Monterrey 24-Hour Urgent Crypto
Infection Damage Assessment and Recovery Support

Crypto-Ransomware : Your Feared Information Technology Nightmare
Ransomware has become an escalating cyberplague that represents an existential danger for businesses poorly prepared for an assault. Different iterations of ransomware such as CrySIS, WannaCry, Locky, SamSam and MongoLock cryptoworms have been around for years and continue to cause destruction. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with frequent unnamed viruses, not only do encryption of on-line data but also infect most available system backups. Information replicated to the cloud can also be held hostage. In a vulnerable environment, it can render automatic restore operations hopeless and basically knocks the entire system back to square one.

Retrieving services and data following a crypto-ransomware intrusion becomes a sprint against the clock as the victim struggles to contain, eradicate the crypto-ransomware, and resume mission-critical activity. Because ransomware needs time to spread, assaults are frequently launched during weekends and nights, when successful penetrations typically take more time to detect. This multiplies the difficulty of quickly assembling and organizing an experienced response team.

Progent has a variety of solutions for protecting enterprises from ransomware penetrations. These include team member training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of the latest generation security gateways with artificial intelligence technology from SentinelOne to detect and extinguish zero-day threats intelligently. Progent also can provide the assistance of veteran crypto-ransomware recovery consultants with the track record and commitment to restore a breached network as urgently as possible.

Progent's Ransomware Recovery Support Services
Soon after a crypto-ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that distant criminals will return the needed keys to unencrypt any of your files. Kaspersky estimated that seventeen percent of crypto-ransomware victims never recovered their files even after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The fallback is to re-install the mission-critical parts of your IT environment. Absent access to essential information backups, this calls for a broad complement of IT skills, well-coordinated team management, and the capability to work 24x7 until the job is completed.

For decades, Progent has provided professional IT services for businesses across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned high-level certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial systems and ERP applications. This breadth of expertise affords Progent the ability to efficiently understand necessary systems and consolidate the surviving parts of your computer network environment following a crypto-ransomware penetration and rebuild them into a functioning system.

Progent's recovery team uses best of breed project management tools to coordinate the complex restoration process. Progent appreciates the importance of working rapidly and in concert with a customer's management and Information Technology resources to assign priority to tasks and to get critical systems back on line as fast as humanly possible.

Client Story: A Successful Ransomware Incident Response
A client escalated to Progent after their network was attacked by Ryuk ransomware. Ryuk is believed to have been deployed by Northern Korean government sponsored hackers, possibly using techniques exposed from the United States National Security Agency. Ryuk attacks specific organizations with limited room for operational disruption and is one of the most profitable examples of ransomware. Major victims include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in the Chicago metro area and has around 500 employees. The Ryuk penetration had brought down all essential operations and manufacturing capabilities. The majority of the client's data backups had been directly accessible at the start of the attack and were destroyed. The client was taking steps for paying the ransom (in excess of $200K) and hoping for the best, but ultimately engaged Progent.

Progent worked hand in hand the customer to quickly determine and assign priority to the key elements that needed to be recovered to make it possible to continue business functions:

• Windows Active Directory
• Microsoft Exchange Server
• Accounting/MRP

In less than two days, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then completed rebuilding and storage recovery on critical applications. All Exchange Server ties and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to locate non-encrypted OST files (Microsoft Outlook Offline Data Files) on various PCs and laptops to recover mail messages. A recent off-line backup of the customer's financials/ERP systems made them able to return these essential programs back online. Although significant work remained to recover completely from the Ryuk event, core services were returned to operations quickly:

Throughout the next few weeks key milestones in the recovery project were completed in tight collaboration between Progent consultants and the customer:

• Self-hosted web sites were brought back up without losing any data.
• The MailStore Server containing more than 4 million historical messages was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory Control functions were completely recovered.
• A new Palo Alto Networks 850 firewall was brought online.
• Ninety percent of the user workstations were back into operation.

Conclusion
A potential enterprise-killing disaster was averted through the efforts of results-oriented professionals, a broad spectrum of IT skills, and close collaboration. Although in retrospect the ransomware virus incident detailed here would have been identified and disabled with up-to-date cyber security solutions and ISO/IEC 27001 best practices, user and IT administrator education, and properly executed security procedures for information protection and proper patching controls, the fact remains that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware incident, remember that Progent's team of experts has extensive experience in crypto-ransomware virus defense, removal, and file restoration.

To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Monterrey a variety of online monitoring and security evaluation services to help you to reduce the threat from ransomware. These services include next-generation artificial intelligence capability to uncover new variants of ransomware that are able to evade legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the daily monitoring and maintenance for you, so your network expands easily without holding you back. For a low and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Basic packages include RMM, cybersecurity, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management technology to keep your network operating at peak levels by checking the state of vital computers that power your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your specified IT management personnel and your Progent engineering consultant so that any potential issues can be addressed before they have a chance to disrupt your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for monitoring and managing your network, server, and desktop devices by offering an environment for performing common time-consuming tasks. These include health monitoring, patch management, automated remediation, endpoint setup, backup and restore, A/V response, remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alarm to your designated IT management personnel and your assigned Progent technical consultant so potential issues can be fixed before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for smaller organizations to map out, track, reconfigure and troubleshoot their connectivity hardware such as switches, firewalls, and load balancers as well as servers, printers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network diagrams are always updated, copies and displays the configuration of virtually all devices connected to your network, tracks performance, and generates notices when potential issues are detected. By automating time-consuming management activities, ProSight WAN Watch can knock hours off ordinary tasks such as network mapping, reconfiguring your network, locating devices that need critical updates, or resolving performance bottlenecks. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time and in-depth reporting plug-ins designed to work with the leading ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues like inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has worked with advanced backup/restore software providers to produce ProSight Data Protection Services, a portfolio of subscription-based offerings that deliver backup-as-a-service. ProSight DPS services manage and track your backup processes and allow transparent backup and rapid restoration of important files, apps, images, and virtual machines. ProSight DPS lets your business protect against data loss caused by hardware failures, natural disasters, fire, malware like ransomware, human error, malicious employees, or software glitches. Managed services in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading information security companies to deliver centralized control and comprehensive security for all your inbound and outbound email. The powerful structure of Progent's Email Guard managed service integrates a Cloud Protection Layer with an on-premises security gateway device to provide advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The cloud filter serves as a first line of defense and blocks most unwanted email from making it to your network firewall. This reduces your exposure to external threats and conserves network bandwidth and storage. Email Guard's onsite gateway device provides a further level of analysis for inbound email. For outbound email, the on-premises security gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Exchange Server to track and safeguard internal email that stays inside your security perimeter. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo MFA service plans incorporate Cisco's Duo technology to protect against password theft by using two-factor authentication. Duo enables single-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. Using 2FA, whenever you sign into a secured online account and give your password you are requested to confirm your identity via a device that only you have and that uses a separate network channel. A broad range of out-of-band devices can be used for this added form of authentication including an iPhone or Android or watch, a hardware/software token, a landline telephone, etc. You may designate several validation devices. For more information about Duo identity authentication services, see Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Service Desk: Help Desk Managed Services
  Progent's Call Center managed services allow your IT staff to offload Support Desk services to Progent or split responsibilities for support services transparently between your internal support team and Progent's nationwide pool of IT support engineers and subject matter experts. Progent's Co-managed Service Desk provides a transparent supplement to your in-house network support staff. User access to the Service Desk, delivery of support services, problem escalation, trouble ticket generation and tracking, performance metrics, and maintenance of the service database are cohesive whether issues are resolved by your internal network support staff, by Progent, or a mix of the two. Learn more about Progent's outsourced/co-managed Call Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior analysis technology to guard endpoint devices and physical and virtual servers against new malware assaults like ransomware and file-less exploits, which easily evade traditional signature-matching anti-virus products. Progent Active Security Monitoring services protect local and cloud resources and provides a unified platform to address the entire malware attack lifecycle including blocking, detection, mitigation, remediation, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and safeguard information about your network infrastructure, processes, applications, and services. You can instantly find passwords or IP addresses and be warned about impending expirations of SSLs or domains. By updating and managing your network documentation, you can save up to half of time spent searching for critical information about your IT network. ProSight IT Asset Management includes a common repository for holding and collaborating on all documents required for managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT data. Whether you're making enhancements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the data you require when you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a versatile and cost-effective alternative for assessing, validating, scheduling, implementing, and documenting updates to your ever-evolving information system. In addition to maximizing the security and reliability of your computer network, Progent's patch management services free up time for your in-house IT team to concentrate on more strategic projects and activities that deliver the highest business value from your information network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a secure Tier III data center on a high-performance virtual machine host set up and managed by Progent's network support professionals. With Progent's ProSight Virtual Hosting service model, the customer owns the data, the OS platforms, and the apps. Because the environment is virtualized, it can be moved easily to a different hardware solution without a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior-based analysis technology to guard physical and virtual endpoint devices against new malware assaults such as ransomware and email phishing, which easily escape traditional signature-based AV products. ProSight Active Security Monitoring protects local and cloud resources and offers a single platform to address the entire threat lifecycle including blocking, identification, containment, cleanup, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Exchange Email Filtering
  ProSight Enhanced Security Protection managed services offer ultra-affordable multi-layer security for physical servers and virtual machines, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and reacting to cyber threats from all attack vectors. ProSight ESP offers firewall protection, penetration alerts, endpoint management, and web filtering via cutting-edge technologies packaged within a single agent managed from a single console. Progent's data protection and virtualization consultants can help you to plan and implement a ProSight ESP deployment that addresses your company's unique requirements and that allows you demonstrate compliance with government and industry information security regulations. Progent will help you specify and configure policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for urgent attention. Progent can also assist your company to install and verify a backup and restore solution such as ProSight Data Protection Services so you can recover rapidly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange email filtering.