24/7/365 Las Vegas Urgent CryptoLocker
Malware Identification and Remediation Consultants

Ransomware : Your Crippling IT Disaster
Crypto-Ransomware has become a modern cyber pandemic that presents an extinction-level danger for businesses of all sizes vulnerable to an assault. Multiple generations of ransomware like the CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and still inflict destruction. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, plus more unnamed viruses, not only do encryption of on-line files but also infect all accessible system restores and backups. Information replicated to cloud environments can also be ransomed. In a poorly designed environment, this can render any restoration useless and effectively sets the entire system back to zero.

Restoring services and information after a ransomware intrusion becomes a sprint against the clock as the victim tries its best to stop the spread, cleanup the virus, and resume enterprise-critical operations. Due to the fact that crypto-ransomware takes time to move laterally, attacks are often sprung on weekends, when successful attacks tend to take more time to uncover. This compounds the difficulty of quickly assembling and organizing a qualified mitigation team.

Progent makes available a range of solutions for protecting businesses from ransomware events. Among these are team education to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of the latest generation security gateways with artificial intelligence technology from SentinelOne to detect and quarantine day-zero cyber threats rapidly. Progent also provides the assistance of veteran ransomware recovery consultants with the talent and perseverance to reconstruct a compromised system as rapidly as possible.

Progent's Ransomware Recovery Help
Subsequent to a ransomware invasion, paying the ransom demands in cryptocurrency does not guarantee that distant criminals will provide the keys to decipher all your files. Kaspersky estimated that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to setup from scratch the key parts of your IT environment. Absent access to complete system backups, this requires a broad complement of skills, professional team management, and the ability to work non-stop until the recovery project is completed.

For twenty years, Progent has offered expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have been awarded high-level certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP software solutions. This breadth of experience provides Progent the skills to rapidly determine important systems and re-organize the surviving pieces of your computer network system following a ransomware penetration and configure them into a functioning system.

Progent's security team uses best of breed project management applications to orchestrate the sophisticated recovery process. Progent understands the urgency of working swiftly and in concert with a customer's management and Information Technology resources to assign priority to tasks and to get critical applications back on line as soon as humanly possible.

Case Study: A Successful Ransomware Virus Recovery
A client engaged Progent after their network was attacked by the Ryuk crypto-ransomware. Ryuk is generally considered to have been launched by Northern Korean state hackers, possibly adopting algorithms leaked from America's NSA organization. Ryuk goes after specific companies with little or no room for disruption and is one of the most profitable instances of ransomware. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturer based in Chicago and has around 500 staff members. The Ryuk attack had paralyzed all essential operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the beginning of the intrusion and were eventually encrypted. The client was pursuing financing for paying the ransom (exceeding $200,000) and hoping for good luck, but ultimately brought in Progent.

Progent worked hand in hand the customer to rapidly determine and assign priority to the critical areas that had to be restored to make it possible to resume business functions:

• Active Directory (AD)
• E-Mail
• MRP System

Within two days, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then accomplished reinstallations and hard drive recovery of critical applications. All Exchange Server schema and configuration information were intact, which accelerated the restore of Exchange. Progent was able to locate local OST data files (Outlook Off-Line Folder Files) on team workstations in order to recover email information. A not too old off-line backup of the businesses accounting software made it possible to return these vital services back online. Although a large amount of work needed to be completed to recover fully from the Ryuk damage, the most important services were restored quickly:

Over the following month important milestones in the recovery project were made through tight collaboration between Progent consultants and the customer:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Server containing more than 4 million archived emails was spun up and available for users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory capabilities were 100 percent operational.
• A new Palo Alto 850 security appliance was brought on-line.
• Ninety percent of the user PCs were operational.

Conclusion
A likely business catastrophe was evaded through the efforts of dedicated professionals, a wide range of technical expertise, and tight collaboration. Although in retrospect the crypto-ransomware virus incident described here should have been prevented with up-to-date cyber security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and well thought out incident response procedures for data protection and keeping systems up to date with security patches, the reality is that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware incident, remember that Progent's team of professionals has substantial experience in ransomware virus defense, cleanup, and data disaster recovery.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Las Vegas a variety of online monitoring and security assessment services to help you to minimize your vulnerability to ransomware. These services utilize next-generation AI technology to uncover zero-day strains of ransomware that can get past legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve leading-edge network resilience. Progent takes care of the necessary monitoring and management for you, so your network scales readily without becoming an obstacle. For a low and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management (RMM), security, monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) techniques to help keep your IT system running efficiently by tracking the health of critical computers that drive your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted automatically to your designated IT management staff and your assigned Progent engineering consultant so all looming issues can be resolved before they can impact productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for managing your client-server infrastructure by offering tools for streamlining common tedious tasks. These include health monitoring, update management, automated repairs, endpoint configuration, backup and restore, A/V protection, remote access, standard and custom scripts, asset inventory, endpoint status reports, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alarm to your specified IT management personnel and your assigned Progent consultant so emerging problems can be taken care of before they interfere with your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to map, track, reconfigure and troubleshoot their connectivity hardware such as switches, firewalls, and wireless controllers as well as servers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network diagrams are always updated, captures and manages the configuration of almost all devices connected to your network, monitors performance, and generates notices when problems are detected. By automating complex management activities, ProSight WAN Watch can knock hours off ordinary chores such as making network diagrams, expanding your network, locating devices that require important updates, or isolating performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time reporting tools designed to work with the top ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues like inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup technology companies to produce ProSight Data Protection Services (DPS), a portfolio of subscription-based offerings that provide backup-as-a-service. ProSight DPS services manage and monitor your backup operations and enable non-disruptive backup and rapid restoration of vital files/folders, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS lets you recover from data loss caused by hardware breakdown, natural calamities, fire, malware like ransomware, human mistakes, malicious insiders, or application glitches. Managed services available in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading data security vendors to provide centralized management and comprehensive protection for your email traffic. The powerful structure of Email Guard combines cloud-based filtering with a local gateway appliance to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's cloud filter acts as a first line of defense and blocks most threats from making it to your network firewall. This reduces your vulnerability to external threats and saves network bandwidth and storage. Email Guard's onsite security gateway appliance provides a deeper level of analysis for inbound email. For outbound email, the local security gateway provides AV and anti-spam filtering, protection against data leaks, and email encryption. The onsite security gateway can also assist Microsoft Exchange Server to monitor and protect internal email that stays within your security perimeter. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans incorporate Cisco's Duo cloud technology to defend against password theft through the use of two-factor authentication (2FA). Duo enables single-tap identity verification with iOS, Google Android, and other out-of-band devices. Using Duo 2FA, whenever you sign into a protected online account and enter your password you are requested to verify your identity on a unit that only you possess and that uses a separate network channel. A broad selection of out-of-band devices can be utilized as this added form of authentication including an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You can register multiple verification devices. For more information about Duo two-factor identity validation services, refer to Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Service Desk: Support Desk Managed Services
  Progent's Support Center services permit your IT group to outsource Call Center services to Progent or split activity for Help Desk services seamlessly between your internal support resources and Progent's extensive roster of certified IT support technicians, engineers and subject matter experts. Progent's Shared Service Desk provides a seamless extension of your core support group. End user access to the Help Desk, delivery of technical assistance, escalation, ticket generation and tracking, efficiency metrics, and maintenance of the service database are consistent regardless of whether issues are taken care of by your corporate IT support group, by Progent, or both. Read more about Progent's outsourced/co-managed Help Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates cutting edge behavior-based machine learning technology to guard endpoints and servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily get by legacy signature-based AV tools. Progent Active Security Monitoring services protect on-premises and cloud-based resources and offers a unified platform to manage the complete threat lifecycle including blocking, identification, containment, cleanup, and post-attack forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, retrieve and safeguard data about your network infrastructure, processes, business apps, and services. You can quickly find passwords or serial numbers and be alerted about upcoming expirations of SSLs or domains. By updating and organizing your IT infrastructure documentation, you can save up to 50% of time wasted looking for critical information about your network. ProSight IT Asset Management features a common location for storing and collaborating on all documents related to managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT data. Whether you're making enhancements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need when you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide businesses of any size a flexible and cost-effective alternative for evaluating, testing, scheduling, implementing, and documenting updates to your dynamic IT system. In addition to optimizing the security and functionality of your IT environment, Progent's software/firmware update management services free up time for your in-house IT staff to focus on line-of-business initiatives and tasks that derive maximum business value from your network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual host set up and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS software, and the apps. Since the environment is virtualized, it can be ported easily to an alternate hardware environment without requiring a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not tied one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection service that incorporates SentinelOne's cutting edge behavior analysis tools to guard physical and virtual endpoint devices against modern malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-based anti-virus tools. ProSight ASM safeguards on-premises and cloud resources and offers a unified platform to automate the entire malware attack lifecycle including filtering, identification, mitigation, remediation, and post-attack forensics. Top capabilities include single-click rollback using Windows VSS and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer economical multi-layer protection for physical servers and VMs, desktops, smartphones, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP delivers firewall protection, penetration alerts, endpoint control, and web filtering via leading-edge technologies packaged within a single agent managed from a single console. Progent's security and virtualization consultants can assist you to plan and configure a ProSight ESP environment that meets your company's unique requirements and that allows you prove compliance with legal and industry data protection regulations. Progent will help you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for immediate attention. Progent's consultants can also assist you to set up and verify a backup and restore solution like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Microsoft Exchange filtering.