24-Hour Alpharetta Urgent Crypto-Ransomware
Virus Assessment and Removal Services

Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a too-frequent cyber pandemic that represents an existential danger for businesses vulnerable to an assault. Multiple generations of ransomware like the CrySIS, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been running rampant for many years and still cause destruction. Recent variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, plus daily as yet unnamed newcomers, not only encrypt on-line information but also infect any accessible system backup. Information synchronized to off-site disaster recovery sites can also be encrypted. In a vulnerable data protection solution, it can render any restoration hopeless and effectively knocks the datacenter back to zero.

Getting back applications and data after a ransomware attack becomes a race against the clock as the victim tries its best to contain the damage, cleanup the crypto-ransomware, and restore enterprise-critical activity. Due to the fact that crypto-ransomware needs time to move laterally, attacks are frequently sprung at night, when penetrations in many cases take more time to identify. This multiplies the difficulty of rapidly mobilizing and coordinating a qualified response team.

Progent makes available a variety of solutions for securing enterprises from ransomware events. Among these are user training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of modern security solutions with artificial intelligence capabilities from SentinelOne to detect and suppress day-zero cyber threats quickly. Progent in addition provides the services of experienced ransomware recovery consultants with the skills and commitment to restore a compromised system as quickly as possible.

Progent's Ransomware Restoration Help
Following a ransomware event, paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will respond with the codes to decipher all your information. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files after having paid the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to re-install the vital elements of your Information Technology environment. Absent access to complete information backups, this requires a wide complement of IT skills, professional project management, and the willingness to work 24x7 until the recovery project is over.

For two decades, Progent has made available expert IT services for companies throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have earned advanced certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have garnered internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of experience gives Progent the ability to knowledgably understand necessary systems and re-organize the remaining components of your Information Technology environment after a ransomware penetration and assemble them into a functioning system.

Progent's recovery group has top notch project management tools to coordinate the sophisticated recovery process. Progent appreciates the urgency of acting rapidly and in concert with a customer's management and Information Technology staff to assign priority to tasks and to get essential services back online as fast as humanly possible.

Business Case Study: A Successful Ransomware Attack Restoration
A small business engaged Progent after their network system was taken over by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state sponsored cybercriminals, suspected of using technology exposed from America's NSA organization. Ryuk attacks specific organizations with little or no tolerance for operational disruption and is one of the most profitable versions of crypto-ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer located in the Chicago metro area with about 500 employees. The Ryuk attack had disabled all company operations and manufacturing processes. Most of the client's data protection had been online at the start of the intrusion and were encrypted. The client was pursuing financing for paying the ransom (exceeding $200K) and hoping for good luck, but ultimately utilized Progent.

Progent worked with the customer to rapidly understand and assign priority to the critical elements that had to be recovered to make it possible to restart company operations:

• Windows Active Directory
• Exchange Server
• Financials/MRP

Within 48 hours, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then accomplished reinstallations and storage recovery of key servers. All Exchange data and configuration information were usable, which greatly helped the restore of Exchange. Progent was also able to collect local OST data files (Outlook Email Offline Data Files) on staff PCs in order to recover mail data. A recent off-line backup of the customer's accounting systems made it possible to recover these essential applications back online for users. Although a large amount of work remained to recover fully from the Ryuk damage, core systems were restored quickly:

During the following month important milestones in the recovery project were completed through tight collaboration between Progent engineers and the customer:

• Self-hosted web applications were restored with no loss of data.
• The MailStore Server with over 4 million historical messages was brought online and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory capabilities were completely recovered.
• A new Palo Alto Networks 850 firewall was set up.
• Ninety percent of the user workstations were functioning as before the incident.

Conclusion
A possible business disaster was evaded due to results-oriented experts, a broad spectrum of technical expertise, and tight collaboration. Although in retrospect the ransomware incident detailed here should have been identified and blocked with advanced cyber security technology solutions and NIST Cybersecurity Framework best practices, user education, and well designed security procedures for information backup and proper patching controls, the fact is that state-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware incursion, feel confident that Progent's roster of experts has substantial experience in ransomware virus defense, mitigation, and information systems recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Alpharetta a variety of remote monitoring and security evaluation services to assist you to minimize the threat from ransomware. These services utilize next-generation AI technology to uncover new variants of ransomware that are able to escape detection by legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the necessary monitoring and maintenance for you, so your system scales smoothly without becoming an obstacle. For a low and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Basic packages include RMM, security, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management technology to keep your network running at peak levels by checking the state of vital assets that power your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted immediately to your designated IT staff and your Progent engineering consultant so all potential issues can be resolved before they have a chance to disrupt productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for monitoring and managing your network, server, and desktop devices by offering an environment for performing common tedious tasks. These can include health monitoring, update management, automated repairs, endpoint configuration, backup and recovery, A/V protection, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alert to your specified IT management staff and your assigned Progent technical consultant so potential problems can be fixed before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for smaller organizations to map out, monitor, reconfigure and troubleshoot their connectivity hardware such as routers and switches, firewalls, and access points as well as servers, printers, endpoints and other devices. Using cutting-edge Remote Monitoring and Management technology, WAN Watch ensures that network maps are kept updated, captures and manages the configuration of almost all devices on your network, tracks performance, and sends notices when potential issues are discovered. By automating tedious management and troubleshooting activities, WAN Watch can knock hours off common chores such as making network diagrams, expanding your network, locating appliances that require critical updates, or isolating performance issues. Find out more details about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time and in-depth management reporting plug-ins designed to integrate with the industry's leading ticketing and remote network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues such as spotty support follow-up or endpoints with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with leading backup/restore software companies to produce ProSight Data Protection Services (DPS), a selection of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup processes and enable transparent backup and rapid recovery of critical files, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business avoid data loss resulting from hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, human mistakes, ill-intentioned insiders, or software glitches. Managed backup services in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can help you to identify which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of top information security vendors to provide centralized control and comprehensive security for all your email traffic. The hybrid structure of Email Guard managed service combines cloud-based filtering with an on-premises gateway device to offer advanced defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's Cloud Protection Layer acts as a preliminary barricade and blocks most threats from reaching your network firewall. This decreases your exposure to external attacks and saves system bandwidth and storage space. Email Guard's on-premises gateway device adds a deeper level of analysis for incoming email. For outgoing email, the on-premises security gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also assist Exchange Server to track and protect internal email traffic that originates and ends inside your security perimeter. For more details, visit Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA managed services utilize Cisco's Duo technology to protect against stolen passwords through the use of two-factor authentication. Duo enables single-tap identity confirmation with iOS, Android, and other out-of-band devices. Using Duo 2FA, when you log into a protected online account and enter your password you are requested to confirm who you are via a device that only you possess and that uses a different ("out-of-band") network channel. A wide selection of out-of-band devices can be used for this second form of ID validation including a smartphone or watch, a hardware token, a landline telephone, etc. You can register several validation devices. To find out more about Duo identity authentication services, visit Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Call Desk: Help Desk Managed Services
  Progent's Help Desk managed services enable your IT team to offload Help Desk services to Progent or split activity for support services transparently between your internal support team and Progent's nationwide pool of IT service engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a smooth supplement to your in-house IT support team. User access to the Service Desk, delivery of technical assistance, problem escalation, ticket generation and updates, performance metrics, and maintenance of the support database are consistent regardless of whether incidents are resolved by your corporate support staff, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Service Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates next generation behavior-based analysis technology to guard endpoints and servers and VMs against new malware assaults like ransomware and email phishing, which routinely get by traditional signature-matching AV tools. Progent Active Security Monitoring services protect on-premises and cloud-based resources and provides a unified platform to automate the complete threat progression including blocking, identification, mitigation, cleanup, and post-attack forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered threats. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, retrieve and protect information related to your network infrastructure, processes, applications, and services. You can instantly find passwords or serial numbers and be warned about impending expirations of SSLs ,domains or warranties. By updating and managing your IT documentation, you can eliminate up to 50% of time thrown away looking for vital information about your network. ProSight IT Asset Management includes a common location for storing and collaborating on all documents required for managing your business network such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether you're making enhancements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you need as soon as you need it. Read more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide organizations of any size a flexible and affordable solution for evaluating, testing, scheduling, applying, and documenting software and firmware updates to your dynamic information network. In addition to maximizing the security and reliability of your IT environment, Progent's patch management services allow your in-house IT staff to concentrate on line-of-business projects and activities that derive maximum business value from your information network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a secure Tier III data center on a fast virtual host configured and managed by Progent's network support professionals. With the ProSight Virtual Hosting model, the client owns the data, the operating system platforms, and the applications. Since the system is virtualized, it can be ported easily to an alternate hardware environment without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not locked into one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior machine learning technology to defend physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which easily evade traditional signature-matching AV tools. ProSight Active Security Monitoring safeguards local and cloud resources and provides a single platform to address the entire malware attack lifecycle including filtering, detection, mitigation, remediation, and forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver ultra-affordable multi-layer security for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and responding to cyber assaults from all attack vectors. ProSight ESP offers two-way firewall protection, penetration alarms, device management, and web filtering via leading-edge tools incorporated within one agent managed from a single control. Progent's security and virtualization experts can help your business to design and implement a ProSight ESP environment that meets your company's specific needs and that helps you achieve and demonstrate compliance with government and industry data security standards. Progent will help you define and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that require urgent action. Progent's consultants can also help your company to install and verify a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange filtering.