbound email. For outbound email, the onsite security gateway offers AV and anti-spam filtering, DLP, and email encryption. The on-premises security gateway can also assist Microsoft Exchange Server to monitor and protect internal email that stays within your security perimeter. For more details, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo technology to defend against password theft through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation on Apple iOS, Google Android, and other out-of-band devices. Using Duo 2FA, whenever you sign into a secured application and enter your password you are asked to verify who you are on a device that only you possess and that uses a separate network channel. A broad range of devices can be used as this second form of authentication including a smartphone or wearable, a hardware token, a landline telephone, etc. You may register multiple validation devices. For more information about Duo two-factor identity validation services, go to Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Support Desk services enable your information technology group to outsource Help Desk services to Progent or split activity for Service Desk support transparently between your internal support staff and Progent's nationwide roster of certified IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a seamless extension of your in-house network support team. Client interaction with the Help Desk, delivery of technical assistance, issue escalation, trouble ticket generation and tracking, performance metrics, and management of the support database are consistent regardless of whether issues are resolved by your core network support resources, by Progent's team, or by a combination. Read more about Progent's outsourced/shared Help Center services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates cutting edge behavior-based machine learning tools to guard endpoints as well as physical and virtual servers against modern malware assaults like ransomware and file-less exploits, which routinely get by traditional signature-matching AV tools. Progent ASM services safeguard on-premises and cloud resources and offers a unified platform to address the complete threat progression including filtering, detection, mitigation, cleanup, and forensics. Top features include single-click rollback using Windows VSS and automatic network-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, find and protect information about your IT infrastructure, procedures, business apps, and services. You can instantly find passwords or serial numbers and be alerted about upcoming expirations of SSLs or domains. By cleaning up and organizing your IT documentation, you can eliminate as much as half of time thrown away trying to find vital information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and sharing all documents required for managing your business network like standard operating procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're planning improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the data you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of any size a versatile and affordable solution for assessing, testing, scheduling, implementing, and documenting software and firmware updates to your ever-evolving IT network. Besides maximizing the security and reliability of your computer environment, Progent's software/firmware update management services permit your IT staff to focus on line-of-business projects and activities that derive maximum business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure Tier III data center on a high-performance virtual host configured and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system platforms, and the applications. Since the system is virtualized, it can be moved immediately to an alternate hardware solution without requiring a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior-based analysis tools to guard physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which routinely get by legacy signature-matching AV products. ProSight ASM protects on-premises and cloud-based resources and provides a unified platform to address the entire threat progression including protection, detection, mitigation, remediation, and forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services deliver economical multi-layer security for physical servers and VMs, desktops, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for round-the-clock monitoring and responding to security threats from all vectors. ProSight ESP provides firewall protection, intrusion alarms, device management, and web filtering via cutting-edge tools packaged within one agent managed from a unified console. Progent's data protection and virtualization consultants can help your business to plan and configure a ProSight ESP environment that meets your organization's unique needs and that helps you prove compliance with government and industry information protection regulations. Progent will assist you define and configure security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alarms that call for urgent attention. Progent can also assist you to install and test a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business rapidly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.