Knoxville 24/7/365 Urgent Crypto-Ransomware
Computer Virus Damage Assessment and Recovery Support

Crypto-Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become an escalating cyberplague that represents an extinction-level danger for businesses of all sizes unprepared for an assault. Versions of ransomware like the Reveton, Fusob, Locky, SamSam and MongoLock cryptoworms have been circulating for years and continue to inflict damage. Recent variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, plus frequent unnamed malware, not only encrypt on-line critical data but also infiltrate many accessible system backup. Data synchronized to off-site disaster recovery sites can also be encrypted. In a vulnerable data protection solution, this can render automated restoration useless and basically sets the network back to zero.

Getting back online services and information following a ransomware attack becomes a race against the clock as the targeted organization struggles to contain, clear the virus, and resume enterprise-critical activity. Since ransomware requires time to replicate, attacks are usually launched during weekends and nights, when successful penetrations tend to take longer to discover. This compounds the difficulty of quickly marshalling and coordinating an experienced mitigation team.

Progent offers a variety of help services for protecting organizations from ransomware attacks. These include team member training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with installation of modern security solutions with AI capabilities from SentinelOne to detect and quarantine day-zero cyber threats rapidly. Progent in addition can provide the assistance of expert ransomware recovery engineers with the track record and commitment to rebuild a breached environment as rapidly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a crypto-ransomware event, sending the ransom demands in cryptocurrency does not guarantee that cyber criminals will provide the codes to unencrypt all your files. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their files even after having paid the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The fallback is to setup from scratch the vital elements of your IT environment. Absent access to complete information backups, this calls for a wide complement of IT skills, top notch project management, and the capability to work non-stop until the job is completed.

For two decades, Progent has provided expert Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded top certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with accounting and ERP applications. This breadth of experience provides Progent the ability to efficiently ascertain critical systems and re-organize the surviving parts of your network system after a crypto-ransomware attack and configure them into a functioning system.

Progent's security group deploys top notch project management tools to coordinate the complex recovery process. Progent appreciates the urgency of working swiftly and in concert with a client's management and IT staff to assign priority to tasks and to put the most important services back on line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Penetration Recovery
A customer escalated to Progent after their network system was penetrated by Ryuk crypto-ransomware. Ryuk is believed to have been developed by Northern Korean state sponsored cybercriminals, possibly adopting algorithms leaked from the U.S. National Security Agency. Ryuk attacks specific businesses with little ability to sustain operational disruption and is one of the most lucrative incarnations of ransomware malware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing business headquartered in Chicago with around 500 staff members. The Ryuk intrusion had brought down all business operations and manufacturing processes. Most of the client's information backups had been online at the beginning of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (exceeding $200,000) and hoping for good luck, but in the end utilized Progent.

Progent worked with the client to quickly get our arms around and assign priority to the mission critical services that needed to be addressed in order to restart departmental functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Financials/MRP

Within two days, Progent was able to recover Active Directory services to its pre-virus state. Progent then accomplished rebuilding and storage recovery of key systems. All Exchange ties and attributes were intact, which accelerated the restore of Exchange. Progent was able to collect local OST data files (Outlook Email Off-Line Folder Files) on various PCs and laptops in order to recover email information. A not too old off-line backup of the customer's accounting/MRP software made them able to return these vital applications back servicing users. Although a large amount of work was left to recover fully from the Ryuk virus, essential services were returned to operations rapidly:

Throughout the following couple of weeks critical milestones in the restoration project were completed through tight collaboration between Progent consultants and the client:

• Self-hosted web sites were restored without losing any data.
• The MailStore Microsoft Exchange Server exceeding four million archived emails was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/AP/AR/Inventory functions were fully operational.
• A new Palo Alto 850 security appliance was brought online.
• Most of the user desktops and notebooks were being used by staff.

Conclusion
A possible business-ending disaster was evaded through the efforts of top-tier professionals, a broad spectrum of subject matter expertise, and close teamwork. Although in post mortem the ransomware virus incident described here would have been identified and disabled with up-to-date security technology and ISO/IEC 27001 best practices, user education, and well thought out security procedures for data backup and applying software patches, the fact remains that state-sponsored cybercriminals from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware incident, feel confident that Progent's team of experts has proven experience in crypto-ransomware virus blocking, remediation, and information systems restoration.

To read or download a PDF version of this customer case study, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Knoxville a range of online monitoring and security evaluation services designed to assist you to minimize your vulnerability to ransomware. These services include next-generation machine learning capability to detect new strains of ransomware that can evade legacy signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve leading-edge network resilience. Progent takes care of the daily monitoring and maintenance for you, so your system expands easily without becoming an obstacle. For an affordable and predictable monthly price, Progent's full-service IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management (RMM), security, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management technology to keep your IT system operating at peak levels by tracking the state of critical computers that power your business network. When ProSight LAN Watch uncovers an issue, an alert is transmitted immediately to your specified IT staff and your assigned Progent engineering consultant so any potential issues can be resolved before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for managing your network, server, and desktop devices by offering an environment for streamlining common time-consuming jobs. These can include health monitoring, patch management, automated remediation, endpoint configuration, backup and restore, A/V defense, remote access, standard and custom scripts, resource inventory, endpoint profile reports, and debugging help. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your designated IT management personnel and your Progent consultant so that potential problems can be taken care of before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to diagram, monitor, optimize and troubleshoot their connectivity hardware like routers, firewalls, and access points as well as servers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology diagrams are always updated, copies and displays the configuration of virtually all devices connected to your network, tracks performance, and sends notices when issues are discovered. By automating tedious network management activities, ProSight WAN Watch can knock hours off ordinary tasks such as making network diagrams, expanding your network, locating appliances that require important updates, or resolving performance issues. Find out more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of in-depth management reporting utilities designed to work with the industry's top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize key issues such as inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with advanced backup/restore technology providers to produce ProSight Data Protection Services (DPS), a portfolio of management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS products manage and track your data backup operations and enable non-disruptive backup and fast restoration of vital files/folders, applications, images, plus VMs. ProSight DPS helps your business avoid data loss resulting from hardware failures, natural disasters, fire, cyber attacks like ransomware, human error, malicious employees, or software bugs. Managed services in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can assist you to determine which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of leading data security vendors to deliver web-based control and comprehensive security for all your email traffic. The powerful structure of Progent's Email Guard managed service combines cloud-based filtering with an on-premises security gateway device to offer complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based malware. The cloud filter serves as a first line of defense and blocks the vast majority of threats from making it to your security perimeter. This reduces your vulnerability to external threats and conserves network bandwidth and storage. Email Guard's on-premises gateway device provides a deeper layer of analysis for incoming email. For outgoing email, the local security gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also assist Exchange Server to track and protect internal email that originates and ends inside your corporate firewall. For more details, see Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo technology to defend against password theft through the use of two-factor authentication. Duo supports single-tap identity verification with Apple iOS, Android, and other personal devices. With Duo 2FA, whenever you log into a protected application and enter your password you are requested to confirm who you are on a device that only you possess and that is accessed using a different network channel. A wide selection of out-of-band devices can be used for this added form of ID validation including an iPhone or Android or watch, a hardware token, a landline telephone, etc. You may designate several validation devices. To learn more about ProSight Duo two-factor identity authentication services, refer to Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Center: Call Center Managed Services
  Progent's Help Center managed services permit your information technology team to outsource Call Center services to Progent or divide responsibilities for support services seamlessly between your in-house support group and Progent's extensive roster of IT support technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a seamless supplement to your in-house IT support group. Client access to the Help Desk, provision of technical assistance, issue escalation, ticket generation and updates, performance measurement, and maintenance of the support database are consistent regardless of whether issues are taken care of by your in-house IT support resources, by Progent's team, or both. Learn more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior analysis technology to defend endpoint devices as well as physical and virtual servers against new malware assaults such as ransomware and email phishing, which easily get by legacy signature-based AV tools. Progent ASM services protect on-premises and cloud resources and provides a unified platform to automate the complete threat progression including filtering, identification, containment, remediation, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new threats. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and safeguard information related to your network infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be warned automatically about upcoming expirations of SSL certificates or warranties. By cleaning up and managing your IT infrastructure documentation, you can save up to 50% of time wasted looking for vital information about your IT network. ProSight IT Asset Management includes a centralized location for storing and sharing all documents required for managing your business network like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT information. Whether you're making improvements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you require the instant you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a versatile and affordable solution for evaluating, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving IT system. Besides optimizing the protection and functionality of your IT environment, Progent's software/firmware update management services allow your in-house IT staff to focus on line-of-business initiatives and activities that deliver maximum business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual machine host set up and maintained by Progent's IT support experts. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the OS software, and the apps. Since the system is virtualized, it can be moved immediately to an alternate hosting solution without a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that utilizes SentinelOne's next generation behavior machine learning technology to guard physical and virtual endpoints against modern malware assaults such as ransomware and email phishing, which routinely evade traditional signature-based anti-virus tools. ProSight ASM protects local and cloud resources and provides a unified platform to automate the entire malware attack lifecycle including protection, identification, mitigation, cleanup, and post-attack forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection managed services deliver affordable in-depth protection for physical servers and virtual machines, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and responding to security assaults from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, endpoint management, and web filtering via cutting-edge technologies packaged within one agent accessible from a unified console. Progent's security and virtualization experts can assist you to plan and configure a ProSight ESP deployment that addresses your company's unique requirements and that helps you prove compliance with government and industry information security standards. Progent will help you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that call for immediate action. Progent's consultants can also help your company to set up and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange filtering.