24-7 Jundiaí Emergency CryptoLocker
Malware Identification and Restoration Help

Ransomware : Your Worst IT Disaster
Ransomware has become a modern cyber pandemic that represents an existential danger for organizations vulnerable to an attack. Different versions of ransomware like the Dharma, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for many years and still cause havoc. Recent variants of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as additional as yet unnamed malware, not only encrypt online data files but also infect all configured system protection. Files replicated to the cloud can also be encrypted. In a vulnerable environment, it can make automated restoration useless and basically knocks the network back to zero.

Restoring applications and information after a ransomware intrusion becomes a race against the clock as the targeted organization struggles to contain, cleanup the crypto-ransomware, and resume mission-critical activity. Due to the fact that crypto-ransomware requires time to replicate, assaults are frequently sprung on weekends and holidays, when attacks may take more time to uncover. This multiplies the difficulty of rapidly mobilizing and orchestrating an experienced response team.

Progent has an assortment of services for securing enterprises from crypto-ransomware penetrations. These include team member training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of next-generation security appliances with machine learning technology from SentinelOne to detect and quarantine zero-day cyber attacks intelligently. Progent in addition provides the services of expert ransomware recovery consultants with the skills and perseverance to reconstruct a breached system as soon as possible.

Progent's Ransomware Recovery Help
Following a crypto-ransomware attack, sending the ransom in cryptocurrency does not guarantee that cyber hackers will return the keys to decipher any of your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to re-install the critical elements of your Information Technology environment. Without access to essential information backups, this calls for a broad complement of skills, professional team management, and the ability to work 24x7 until the job is done.

For twenty years, Progent has offered professional IT services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained high-level certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP application software. This breadth of experience provides Progent the ability to quickly identify important systems and organize the remaining parts of your IT system following a crypto-ransomware attack and assemble them into a functioning network.

Progent's ransomware group uses powerful project management tools to coordinate the complicated restoration process. Progent knows the importance of acting rapidly and in concert with a client's management and Information Technology resources to assign priority to tasks and to put key services back online as fast as possible.

Business Case Study: A Successful Ransomware Attack Restoration
A business escalated to Progent after their company was brought down by Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored cybercriminals, suspected of using algorithms leaked from America's NSA organization. Ryuk goes after specific organizations with little or no ability to sustain disruption and is among the most lucrative instances of ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business based in Chicago and has about 500 workers. The Ryuk intrusion had frozen all company operations and manufacturing processes. The majority of the client's backups had been on-line at the beginning of the intrusion and were encrypted. The client was evaluating paying the ransom (in excess of $200,000) and wishfully thinking for good luck, but in the end brought in Progent.

Progent worked with the client to rapidly understand and assign priority to the essential areas that needed to be restored in order to resume company functions:

• Microsoft Active Directory
• Electronic Mail
• Accounting/MRP

In less than two days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then accomplished setup and storage recovery of key systems. All Exchange schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Email Off-Line Data Files) on team PCs in order to recover email data. A not too old offline backup of the customer's financials/ERP software made it possible to restore these required services back on-line. Although a large amount of work was left to recover completely from the Ryuk attack, core services were returned to operations quickly:

Over the next couple of weeks critical milestones in the restoration project were achieved through tight collaboration between Progent engineers and the client:

• Internal web applications were brought back up without losing any data.
• The MailStore Exchange Server with over four million historical messages was restored to operations and available for users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory Control functions were completely operational.
• A new Palo Alto Networks 850 security appliance was installed and configured.
• Most of the desktop computers were fully operational.

Conclusion
A potential business catastrophe was averted with hard-working professionals, a broad spectrum of knowledge, and tight collaboration. Although in hindsight the crypto-ransomware virus incident described here could have been identified and stopped with current cyber security technology solutions and NIST Cybersecurity Framework best practices, user education, and properly executed incident response procedures for information backup and applying software patches, the fact is that state-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's team of professionals has a proven track record in crypto-ransomware virus blocking, cleanup, and data recovery.

To read or download a PDF version of this customer story, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers companies in Jundiaí a variety of online monitoring and security assessment services to help you to minimize the threat from crypto-ransomware. These services include modern machine learning technology to uncover new strains of ransomware that can get past legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent handles the necessary monitoring and maintenance for you, so your network expands readily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's experienced IT group can be your dependable technology safety net. Basic packages include RMM, security, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management techniques to keep your IT system running efficiently by checking the health of critical computers that drive your information system. When ProSight LAN Watch uncovers a problem, an alert is sent immediately to your specified IT management staff and your Progent engineering consultant so that all looming issues can be resolved before they can disrupt productivity. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for monitoring and managing your network, server, and desktop devices by providing an environment for performing common time-consuming tasks. These include health monitoring, patch management, automated remediation, endpoint configuration, backup and recovery, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it transmits an alarm to your specified IT personnel and your Progent technical consultant so that potential problems can be fixed before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for smaller businesses to map, track, optimize and debug their networking appliances such as routers, firewalls, and load balancers as well as servers, printers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network maps are always updated, copies and displays the configuration of virtually all devices connected to your network, monitors performance, and sends alerts when problems are detected. By automating complex management and troubleshooting activities, ProSight WAN Watch can cut hours off ordinary tasks like network mapping, expanding your network, finding appliances that need critical software patches, or identifying the cause of performance bottlenecks. Learn more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of in-depth reporting utilities designed to work with the industry's top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup software companies to produce ProSight Data Protection Services, a portfolio of management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS products manage and monitor your data backup processes and allow transparent backup and rapid recovery of critical files, applications, system images, and virtual machines. ProSight DPS helps you recover from data loss resulting from equipment failures, natural calamities, fire, malware like ransomware, user error, malicious insiders, or application bugs. Managed services in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top data security vendors to deliver web-based control and comprehensive protection for your inbound and outbound email. The powerful architecture of Progent's Email Guard managed service combines cloud-based filtering with an on-premises security gateway device to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The Cloud Protection Layer serves as a preliminary barricade and blocks most threats from making it to your security perimeter. This reduces your vulnerability to inbound attacks and conserves network bandwidth and storage. Email Guard's on-premises security gateway appliance provides a further level of analysis for inbound email. For outgoing email, the on-premises security gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also help Exchange Server to monitor and safeguard internal email that originates and ends within your security perimeter. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo MFA managed services incorporate Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication. Duo enables one-tap identity confirmation with iOS, Android, and other out-of-band devices. With 2FA, when you sign into a protected online account and enter your password you are asked to verify your identity via a device that only you have and that is accessed using a separate network channel. A wide selection of out-of-band devices can be utilized as this second means of ID validation including an iPhone or Android or watch, a hardware token, a landline telephone, etc. You may register multiple verification devices. For more information about ProSight Duo two-factor identity authentication services, visit Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Support Desk managed services enable your IT staff to outsource Call Center services to Progent or divide responsibilities for Help Desk services transparently between your internal network support team and Progent's extensive pool of IT support engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a transparent supplement to your in-house network support organization. User access to the Service Desk, provision of support services, problem escalation, trouble ticket generation and tracking, efficiency measurement, and maintenance of the service database are consistent regardless of whether issues are taken care of by your internal support organization, by Progent, or a mix of the two. Learn more about Progent's outsourced/shared Service Center services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that utilizes next generation behavior-based machine learning tools to defend endpoint devices and physical and virtual servers against modern malware assaults like ransomware and email phishing, which easily get by legacy signature-matching anti-virus tools. Progent Active Security Monitoring services protect local and cloud-based resources and provides a single platform to manage the entire threat lifecycle including blocking, infiltration detection, containment, cleanup, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new attacks. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and safeguard data about your IT infrastructure, procedures, business apps, and services. You can instantly find passwords or IP addresses and be alerted about impending expirations of SSLs or domains. By cleaning up and organizing your IT documentation, you can eliminate up to 50% of time thrown away trying to find vital information about your IT network. ProSight IT Asset Management includes a centralized repository for storing and sharing all documents required for managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether you're planning improvements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide organizations of all sizes a versatile and cost-effective solution for assessing, testing, scheduling, implementing, and tracking updates to your dynamic IT system. Besides optimizing the security and reliability of your IT environment, Progent's software/firmware update management services free up time for your IT team to concentrate on line-of-business projects and activities that deliver maximum business value from your information network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual machine host set up and managed by Progent's network support professionals. With Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system platforms, and the applications. Since the environment is virtualized, it can be ported immediately to a different hardware solution without a time-consuming and difficult configuration process. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's next generation behavior-based analysis tools to defend physical and virtual endpoints against modern malware attacks such as ransomware and email phishing, which routinely evade traditional signature-matching anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a unified platform to automate the entire malware attack progression including filtering, infiltration detection, mitigation, remediation, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection services offer affordable in-depth protection for physical and virtual servers, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and reacting to cyber threats from all attack vectors. ProSight ESP offers firewall protection, intrusion alarms, endpoint management, and web filtering via cutting-edge technologies packaged within one agent accessible from a single control. Progent's data protection and virtualization experts can assist your business to plan and implement a ProSight ESP environment that meets your company's unique needs and that helps you prove compliance with legal and industry data protection regulations. Progent will assist you specify and configure policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that call for urgent attention. Progent's consultants can also assist you to install and test a backup and restore system like ProSight Data Protection Services so you can get back in business rapidly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange email filtering.