Mexico City 24-7 Urgent Crypto
Computer Virus Detection and Removal Consulting

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a too-frequent cyberplague that presents an existential threat for organizations poorly prepared for an attack. Multiple generations of crypto-ransomware such as Dharma, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been replicating for a long time and continue to inflict havoc. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, along with more as yet unnamed viruses, not only do encryption of online files but also infect any available system restores and backups. Files replicated to off-site disaster recovery sites can also be encrypted. In a vulnerable environment, it can make automated restoration hopeless and effectively knocks the datacenter back to zero.

Restoring programs and information following a crypto-ransomware outage becomes a race against time as the targeted business tries its best to stop lateral movement, eradicate the ransomware, and resume business-critical activity. Since ransomware requires time to replicate, assaults are often launched at night, when successful penetrations may take more time to identify. This multiplies the difficulty of quickly mobilizing and coordinating a capable response team.

Progent makes available a range of solutions for securing businesses from ransomware penetrations. Among these are user training to help identify and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of modern security solutions with machine learning technology from SentinelOne to detect and disable day-zero cyber threats automatically. Progent also offers the services of seasoned crypto-ransomware recovery professionals with the skills and perseverance to re-deploy a compromised environment as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Following a crypto-ransomware attack, even paying the ransom in cryptocurrency does not guarantee that cyber hackers will return the needed keys to unencrypt all your information. Kaspersky Labs determined that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The fallback is to setup from scratch the critical components of your IT environment. Absent access to essential data backups, this requires a broad range of skills, well-coordinated project management, and the capability to work non-stop until the task is completed.

For twenty years, Progent has provided professional IT services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded high-level certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial systems and ERP application software. This breadth of expertise gives Progent the capability to quickly ascertain necessary systems and integrate the surviving parts of your IT system after a ransomware attack and assemble them into a functioning system.

Progent's ransomware group uses powerful project management applications to coordinate the sophisticated restoration process. Progent appreciates the urgency of working quickly and together with a customer's management and IT team members to prioritize tasks and to get the most important services back on-line as soon as humanly possible.

Client Story: A Successful Ransomware Incident Response
A client sought out Progent after their network was taken over by the Ryuk crypto-ransomware. Ryuk is thought to have been developed by North Korean government sponsored hackers, suspected of using strategies leaked from the U.S. National Security Agency. Ryuk attacks specific companies with little or no tolerance for operational disruption and is among the most profitable versions of crypto-ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer based in the Chicago metro area and has around 500 employees. The Ryuk event had shut down all business operations and manufacturing capabilities. Most of the client's data protection had been online at the start of the intrusion and were encrypted. The client considered paying the ransom demand (exceeding $200,000) and wishfully thinking for the best, but ultimately reached out to Progent.

Progent worked together with the customer to quickly understand and prioritize the key applications that had to be addressed to make it possible to continue company operations:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

Within 2 days, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then helped perform reinstallations and storage recovery on key systems. All Microsoft Exchange Server schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to find non-encrypted OST files (Outlook Offline Data Files) on various PCs in order to recover mail data. A recent offline backup of the client's accounting/ERP systems made them able to restore these essential programs back servicing users. Although a lot of work remained to recover completely from the Ryuk attack, critical services were recovered rapidly:

During the following month critical milestones in the restoration project were made through tight cooperation between Progent team members and the client:

• Self-hosted web applications were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million archived emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory Control functions were 100 percent restored.
• A new Palo Alto Networks 850 firewall was brought online.
• Most of the user workstations were fully operational.

Conclusion
A probable business-killing catastrophe was avoided through the efforts of results-oriented professionals, a wide array of technical expertise, and close collaboration. Although in analyzing the event afterwards the ransomware virus incident detailed here would have been identified and prevented with modern security systems and best practices, user and IT administrator training, and well designed incident response procedures for data backup and applying software patches, the reality is that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware attack, feel confident that Progent's team of professionals has a proven track record in crypto-ransomware virus defense, mitigation, and information systems restoration.

To read or download a PDF version of this customer case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Mexico City a portfolio of online monitoring and security assessment services designed to assist you to reduce your vulnerability to crypto-ransomware. These services include modern AI capability to detect zero-day variants of ransomware that can evade traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to achieve leading-edge IT resilience. Progent handles the daily monitoring and management for you, so your network scales easily without holding you back. For a low and predictable monthly price, Progent's full-service IT group can be your complete technology safety net. Entry-level packages include remote monitoring and management, security, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management technology to help keep your IT system operating at peak levels by checking the state of critical computers that drive your business network. When ProSight LAN Watch detects an issue, an alert is transmitted immediately to your specified IT personnel and your Progent consultant so all potential problems can be resolved before they have a chance to disrupt productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven solution for monitoring and managing your client-server infrastructure by providing an environment for streamlining common time-consuming tasks. These can include health checking, patch management, automated remediation, endpoint deployment, backup and recovery, A/V protection, remote access, built-in and custom scripts, asset inventory, endpoint profile reports, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it transmits an alarm to your specified IT staff and your Progent technical consultant so emerging issues can be taken care of before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized organizations to diagram, track, optimize and debug their connectivity appliances such as routers, firewalls, and load balancers plus servers, printers, client computers and other networked devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch ensures that infrastructure topology diagrams are kept current, copies and manages the configuration information of virtually all devices on your network, tracks performance, and sends notices when problems are detected. By automating complex management and troubleshooting processes, WAN Watch can cut hours off ordinary chores like making network diagrams, expanding your network, finding devices that require critical software patches, or resolving performance issues. Learn more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time and in-depth reporting plug-ins designed to work with the top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues like inconsistent support follow-through or machines with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has worked with leading backup technology providers to produce ProSight Data Protection Services (DPS), a family of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS services manage and track your backup operations and enable non-disruptive backup and fast restoration of critical files, apps, images, plus VMs. ProSight DPS lets your business protect against data loss caused by equipment breakdown, natural disasters, fire, malware like ransomware, human mistakes, ill-intentioned insiders, or software bugs. Managed backup services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of top information security companies to provide centralized management and world-class protection for all your email traffic. The powerful structure of Email Guard managed service integrates a Cloud Protection Layer with a local gateway appliance to provide complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. Email Guard's Cloud Protection Layer acts as a preliminary barricade and keeps most threats from reaching your security perimeter. This reduces your vulnerability to external threats and saves system bandwidth and storage. Email Guard's onsite security gateway device adds a deeper layer of analysis for incoming email. For outgoing email, the onsite gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to track and safeguard internal email that stays inside your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication service plans utilize Cisco's Duo technology to defend against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity verification with Apple iOS, Google Android, and other personal devices. Using Duo 2FA, whenever you sign into a protected online account and enter your password you are asked to verify your identity on a device that only you possess and that uses a different network channel. A wide selection of devices can be utilized as this added means of authentication including an iPhone or Android or watch, a hardware/software token, a landline telephone, etc. You may designate multiple validation devices. For more information about ProSight Duo identity validation services, refer to Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Help Center managed services permit your information technology team to outsource Call Center services to Progent or divide activity for support services seamlessly between your internal network support team and Progent's nationwide pool of IT service engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a smooth extension of your corporate support team. Client access to the Help Desk, delivery of support, issue escalation, ticket generation and tracking, efficiency measurement, and management of the support database are consistent regardless of whether incidents are resolved by your in-house support resources, by Progent, or both. Find out more about Progent's outsourced/shared Service Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes next generation behavior machine learning tools to defend endpoints as well as servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily get by legacy signature-based anti-virus tools. Progent ASM services protect local and cloud-based resources and offers a single platform to manage the entire malware attack progression including protection, detection, containment, cleanup, and forensics. Key features include single-click rollback using Windows VSS and automatic system-wide immunization against new attacks. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, find and protect data related to your IT infrastructure, procedures, applications, and services. You can instantly locate passwords or IP addresses and be warned automatically about impending expirations of SSLs or domains. By updating and managing your IT documentation, you can save as much as 50% of time thrown away looking for critical information about your IT network. ProSight IT Asset Management includes a centralized location for holding and sharing all documents related to managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're planning improvements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a versatile and affordable solution for assessing, testing, scheduling, implementing, and documenting software and firmware updates to your dynamic IT system. Besides maximizing the protection and functionality of your IT environment, Progent's software/firmware update management services free up time for your IT staff to focus on more strategic initiatives and tasks that derive maximum business value from your network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host set up and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system software, and the applications. Because the environment is virtualized, it can be moved immediately to a different hosting solution without requiring a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior-based analysis technology to defend physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which easily escape traditional signature-matching anti-virus tools. ProSight Active Security Monitoring protects on-premises and cloud resources and offers a single platform to address the complete malware attack lifecycle including blocking, infiltration detection, mitigation, remediation, and forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver economical multi-layer security for physical servers and VMs, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and responding to security assaults from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, endpoint management, and web filtering through leading-edge tools incorporated within one agent managed from a unified console. Progent's data protection and virtualization experts can assist you to plan and configure a ProSight ESP environment that meets your organization's specific needs and that helps you demonstrate compliance with legal and industry data security standards. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that call for urgent action. Progent's consultants can also help you to set up and test a backup and restore system such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange email filtering.