24/7 Irving Critical Crypto
Malware Identification and Remediation Consulting

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become an escalating cyber pandemic that presents an extinction-level danger for organizations vulnerable to an assault. Different versions of ransomware such as Reveton, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for many years and continue to cause harm. Modern variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with frequent as yet unnamed malware, not only encrypt online information but also infect many configured system protection mechanisms. Files replicated to the cloud can also be ransomed. In a poorly architected environment, it can make automatic restoration impossible and effectively knocks the network back to square one.

Getting back programs and data following a ransomware event becomes a race against time as the victim tries its best to stop lateral movement, clear the ransomware, and restore enterprise-critical operations. Because ransomware needs time to spread, penetrations are usually sprung at night, when successful penetrations may take more time to identify. This multiplies the difficulty of promptly marshalling and coordinating an experienced response team.

Progent provides a variety of support services for protecting organizations from ransomware events. These include staff education to help recognize and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of the latest generation security gateways with machine learning capabilities from SentinelOne to detect and quarantine day-zero cyber attacks rapidly. Progent also offers the assistance of seasoned ransomware recovery engineers with the talent and perseverance to restore a compromised environment as rapidly as possible.

Progent's Ransomware Recovery Services
Following a crypto-ransomware event, even paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will provide the keys to decrypt any or all of your information. Kaspersky Labs ascertained that seventeen percent of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to re-install the essential components of your Information Technology environment. Absent access to full information backups, this requires a broad complement of skill sets, top notch team management, and the ability to work non-stop until the job is complete.

For twenty years, Progent has made available certified expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have been awarded top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial systems and ERP application software. This breadth of expertise affords Progent the ability to rapidly understand critical systems and integrate the surviving pieces of your Information Technology environment after a crypto-ransomware event and assemble them into an operational network.

Progent's recovery group utilizes best of breed project management tools to orchestrate the complex recovery process. Progent understands the importance of acting rapidly and together with a client's management and Information Technology team members to assign priority to tasks and to get key applications back on-line as fast as possible.

Business Case Study: A Successful Ransomware Attack Restoration
A client hired Progent after their company was penetrated by the Ryuk crypto-ransomware. Ryuk is thought to have been developed by North Korean government sponsored criminal gangs, possibly adopting techniques exposed from the U.S. NSA organization. Ryuk goes after specific companies with limited ability to sustain operational disruption and is among the most lucrative instances of crypto-ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in Chicago and has about 500 employees. The Ryuk event had disabled all company operations and manufacturing processes. The majority of the client's system backups had been online at the start of the attack and were destroyed. The client considered paying the ransom (in excess of $200K) and praying for good luck, but in the end engaged Progent.

Progent worked with the customer to rapidly identify and assign priority to the mission critical elements that needed to be addressed to make it possible to restart company operations:

• Windows Active Directory
• Microsoft Exchange
• MRP System

Within two days, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then helped perform setup and hard drive recovery of essential systems. All Exchange Server ties and attributes were intact, which accelerated the restore of Exchange. Progent was able to collect local OST data files (Outlook Offline Data Files) on team workstations and laptops to recover mail information. A not too old offline backup of the client's accounting/ERP software made them able to return these required services back online for users. Although major work still had to be done to recover fully from the Ryuk attack, core systems were restored quickly:

During the following couple of weeks critical milestones in the recovery project were made through close collaboration between Progent team members and the customer:

• Self-hosted web sites were brought back up without losing any data.
• The MailStore Microsoft Exchange Server exceeding 4 million historical messages was spun up and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control functions were 100% functional.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Nearly all of the user workstations were operational.

Conclusion
A likely business catastrophe was dodged through the efforts of results-oriented experts, a broad spectrum of knowledge, and close teamwork. Although in retrospect the crypto-ransomware virus attack detailed here would have been stopped with current cyber security solutions and recognized best practices, user education, and properly executed security procedures for information backup and proper patching controls, the fact remains that government-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has proven experience in crypto-ransomware virus blocking, mitigation, and file restoration.

To read or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers companies in Irving a variety of remote monitoring and security evaluation services designed to assist you to reduce your vulnerability to crypto-ransomware. These services incorporate next-generation artificial intelligence capability to detect zero-day variants of ransomware that can get past legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve leading-edge IT resilience. Progent handles the necessary monitoring and maintenance for you, so your network expands readily without becoming an obstacle. For a low and predictable monthly price, Progent's experienced IT team can be your dependable technology safety net. Basic plans include remote monitoring and management, cybersecurity, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management techniques to keep your network operating efficiently by tracking the health of critical computers that drive your business network. When ProSight LAN Watch detects a problem, an alert is sent immediately to your specified IT management personnel and your Progent engineering consultant so all looming issues can be resolved before they can disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for managing your client-server infrastructure by providing tools for performing common tedious tasks. These can include health checking, patch management, automated remediation, endpoint deployment, backup and recovery, anti-virus response, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and debugging support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alarm to your specified IT management personnel and your Progent technical consultant so emerging issues can be taken care of before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to map, track, enhance and troubleshoot their connectivity hardware like routers, firewalls, and access points plus servers, printers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that network maps are kept current, copies and displays the configuration of almost all devices on your network, tracks performance, and generates alerts when potential issues are discovered. By automating time-consuming management and troubleshooting processes, WAN Watch can knock hours off ordinary tasks such as making network diagrams, reconfiguring your network, locating appliances that require critical software patches, or identifying the cause of performance issues. Find out more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of in-depth reporting tools designed to work with the industry's top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues like spotty support follow-through or endpoints with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has partnered with leading backup technology companies to create ProSight Data Protection Services (DPS), a portfolio of subscription-based offerings that provide backup-as-a-service (BaaS). ProSight DPS services automate and track your backup processes and allow transparent backup and rapid restoration of critical files, applications, images, plus Hyper-V and VMware virtual machines. ProSight DPS helps your business protect against data loss caused by equipment breakdown, natural calamities, fire, malware such as ransomware, human error, malicious insiders, or software glitches. Managed services in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top information security vendors to provide centralized management and world-class security for your inbound and outbound email. The hybrid structure of Email Guard managed service integrates cloud-based filtering with a local gateway appliance to offer complete protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne threats. Email Guard's Cloud Protection Layer acts as a preliminary barricade and keeps the vast majority of threats from making it to your security perimeter. This reduces your exposure to inbound threats and saves network bandwidth and storage. Email Guard's on-premises security gateway device provides a further level of inspection for incoming email. For outbound email, the onsite gateway offers anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also help Exchange Server to track and safeguard internal email that originates and ends inside your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity confirmation on iOS, Android, and other personal devices. With 2FA, whenever you log into a protected online account and give your password you are asked to verify your identity on a unit that only you have and that uses a different network channel. A wide selection of devices can be used for this added form of ID validation including an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can register multiple validation devices. For details about Duo two-factor identity validation services, visit Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Call Desk: Call Center Managed Services
  Progent's Help Center services permit your information technology group to offload Call Center services to Progent or divide responsibilities for Service Desk support seamlessly between your in-house network support group and Progent's extensive roster of IT support engineers and subject matter experts. Progent's Co-managed Service Desk provides a seamless extension of your in-house IT support team. Client access to the Help Desk, delivery of support services, problem escalation, trouble ticket creation and updates, performance measurement, and management of the support database are cohesive regardless of whether incidents are resolved by your corporate IT support resources, by Progent's team, or both. Find out more about Progent's outsourced/shared Service Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior machine learning tools to guard endpoints and servers and VMs against new malware assaults like ransomware and file-less exploits, which routinely escape legacy signature-matching AV products. Progent Active Security Monitoring services safeguard local and cloud-based resources and offers a single platform to automate the complete malware attack progression including protection, infiltration detection, mitigation, cleanup, and forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, retrieve and protect information related to your network infrastructure, procedures, business apps, and services. You can quickly locate passwords or serial numbers and be warned automatically about upcoming expirations of SSLs or domains. By cleaning up and organizing your IT infrastructure documentation, you can save up to 50% of time thrown away trying to find vital information about your IT network. ProSight IT Asset Management features a common repository for storing and sharing all documents related to managing your business network such as recommended procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT information. Whether you're making improvements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the knowledge you need when you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management provide businesses of any size a versatile and affordable solution for assessing, validating, scheduling, implementing, and tracking updates to your dynamic IT network. In addition to maximizing the protection and reliability of your IT environment, Progent's patch management services free up time for your IT staff to focus on more strategic projects and tasks that derive maximum business value from your network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a protected fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system software, and the apps. Since the environment is virtualized, it can be moved immediately to an alternate hosting solution without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not tied one hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior-based analysis technology to defend physical and virtual endpoints against modern malware assaults like ransomware and file-less exploits, which easily get by traditional signature-matching anti-virus tools. ProSight Active Security Monitoring protects local and cloud resources and offers a single platform to automate the complete threat lifecycle including blocking, identification, containment, cleanup, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable in-depth protection for physical servers and VMs, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to security threats from all attack vectors. ProSight ESP delivers firewall protection, intrusion alerts, device control, and web filtering through leading-edge tools incorporated within one agent managed from a single console. Progent's security and virtualization experts can assist you to plan and implement a ProSight ESP deployment that addresses your organization's specific requirements and that helps you achieve and demonstrate compliance with government and industry information security regulations. Progent will help you define and implement policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for urgent action. Progent's consultants can also assist your company to install and test a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange email filtering.