24/7/365 Manchester Emergency CryptoLocker
Virus Detection and Restoration Consulting

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyberplague that poses an enterprise-level threat for businesses of all sizes vulnerable to an attack. Versions of ransomware like the CrySIS, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for a long time and continue to inflict havoc. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, as well as daily as yet unnamed malware, not only encrypt on-line data files but also infect any configured system restores and backups. Data replicated to the cloud can also be ransomed. In a poorly architected system, this can make automated restoration hopeless and effectively knocks the datacenter back to square one.

Getting back on-line services and data following a ransomware attack becomes a race against the clock as the victim fights to stop lateral movement, eradicate the ransomware, and restore business-critical activity. Since ransomware requires time to move laterally, attacks are often launched during nights and weekends, when successful penetrations typically take more time to discover. This compounds the difficulty of rapidly assembling and orchestrating a capable response team.

Progent offers an assortment of support services for securing enterprises from ransomware attacks. These include user education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with installation of the latest generation security solutions with AI technology from SentinelOne to discover and quarantine new cyber threats intelligently. Progent also can provide the services of experienced ransomware recovery consultants with the talent and commitment to restore a breached environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a crypto-ransomware event, sending the ransom in cryptocurrency does not ensure that cyber criminals will provide the keys to decrypt any of your data. Kaspersky determined that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to re-install the essential parts of your IT environment. Absent access to full information backups, this calls for a wide range of IT skills, professional project management, and the willingness to work continuously until the recovery project is done.

For twenty years, Progent has made available certified expert IT services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained advanced certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with accounting and ERP applications. This breadth of experience provides Progent the ability to knowledgably determine necessary systems and organize the surviving parts of your network environment following a ransomware penetration and rebuild them into an operational system.

Progent's security group deploys state-of-the-art project management systems to orchestrate the complicated restoration process. Progent knows the importance of working swiftly and in unison with a client's management and IT team members to prioritize tasks and to put key applications back on line as soon as humanly possible.

Client Case Study: A Successful Ransomware Intrusion Restoration
A business escalated to Progent after their network was attacked by Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state sponsored hackers, possibly using technology exposed from America's National Security Agency. Ryuk seeks specific companies with little or no tolerance for disruption and is among the most profitable versions of ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing business headquartered in the Chicago metro area and has around 500 staff members. The Ryuk attack had brought down all business operations and manufacturing processes. Most of the client's data backups had been directly accessible at the time of the intrusion and were destroyed. The client was taking steps for paying the ransom demand (exceeding $200K) and wishfully thinking for good luck, but in the end called Progent.

Progent worked hand in hand the client to quickly assess and assign priority to the essential elements that had to be recovered in order to resume departmental operations:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

Within 2 days, Progent was able to re-build Active Directory to its pre-penetration state. Progent then helped perform setup and hard drive recovery of critical applications. All Exchange Server data and configuration information were usable, which facilitated the restore of Exchange. Progent was also able to find intact OST files (Outlook Off-Line Folder Files) on staff desktop computers to recover mail data. A recent offline backup of the businesses accounting/ERP systems made it possible to restore these vital programs back online. Although a lot of work was left to recover completely from the Ryuk event, the most important services were restored quickly:

Throughout the next few weeks key milestones in the restoration process were accomplished in close cooperation between Progent consultants and the client:

• In-house web applications were brought back up without losing any information.
• The MailStore Exchange Server with over 4 million historical emails was spun up and available for users.
• CRM/Orders/Invoices/Accounts Payable/AR/Inventory functions were 100% restored.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Most of the user PCs were operational.

Conclusion
A potential business-killing catastrophe was evaded by dedicated experts, a broad range of IT skills, and close collaboration. Although in post mortem the crypto-ransomware incident detailed here should have been identified and prevented with modern cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and appropriate incident response procedures for data backup and proper patching controls, the reality remains that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware attack, feel confident that Progent's roster of professionals has extensive experience in ransomware virus blocking, removal, and data restoration.

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Manchester a range of remote monitoring and security assessment services designed to help you to reduce the threat from ransomware. These services utilize next-generation artificial intelligence capability to uncover new strains of ransomware that can evade traditional signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent handles the necessary monitoring and management for you, so your system scales easily without holding you back. For an affordable and predictable monthly price, Progent's experienced IT group can be your complete technology safety net. Basic plans include remote monitoring and management (RMM), security, automatic monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) technology to keep your network operating at peak levels by checking the health of vital assets that power your business network. When ProSight LAN Watch detects an issue, an alert is sent immediately to your specified IT staff and your Progent engineering consultant so that any potential issues can be resolved before they have a chance to disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for managing your client-server infrastructure by offering tools for streamlining common time-consuming jobs. These include health checking, patch management, automated repairs, endpoint configuration, backup and recovery, anti-virus protection, secure remote access, standard and custom scripts, resource inventory, endpoint status reports, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it transmits an alarm to your designated IT management staff and your assigned Progent consultant so potential problems can be taken care of before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to diagram, monitor, reconfigure and debug their networking appliances such as switches, firewalls, and access points plus servers, endpoints and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network maps are always updated, captures and displays the configuration of almost all devices on your network, monitors performance, and generates notices when issues are discovered. By automating complex management and troubleshooting activities, WAN Watch can cut hours off ordinary tasks like making network diagrams, reconfiguring your network, finding devices that need critical software patches, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time and in-depth reporting tools designed to work with the leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with advanced backup software providers to create ProSight Data Protection Services (DPS), a portfolio of subscription-based offerings that provide backup-as-a-service. ProSight DPS products automate and track your backup processes and enable non-disruptive backup and rapid restoration of critical files/folders, applications, system images, and VMs. ProSight DPS lets you avoid data loss caused by hardware failures, natural calamities, fire, malware such as ransomware, human mistakes, ill-intentioned insiders, or application glitches. Managed backup services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of leading information security vendors to provide web-based management and comprehensive security for all your inbound and outbound email. The hybrid architecture of Email Guard managed service combines a Cloud Protection Layer with a local security gateway appliance to provide complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's Cloud Protection Layer serves as a first line of defense and blocks most unwanted email from reaching your security perimeter. This reduces your exposure to inbound attacks and conserves network bandwidth and storage. Email Guard's onsite security gateway appliance adds a further layer of inspection for incoming email. For outbound email, the local gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The onsite security gateway can also assist Exchange Server to track and safeguard internal email traffic that originates and ends inside your corporate firewall. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to defend against stolen passwords by using two-factor authentication. Duo enables single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. With 2FA, when you log into a secured application and give your password you are asked to verify your identity via a unit that only you have and that is accessed using a separate network channel. A broad selection of out-of-band devices can be used for this second means of ID validation including an iPhone or Android or watch, a hardware token, a landline phone, etc. You can register several validation devices. To find out more about Duo two-factor identity authentication services, see Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Call Center: Call Center Managed Services
  Progent's Help Desk services enable your IT group to offload Support Desk services to Progent or divide activity for Help Desk services transparently between your in-house network support team and Progent's extensive pool of certified IT support engineers and subject matter experts. Progent's Co-managed Service Desk offers a smooth supplement to your in-house network support organization. Client interaction with the Help Desk, delivery of support services, problem escalation, ticket generation and tracking, efficiency metrics, and maintenance of the support database are consistent whether issues are taken care of by your in-house network support organization, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Call Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection solution that utilizes next generation behavior analysis tools to guard endpoints as well as physical and virtual servers against new malware assaults such as ransomware and email phishing, which easily evade traditional signature-matching anti-virus tools. Progent Active Security Monitoring services protect on-premises and cloud resources and provides a single platform to manage the complete malware attack lifecycle including blocking, infiltration detection, containment, remediation, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new attacks. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, retrieve and protect information related to your network infrastructure, processes, applications, and services. You can instantly locate passwords or IP addresses and be alerted about upcoming expirations of SSLs or domains. By updating and organizing your network documentation, you can eliminate up to 50% of time thrown away searching for vital information about your IT network. ProSight IT Asset Management features a centralized location for storing and collaborating on all documents required for managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT information. Whether you're making enhancements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the information you need as soon as you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for patch management offer businesses of all sizes a versatile and cost-effective alternative for assessing, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving IT network. Besides maximizing the protection and reliability of your IT network, Progent's patch management services allow your IT staff to focus on more strategic initiatives and tasks that derive maximum business value from your information network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual host configured and managed by Progent's IT support experts. Under Progent's ProSight Virtual Hosting model, the client owns the data, the operating system platforms, and the apps. Since the environment is virtualized, it can be ported immediately to an alternate hardware solution without requiring a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which routinely escape traditional signature-matching AV tools. ProSight ASM protects on-premises and cloud resources and offers a single platform to manage the entire threat progression including blocking, detection, mitigation, cleanup, and post-attack forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection managed services deliver affordable multi-layer security for physical and virtual servers, workstations, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and reacting to security assaults from all vectors. ProSight ESP offers two-way firewall protection, penetration alarms, endpoint control, and web filtering through cutting-edge tools incorporated within one agent managed from a unified control. Progent's data protection and virtualization experts can assist you to plan and implement a ProSight ESP environment that meets your company's unique needs and that allows you prove compliance with legal and industry information protection regulations. Progent will help you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that call for immediate attention. Progent's consultants can also assist your company to set up and test a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange filtering.