24-Hour Miami Emergency Ransomware
Computer Virus Damage Assessment and Restoration Experts

Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become a modern cyberplague that represents an existential danger for businesses unprepared for an attack. Different iterations of ransomware such as CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for a long time and continue to inflict damage. Recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, along with more as yet unnamed newcomers, not only encrypt online data but also infiltrate any available system protection mechanisms. Information synchronized to cloud environments can also be held hostage. In a poorly designed system, it can make automated restoration hopeless and effectively sets the network back to zero.

Getting back services and information after a crypto-ransomware event becomes a race against the clock as the targeted organization struggles to contain, cleanup the ransomware, and resume business-critical operations. Due to the fact that ransomware takes time to move laterally, penetrations are usually sprung on weekends, when successful attacks are likely to take more time to identify. This multiplies the difficulty of quickly assembling and coordinating a capable response team.

Progent makes available a variety of support services for protecting organizations from ransomware attacks. These include team member training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of the latest generation security gateways with AI technology from SentinelOne to discover and extinguish new cyber attacks automatically. Progent in addition offers the services of veteran ransomware recovery professionals with the skills and commitment to restore a compromised environment as quickly as possible.

Progent's Ransomware Restoration Help
Following a ransomware penetration, even paying the ransom in cryptocurrency does not ensure that distant criminals will provide the codes to decipher all your information. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The alternative is to piece back together the key elements of your IT environment. Absent access to full system backups, this requires a broad range of IT skills, top notch team management, and the willingness to work continuously until the task is over.

For two decades, Progent has provided certified expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned top industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have earned internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial management and ERP software solutions. This breadth of experience affords Progent the capability to rapidly determine critical systems and consolidate the surviving parts of your network system after a crypto-ransomware event and assemble them into an operational network.

Progent's recovery team has powerful project management tools to orchestrate the complex restoration process. Progent understands the urgency of acting rapidly and in unison with a customer's management and Information Technology staff to assign priority to tasks and to put critical applications back on-line as fast as possible.

Client Story: A Successful Crypto-Ransomware Incident Response
A customer hired Progent after their network system was penetrated by the Ryuk ransomware virus. Ryuk is believed to have been launched by Northern Korean state sponsored cybercriminals, suspected of using approaches leaked from the United States NSA organization. Ryuk attacks specific organizations with little or no room for disruption and is one of the most lucrative iterations of ransomware malware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in Chicago with about 500 employees. The Ryuk penetration had shut down all company operations and manufacturing processes. Most of the client's information backups had been directly accessible at the beginning of the intrusion and were encrypted. The client considered paying the ransom (more than $200,000) and hoping for the best, but in the end brought in Progent.

Progent worked together with the customer to rapidly identify and prioritize the critical services that needed to be restored in order to continue company operations:

• Active Directory
• Microsoft Exchange Server
• Financials/MRP

In less than 48 hours, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then initiated reinstallations and hard drive recovery of key applications. All Exchange Server data and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to collect intact OST files (Outlook Email Off-Line Data Files) on various workstations and laptops to recover mail information. A not too old offline backup of the customer's accounting systems made them able to recover these essential programs back servicing users. Although major work still had to be done to recover fully from the Ryuk event, critical systems were returned to operations rapidly:

Throughout the next couple of weeks key milestones in the recovery project were completed in close collaboration between Progent team members and the client:

• Self-hosted web applications were returned to operation with no loss of information.
• The MailStore Exchange Server containing more than four million archived messages was restored to operations and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control capabilities were fully recovered.
• A new Palo Alto 850 security appliance was brought on-line.
• Nearly all of the user PCs were operational.

Conclusion
A potential enterprise-killing catastrophe was avoided due to hard-working professionals, a broad spectrum of knowledge, and close teamwork. Although in hindsight the ransomware penetration detailed here could have been shut down with up-to-date cyber security technology solutions and recognized best practices, staff training, and properly executed security procedures for backup and applying software patches, the fact remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's roster of experts has substantial experience in ransomware virus defense, remediation, and file disaster recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Miami a range of online monitoring and security assessment services to help you to reduce your vulnerability to ransomware. These services utilize modern machine learning technology to uncover new strains of crypto-ransomware that are able to evade traditional signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent handles the necessary monitoring and management for you, so your network expands easily without becoming an obstacle. For a low and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management, cybersecurity, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management techniques to help keep your network running at peak levels by tracking the health of critical assets that drive your business network. When ProSight LAN Watch detects a problem, an alarm is transmitted immediately to your specified IT personnel and your assigned Progent engineering consultant so any potential issues can be addressed before they have a chance to disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your client-server infrastructure by providing tools for streamlining common tedious tasks. These can include health monitoring, patch management, automated remediation, endpoint configuration, backup and recovery, anti-virus defense, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alarm to your designated IT management personnel and your Progent consultant so potential issues can be taken care of before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized businesses to map out, track, reconfigure and troubleshoot their networking hardware like routers, firewalls, and load balancers plus servers, printers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that infrastructure topology diagrams are always updated, captures and manages the configuration of almost all devices connected to your network, monitors performance, and generates alerts when problems are discovered. By automating complex management and troubleshooting processes, WAN Watch can knock hours off common tasks like making network diagrams, expanding your network, locating devices that need important software patches, or identifying the cause of performance problems. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time management reporting plug-ins designed to work with the industry's leading ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues like inconsistent support follow-up or machines with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with advanced backup technology providers to produce ProSight Data Protection Services, a family of management offerings that deliver backup-as-a-service. ProSight DPS services automate and track your data backup operations and allow transparent backup and fast restoration of critical files/folders, apps, images, plus VMs. ProSight DPS helps your business protect against data loss resulting from hardware breakdown, natural calamities, fire, malware such as ransomware, human mistakes, ill-intentioned employees, or application glitches. Managed backup services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top data security vendors to deliver centralized control and comprehensive security for all your email traffic. The hybrid structure of Email Guard managed service combines cloud-based filtering with a local gateway device to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. Email Guard's cloud filter serves as a preliminary barricade and blocks the vast majority of threats from making it to your security perimeter. This reduces your vulnerability to external threats and saves system bandwidth and storage space. Email Guard's onsite security gateway appliance adds a further level of analysis for incoming email. For outgoing email, the on-premises security gateway offers AV and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also help Exchange Server to track and safeguard internal email that stays within your corporate firewall. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA service plans incorporate Cisco's Duo cloud technology to protect against password theft by using two-factor authentication (2FA). Duo supports one-tap identity verification on iOS, Android, and other personal devices. Using 2FA, whenever you sign into a secured online account and enter your password you are asked to confirm your identity on a device that only you possess and that uses a different ("out-of-band") network channel. A broad range of devices can be utilized for this added form of ID validation such as a smartphone or watch, a hardware token, a landline telephone, etc. You can register multiple validation devices. To find out more about Duo two-factor identity validation services, go to Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Desk: Help Desk Managed Services
  Progent's Call Center services enable your IT staff to outsource Call Center services to Progent or divide activity for Service Desk support transparently between your in-house support staff and Progent's nationwide roster of certified IT service technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a seamless extension of your corporate support organization. End user access to the Service Desk, delivery of support, issue escalation, ticket generation and updates, performance metrics, and management of the support database are consistent whether incidents are resolved by your corporate network support group, by Progent's team, or both. Learn more about Progent's outsourced/shared Service Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates next generation behavior machine learning tools to defend endpoints and servers and VMs against modern malware assaults such as ransomware and email phishing, which easily get by traditional signature-based AV tools. Progent Active Security Monitoring services safeguard local and cloud-based resources and provides a single platform to address the complete threat progression including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered attacks. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and protect data about your IT infrastructure, procedures, business apps, and services. You can quickly find passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates or domains. By updating and managing your IT documentation, you can eliminate as much as half of time wasted looking for critical information about your network. ProSight IT Asset Management includes a centralized location for storing and collaborating on all documents required for managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT data. Whether you're making improvements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you require the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of all sizes a versatile and affordable solution for assessing, validating, scheduling, implementing, and tracking software and firmware updates to your ever-evolving IT system. Besides maximizing the protection and functionality of your IT environment, Progent's software/firmware update management services permit your IT staff to focus on line-of-business initiatives and tasks that deliver the highest business value from your network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual machine host configured and maintained by Progent's IT support experts. Under the ProSight Virtual Hosting model, the customer owns the data, the operating system software, and the applications. Since the system is virtualized, it can be ported immediately to a different hardware solution without requiring a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, you are not tied a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoints against new malware attacks such as ransomware and email phishing, which routinely escape legacy signature-based AV tools. ProSight Active Security Monitoring protects on-premises and cloud resources and offers a single platform to manage the complete threat lifecycle including filtering, detection, containment, cleanup, and forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable multi-layer security for physical servers and virtual machines, desktops, smartphones, and Exchange Server. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and responding to cyber threats from all attack vectors. ProSight ESP offers firewall protection, intrusion alerts, endpoint management, and web filtering through leading-edge technologies packaged within a single agent managed from a unified control. Progent's security and virtualization consultants can help your business to design and configure a ProSight ESP environment that meets your company's specific requirements and that helps you demonstrate compliance with government and industry information protection regulations. Progent will assist you specify and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for immediate action. Progent's consultants can also help your company to install and verify a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange filtering.