24-7 Mesa Critical Crypto
Virus Identification and Restoration Consultants

Crypto-Ransomware : Your Feared Information Technology Disaster
Ransomware has become an escalating cyberplague that poses an enterprise-level danger for businesses of all sizes vulnerable to an assault. Multiple generations of ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for many years and still inflict havoc. The latest variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Egregor, as well as daily unnamed malware, not only do encryption of online critical data but also infiltrate most available system protection. Information synched to off-site disaster recovery sites can also be encrypted. In a poorly architected system, this can render any restoration impossible and effectively knocks the network back to zero.

Getting back applications and information after a ransomware intrusion becomes a race against time as the targeted organization struggles to stop the spread, remove the ransomware, and resume enterprise-critical activity. Due to the fact that crypto-ransomware takes time to move laterally, penetrations are frequently sprung during nights and weekends, when penetrations tend to take more time to notice. This compounds the difficulty of quickly marshalling and orchestrating a knowledgeable mitigation team.

Progent offers an assortment of support services for protecting organizations from ransomware events. Among these are team education to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of the latest generation security gateways with artificial intelligence capabilities from SentinelOne to identify and disable zero-day cyber threats rapidly. Progent also provides the services of expert ransomware recovery consultants with the track record and perseverance to restore a compromised network as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Following a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will return the keys to unencrypt any of your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their files even after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to piece back together the key components of your Information Technology environment. Absent the availability of complete information backups, this requires a wide range of skill sets, professional team management, and the capability to work non-stop until the job is completed.

For decades, Progent has provided certified expert IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have attained high-level certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of experience gives Progent the skills to quickly ascertain necessary systems and re-organize the surviving components of your network environment after a crypto-ransomware event and assemble them into a functioning network.

Progent's recovery team of experts deploys best of breed project management applications to orchestrate the sophisticated restoration process. Progent appreciates the importance of working swiftly and together with a customer's management and IT team members to prioritize tasks and to put essential systems back on line as fast as possible.

Client Case Study: A Successful Crypto-Ransomware Incident Recovery
A small business contacted Progent after their organization was taken over by the Ryuk crypto-ransomware. Ryuk is believed to have been deployed by Northern Korean state hackers, possibly using strategies exposed from the United States National Security Agency. Ryuk targets specific businesses with little or no ability to sustain disruption and is one of the most lucrative instances of crypto-ransomware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturer located in Chicago with about 500 workers. The Ryuk intrusion had disabled all company operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the beginning of the attack and were eventually encrypted. The client was evaluating paying the ransom (more than $200K) and praying for good luck, but ultimately engaged Progent.

Progent worked hand in hand the client to rapidly determine and prioritize the essential services that had to be recovered in order to continue departmental functions:

• Microsoft Active Directory
• Microsoft Exchange
• MRP System

Within two days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then assisted with rebuilding and storage recovery on the most important systems. All Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to locate intact OST files (Outlook Offline Folder Files) on team PCs and laptops in order to recover mail data. A recent offline backup of the customer's financials/ERP software made it possible to return these required applications back servicing users. Although a lot of work remained to recover fully from the Ryuk event, the most important services were returned to operations quickly:

Throughout the next month important milestones in the recovery project were accomplished in close cooperation between Progent team members and the client:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million archived emails was restored to operations and accessible to users.
• CRM/Orders/Invoicing/AP/AR/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 firewall was installed.
• Nearly all of the user PCs were being used by staff.

Conclusion
A possible business extinction disaster was evaded by dedicated professionals, a wide spectrum of technical expertise, and tight collaboration. Although in post mortem the ransomware attack described here would have been disabled with advanced security technology and ISO/IEC 27001 best practices, user and IT administrator education, and properly executed incident response procedures for backup and applying software patches, the fact remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware penetration, remember that Progent's team of professionals has proven experience in crypto-ransomware virus blocking, remediation, and information systems recovery.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Mesa a portfolio of online monitoring and security evaluation services to help you to reduce the threat from ransomware. These services include next-generation artificial intelligence technology to uncover new variants of crypto-ransomware that are able to get past traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent handles the daily monitoring and management for you, so your network expands smoothly without holding you back. For an affordable and predictable monthly price, Progent's experienced IT team can be your dependable technology safety net. Basic packages include remote monitoring and management, cybersecurity, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to keep your network operating efficiently by tracking the state of vital assets that drive your information system. When ProSight LAN Watch uncovers an issue, an alert is sent automatically to your designated IT management personnel and your Progent consultant so all potential issues can be resolved before they have a chance to impact your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for managing your network, server, and desktop devices by providing tools for streamlining common time-consuming jobs. These can include health monitoring, patch management, automated repairs, endpoint configuration, backup and recovery, A/V defense, remote access, standard and custom scripts, asset inventory, endpoint status reports, and debugging help. If ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your designated IT personnel and your assigned Progent technical consultant so that emerging problems can be fixed before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller organizations to diagram, track, enhance and troubleshoot their networking hardware like routers, firewalls, and wireless controllers plus servers, endpoints and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that infrastructure topology maps are always current, captures and manages the configuration information of virtually all devices connected to your network, monitors performance, and sends notices when potential issues are detected. By automating complex management activities, WAN Watch can cut hours off common tasks like making network diagrams, expanding your network, finding appliances that need critical updates, or resolving performance issues. Learn more details about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of real-time management reporting utilities designed to work with the industry's top ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues like inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with advanced backup technology companies to produce ProSight Data Protection Services, a family of subscription-based offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup operations and enable transparent backup and rapid recovery of vital files/folders, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets your business avoid data loss resulting from equipment failures, natural disasters, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned employees, or software bugs. Managed services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading data security vendors to provide centralized management and comprehensive protection for all your email traffic. The hybrid architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with an on-premises gateway device to provide advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's cloud filter serves as a first line of defense and keeps most threats from reaching your security perimeter. This decreases your vulnerability to inbound attacks and conserves system bandwidth and storage space. Email Guard's onsite security gateway device provides a further level of analysis for inbound email. For outbound email, the onsite gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The on-premises gateway can also help Exchange Server to monitor and protect internal email traffic that stays inside your corporate firewall. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo technology to defend against stolen passwords by using two-factor authentication. Duo supports single-tap identity verification with iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you sign into a protected online account and enter your password you are asked to confirm who you are via a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A broad range of devices can be utilized as this added form of authentication such as a smartphone or wearable, a hardware token, a landline phone, etc. You can register multiple verification devices. For details about ProSight Duo two-factor identity authentication services, see Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Service Desk: Call Center Managed Services
  Progent's Help Center services enable your information technology team to outsource Call Center services to Progent or divide responsibilities for support services transparently between your in-house support team and Progent's nationwide roster of IT support technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a seamless supplement to your core support organization. End user interaction with the Help Desk, delivery of support services, issue escalation, trouble ticket creation and tracking, performance measurement, and management of the service database are consistent regardless of whether incidents are resolved by your in-house network support organization, by Progent, or both. Learn more about Progent's outsourced/shared Call Center services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior-based machine learning technology to guard endpoint devices and servers and VMs against new malware attacks like ransomware and file-less exploits, which routinely escape traditional signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard local and cloud resources and offers a unified platform to address the entire malware attack progression including protection, detection, containment, remediation, and forensics. Top capabilities include one-click rollback with Windows VSS and automatic system-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and protect information about your IT infrastructure, processes, business apps, and services. You can instantly locate passwords or IP addresses and be alerted about upcoming expirations of SSL certificates or warranties. By cleaning up and organizing your network documentation, you can save up to 50% of time spent trying to find vital information about your IT network. ProSight IT Asset Management includes a common repository for holding and collaborating on all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and associating IT information. Whether you're making enhancements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you require the instant you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management offer businesses of any size a versatile and affordable solution for assessing, testing, scheduling, applying, and tracking updates to your dynamic IT system. Besides maximizing the protection and reliability of your IT network, Progent's software/firmware update management services allow your IT staff to focus on more strategic projects and activities that deliver the highest business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a protected fault tolerant data center on a high-performance virtual machine host set up and maintained by Progent's network support experts. Under the ProSight Virtual Hosting model, the customer owns the data, the OS software, and the apps. Since the system is virtualized, it can be ported immediately to a different hardware solution without a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's cutting edge behavior-based analysis technology to guard physical and virtual endpoints against new malware assaults such as ransomware and file-less exploits, which easily evade legacy signature-matching anti-virus products. ProSight Active Security Monitoring protects on-premises and cloud-based resources and provides a unified platform to address the complete threat progression including protection, infiltration detection, mitigation, remediation, and forensics. Key features include single-click rollback with Windows VSS and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services offer affordable in-depth security for physical servers and virtual machines, desktops, smartphones, and Exchange email. ProSight ESP utilizes adaptive security and advanced heuristics for round-the-clock monitoring and responding to security assaults from all attack vectors. ProSight ESP offers firewall protection, penetration alarms, device management, and web filtering via leading-edge tools incorporated within a single agent accessible from a single control. Progent's security and virtualization experts can assist you to design and implement a ProSight ESP deployment that meets your company's unique requirements and that allows you demonstrate compliance with legal and industry data security standards. Progent will assist you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that call for urgent action. Progent's consultants can also assist your company to set up and verify a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange filtering.