24/7/365 Alexandria Critical Crypto
Computer Virus Identification and Restoration Services

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that poses an extinction-level danger for businesses vulnerable to an attack. Different versions of ransomware like the CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and continue to inflict havoc. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, along with daily unnamed malware, not only encrypt on-line files but also infiltrate most accessible system restores and backups. Files synched to cloud environments can also be corrupted. In a vulnerable system, this can make any restoration hopeless and effectively sets the datacenter back to zero.

Retrieving services and data following a ransomware event becomes a race against the clock as the victim tries its best to stop the spread, clear the crypto-ransomware, and restore business-critical activity. Due to the fact that ransomware requires time to spread, penetrations are usually launched on weekends and holidays, when successful attacks typically take longer to discover. This compounds the difficulty of quickly assembling and organizing an experienced response team.

Progent makes available a range of help services for protecting organizations from ransomware penetrations. Among these are user education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of modern security solutions with artificial intelligence capabilities from SentinelOne to discover and disable new threats quickly. Progent also provides the services of seasoned crypto-ransomware recovery professionals with the skills and commitment to rebuild a breached system as quickly as possible.

Progent's Ransomware Recovery Help
Following a crypto-ransomware event, even paying the ransom demands in cryptocurrency does not ensure that criminal gangs will respond with the codes to decipher all your information. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their data even after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to re-install the vital elements of your IT environment. Absent the availability of complete information backups, this requires a wide complement of skills, professional team management, and the willingness to work continuously until the task is done.

For two decades, Progent has made available professional Information Technology services for businesses throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have been awarded high-level certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP software solutions. This breadth of expertise gives Progent the skills to efficiently understand critical systems and organize the remaining parts of your computer network environment following a crypto-ransomware attack and assemble them into an operational network.

Progent's ransomware team utilizes state-of-the-art project management systems to coordinate the sophisticated recovery process. Progent knows the urgency of acting swiftly and together with a client's management and Information Technology team members to assign priority to tasks and to get the most important applications back on line as fast as humanly possible.

Client Story: A Successful Ransomware Virus Response
A customer engaged Progent after their network was penetrated by Ryuk ransomware. Ryuk is believed to have been created by North Korean government sponsored cybercriminals, possibly using algorithms leaked from the United States NSA organization. Ryuk attacks specific businesses with little or no room for operational disruption and is among the most profitable examples of ransomware viruses. Major victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing company located in Chicago with about 500 employees. The Ryuk intrusion had brought down all business operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the beginning of the attack and were eventually encrypted. The client considered paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but ultimately reached out to Progent.

Progent worked hand in hand the customer to rapidly determine and assign priority to the critical applications that had to be restored in order to resume departmental operations:

• Windows Active Directory
• Electronic Mail
• Financials/MRP

In less than two days, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then initiated setup and storage recovery of needed applications. All Exchange Server schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was able to assemble local OST files (Outlook Offline Data Files) on various desktop computers in order to recover mail data. A recent off-line backup of the customer's financials/ERP software made it possible to restore these vital programs back available to users. Although a large amount of work still had to be done to recover completely from the Ryuk event, essential services were recovered quickly:

Throughout the next month key milestones in the restoration process were accomplished through tight cooperation between Progent consultants and the customer:

• Internal web applications were returned to operation with no loss of information.
• The MailStore Server exceeding 4 million archived emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/AP/AR/Inventory Control capabilities were 100 percent restored.
• A new Palo Alto 850 firewall was brought online.
• Ninety percent of the user desktops and notebooks were back into operation.

Conclusion
A probable business extinction disaster was averted through the efforts of top-tier experts, a broad range of technical expertise, and tight teamwork. Although upon completion of forensics the ransomware virus incident detailed here could have been blocked with advanced security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and well designed incident response procedures for information protection and proper patching controls, the reality is that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware attack, remember that Progent's team of experts has extensive experience in ransomware virus blocking, remediation, and file recovery.

To read or download a PDF version of this case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Alexandria a variety of remote monitoring and security evaluation services designed to help you to minimize your vulnerability to crypto-ransomware. These services include next-generation AI technology to uncover zero-day strains of ransomware that can escape detection by traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your network expands readily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT team can be your complete technology safety net. Basic packages include remote monitoring and management (RMM), cybersecurity, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management technology to help keep your IT system running at peak levels by tracking the health of vital computers that drive your information system. When ProSight LAN Watch detects an issue, an alert is transmitted automatically to your specified IT personnel and your assigned Progent consultant so that any potential issues can be addressed before they can disrupt your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven platform for managing your network, server, and desktop devices by providing an environment for streamlining common tedious jobs. These include health checking, patch management, automated repairs, endpoint deployment, backup and recovery, A/V defense, remote access, standard and custom scripts, resource inventory, endpoint status reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your designated IT management staff and your assigned Progent consultant so that emerging issues can be fixed before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to map out, monitor, enhance and troubleshoot their connectivity appliances such as routers and switches, firewalls, and access points plus servers, endpoints and other networked devices. Incorporating state-of-the-art RMM technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are kept updated, captures and displays the configuration of virtually all devices connected to your network, tracks performance, and sends notices when problems are discovered. By automating complex management and troubleshooting activities, WAN Watch can cut hours off ordinary chores like making network diagrams, reconfiguring your network, finding appliances that require important software patches, or identifying the cause of performance bottlenecks. Learn more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time reporting tools created to work with the leading ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues like inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup/restore technology companies to create ProSight Data Protection Services (DPS), a family of subscription-based offerings that provide backup-as-a-service. ProSight DPS products manage and monitor your backup operations and allow transparent backup and rapid recovery of vital files, applications, images, plus virtual machines. ProSight DPS helps your business avoid data loss resulting from equipment failures, natural calamities, fire, malware like ransomware, human error, malicious insiders, or application glitches. Managed services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading information security vendors to deliver centralized management and comprehensive security for all your inbound and outbound email. The powerful structure of Progent's Email Guard combines cloud-based filtering with a local gateway appliance to provide complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's cloud filter serves as a preliminary barricade and blocks most threats from making it to your security perimeter. This reduces your vulnerability to external attacks and saves network bandwidth and storage space. Email Guard's onsite security gateway appliance adds a further layer of inspection for incoming email. For outgoing email, the onsite gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local gateway can also help Exchange Server to track and safeguard internal email that stays inside your security perimeter. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA services utilize Cisco's Duo technology to protect against stolen passwords through the use of two-factor authentication. Duo supports one-tap identity confirmation with iOS, Android, and other out-of-band devices. With 2FA, when you log into a protected online account and enter your password you are asked to confirm who you are via a unit that only you possess and that uses a different network channel. A wide range of out-of-band devices can be utilized as this second means of authentication such as an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You can register several validation devices. For details about ProSight Duo two-factor identity authentication services, visit Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Service Center: Call Center Managed Services
  Progent's Help Desk managed services allow your information technology group to outsource Support Desk services to Progent or split activity for support services transparently between your in-house network support group and Progent's extensive pool of certified IT support engineers and subject matter experts. Progent's Shared Service Desk provides a seamless extension of your corporate IT support group. End user interaction with the Service Desk, delivery of support, escalation, trouble ticket generation and tracking, performance measurement, and maintenance of the service database are cohesive regardless of whether issues are resolved by your core network support organization, by Progent's team, or by a combination. Read more about Progent's outsourced/co-managed Service Center services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that utilizes cutting edge behavior-based analysis technology to guard endpoints and servers and VMs against modern malware assaults like ransomware and email phishing, which routinely get by traditional signature-matching AV tools. Progent ASM services safeguard local and cloud resources and offers a unified platform to address the complete malware attack lifecycle including blocking, infiltration detection, containment, cleanup, and forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, find and safeguard information related to your IT infrastructure, processes, applications, and services. You can instantly find passwords or serial numbers and be warned about upcoming expirations of SSL certificates or domains. By cleaning up and managing your IT documentation, you can eliminate as much as half of time wasted looking for critical information about your IT network. ProSight IT Asset Management features a centralized location for holding and collaborating on all documents required for managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and relating IT information. Whether you're planning improvements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you need the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management provide businesses of any size a versatile and cost-effective solution for evaluating, validating, scheduling, implementing, and documenting updates to your ever-evolving IT system. In addition to maximizing the security and reliability of your IT environment, Progent's patch management services allow your in-house IT staff to concentrate on line-of-business initiatives and activities that deliver the highest business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host configured and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the OS software, and the applications. Because the system is virtualized, it can be ported immediately to a different hardware solution without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior analysis tools to guard physical and virtual endpoint devices against new malware attacks like ransomware and file-less exploits, which routinely escape legacy signature-matching AV tools. ProSight Active Security Monitoring protects on-premises and cloud-based resources and provides a single platform to manage the entire threat lifecycle including filtering, detection, mitigation, remediation, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer economical multi-layer protection for physical and virtual servers, workstations, smartphones, and Exchange email. ProSight ESP uses contextual security and advanced machine learning for continuously monitoring and reacting to security threats from all attack vectors. ProSight ESP provides firewall protection, intrusion alerts, device control, and web filtering via cutting-edge technologies incorporated within one agent accessible from a single control. Progent's data protection and virtualization experts can help you to plan and configure a ProSight ESP environment that meets your organization's unique needs and that helps you demonstrate compliance with government and industry data security standards. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for immediate action. Progent's consultants can also assist your company to set up and test a backup and disaster recovery system such as ProSight Data Protection Services so you can recover rapidly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange email filtering.