24/7 Londrina Urgent Ransomware
Virus Identification and Repair Services

Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become an escalating cyber pandemic that poses an enterprise-level threat for organizations vulnerable to an assault. Multiple generations of crypto-ransomware such as Reveton, Fusob, Locky, SamSam and MongoLock cryptoworms have been circulating for a long time and still inflict harm. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, along with daily as yet unnamed malware, not only do encryption of online files but also infiltrate many configured system protection mechanisms. Data replicated to off-site disaster recovery sites can also be held hostage. In a poorly architected environment, this can make automatic recovery impossible and effectively sets the network back to square one.

Getting back online services and data following a ransomware event becomes a race against the clock as the targeted business struggles to stop lateral movement, remove the crypto-ransomware, and resume mission-critical operations. Due to the fact that crypto-ransomware requires time to spread, penetrations are often sprung at night, when penetrations tend to take longer to identify. This multiplies the difficulty of quickly mobilizing and coordinating a capable response team.

Progent has an assortment of services for securing enterprises from crypto-ransomware attacks. Among these are team education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of next-generation security solutions with machine learning capabilities from SentinelOne to identify and disable zero-day threats automatically. Progent also offers the assistance of experienced ransomware recovery consultants with the track record and commitment to restore a compromised environment as quickly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a ransomware penetration, even paying the ransom in cryptocurrency does not guarantee that criminal gangs will respond with the keys to unencrypt any of your information. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their information after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The alternative is to setup from scratch the essential elements of your Information Technology environment. Without the availability of essential system backups, this calls for a broad range of IT skills, well-coordinated team management, and the ability to work continuously until the job is complete.

For two decades, Progent has offered professional IT services for companies throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained high-level certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have earned internationally-recognized certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of expertise affords Progent the capability to knowledgably determine critical systems and consolidate the surviving pieces of your network system after a crypto-ransomware attack and rebuild them into an operational network.

Progent's recovery team uses best of breed project management tools to orchestrate the complicated recovery process. Progent understands the importance of acting swiftly and in concert with a customer's management and Information Technology resources to prioritize tasks and to get key services back on-line as fast as humanly possible.

Client Case Study: A Successful Ransomware Incident Recovery
A customer sought out Progent after their network system was taken over by the Ryuk ransomware. Ryuk is believed to have been deployed by Northern Korean state sponsored hackers, possibly using algorithms leaked from the U.S. National Security Agency. Ryuk attacks specific companies with limited ability to sustain disruption and is among the most profitable examples of ransomware. Headline targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business located in Chicago and has about 500 workers. The Ryuk penetration had brought down all essential operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the start of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (exceeding $200,000) and praying for the best, but in the end called Progent.

Progent worked hand in hand the customer to quickly identify and assign priority to the most important services that needed to be addressed to make it possible to continue departmental functions:

• Windows Active Directory
• Microsoft Exchange Server
• Accounting/MRP

Within two days, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then assisted with rebuilding and hard drive recovery of key systems. All Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was able to find local OST data files (Microsoft Outlook Off-Line Folder Files) on various PCs in order to recover mail messages. A not too old offline backup of the customer's financials/ERP systems made them able to restore these essential applications back servicing users. Although significant work was left to recover fully from the Ryuk event, the most important systems were restored rapidly:

Over the following few weeks critical milestones in the restoration process were completed in close cooperation between Progent engineers and the customer:

• Self-hosted web sites were brought back up without losing any information.
• The MailStore Server containing more than four million historical messages was brought online and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control modules were fully functional.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the user PCs were fully operational.

Conclusion
A potential business-killing disaster was dodged by results-oriented experts, a broad spectrum of technical expertise, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware incident described here should have been stopped with up-to-date cyber security systems and ISO/IEC 27001 best practices, user and IT administrator training, and properly executed security procedures for data protection and keeping systems up to date with security patches, the reality is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware incursion, feel confident that Progent's team of professionals has a proven track record in ransomware virus defense, cleanup, and information systems disaster recovery.

To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Londrina a variety of remote monitoring and security evaluation services to assist you to minimize your vulnerability to crypto-ransomware. These services include modern AI capability to detect zero-day strains of crypto-ransomware that can evade traditional signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent takes care of the daily monitoring and maintenance for you, so your network expands readily without becoming an obstacle. For a low and predictable monthly price, Progent's full-service IT group can be your complete technology safety net. Basic packages include remote monitoring and management, cybersecurity, automatic monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to help keep your network operating efficiently by checking the state of critical computers that drive your information system. When ProSight LAN Watch detects a problem, an alarm is transmitted automatically to your specified IT management personnel and your assigned Progent consultant so any looming problems can be addressed before they can disrupt productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your client-server infrastructure by offering an environment for performing common tedious jobs. These include health checking, patch management, automated remediation, endpoint configuration, backup and restore, A/V response, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and debugging help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alarm to your specified IT management staff and your assigned Progent consultant so emerging problems can be taken care of before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized businesses to map out, track, enhance and troubleshoot their connectivity hardware such as routers, firewalls, and load balancers as well as servers, printers, endpoints and other networked devices. Using state-of-the-art RMM technology, WAN Watch ensures that infrastructure topology maps are always current, captures and displays the configuration of almost all devices on your network, monitors performance, and generates alerts when potential issues are detected. By automating time-consuming network management activities, ProSight WAN Watch can knock hours off ordinary tasks such as network mapping, expanding your network, finding devices that need important software patches, or isolating performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of in-depth reporting utilities created to integrate with the industry's top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as inconsistent support follow-up or machines with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with advanced backup/restore technology providers to produce ProSight Data Protection Services, a selection of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and track your backup operations and allow non-disruptive backup and rapid recovery of critical files/folders, applications, images, and VMs. ProSight DPS lets your business recover from data loss resulting from hardware breakdown, natural calamities, fire, malware such as ransomware, user mistakes, malicious insiders, or application glitches. Managed services available in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of top data security companies to deliver web-based control and world-class security for your email traffic. The powerful structure of Progent's Email Guard integrates cloud-based filtering with a local security gateway device to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based threats. The Cloud Protection Layer serves as a preliminary barricade and keeps most unwanted email from making it to your network firewall. This reduces your exposure to inbound threats and conserves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a further level of inspection for inbound email. For outbound email, the local security gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The onsite gateway can also help Microsoft Exchange Server to monitor and protect internal email that stays inside your corporate firewall. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo technology to protect against compromised passwords by using two-factor authentication (2FA). Duo enables one-tap identity verification on iOS, Android, and other out-of-band devices. With 2FA, when you sign into a secured online account and give your password you are asked to verify your identity on a device that only you possess and that uses a different network channel. A wide range of devices can be utilized as this added form of ID validation including an iPhone or Android or watch, a hardware token, a landline telephone, etc. You may register several validation devices. For details about Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Center: Call Center Managed Services
  Progent's Help Center managed services allow your IT group to offload Call Center services to Progent or divide responsibilities for Service Desk support seamlessly between your in-house support team and Progent's nationwide pool of IT support engineers and subject matter experts (SMEs). Progent's Shared Service Desk provides a smooth extension of your core support resources. User interaction with the Service Desk, provision of support services, problem escalation, trouble ticket generation and tracking, performance measurement, and management of the support database are cohesive regardless of whether issues are taken care of by your core support group, by Progent's team, or both. Learn more about Progent's outsourced/shared Help Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior analysis tools to guard endpoints and servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily evade legacy signature-based AV products. Progent ASM services protect local and cloud resources and offers a unified platform to automate the complete threat progression including protection, identification, containment, remediation, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered attacks. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, find and protect data about your IT infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSLs ,domains or warranties. By cleaning up and organizing your network documentation, you can save up to half of time wasted searching for critical information about your network. ProSight IT Asset Management includes a common location for storing and sharing all documents related to managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT data. Whether you're planning enhancements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you need when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management offer businesses of all sizes a flexible and affordable alternative for evaluating, testing, scheduling, applying, and documenting updates to your ever-evolving information network. In addition to optimizing the protection and functionality of your computer environment, Progent's patch management services free up time for your IT staff to concentrate on line-of-business projects and activities that derive the highest business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a secure Tier III data center on a fast virtual host set up and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting service model, the client owns the data, the operating system platforms, and the applications. Since the environment is virtualized, it can be ported easily to a different hardware environment without requiring a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not tied one hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior-based analysis tools to guard physical and virtual endpoints against modern malware assaults such as ransomware and file-less exploits, which routinely get by traditional signature-based AV products. ProSight ASM safeguards on-premises and cloud-based resources and provides a single platform to manage the complete malware attack lifecycle including protection, detection, containment, remediation, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection managed services deliver affordable multi-layer security for physical and virtual servers, desktops, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and advanced heuristics for round-the-clock monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, device control, and web filtering through cutting-edge technologies incorporated within a single agent accessible from a single control. Progent's data protection and virtualization consultants can assist your business to design and configure a ProSight ESP deployment that meets your organization's specific needs and that helps you achieve and demonstrate compliance with government and industry information protection regulations. Progent will assist you define and configure security policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require urgent action. Progent can also help you to install and test a backup and restore system like ProSight Data Protection Services (DPS) so you can recover quickly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.