24-7 Morgan Hill Emergency Ransomware
Infection Detection and Repair Consultants

Ransomware : Your Feared IT Nightmare
Crypto-Ransomware has become a modern cyberplague that poses an existential danger for businesses unprepared for an assault. Versions of ransomware like the CrySIS, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for a long time and still inflict damage. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, as well as additional unnamed malware, not only encrypt online data but also infect many accessible system backup. Data replicated to the cloud can also be corrupted. In a poorly architected system, this can make any recovery hopeless and effectively sets the datacenter back to square one.

Getting back online programs and data following a ransomware intrusion becomes a sprint against the clock as the targeted business fights to contain, cleanup the ransomware, and restore enterprise-critical operations. Due to the fact that ransomware needs time to move laterally, attacks are frequently sprung on weekends and holidays, when successful attacks typically take longer to discover. This multiplies the difficulty of quickly mobilizing and coordinating an experienced response team.

Progent provides a range of services for securing businesses from ransomware events. These include staff education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with installation of next-generation security solutions with machine learning capabilities from SentinelOne to identify and quarantine new cyber threats rapidly. Progent in addition provides the services of seasoned ransomware recovery consultants with the talent and commitment to rebuild a compromised system as soon as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a ransomware attack, even paying the ransom demands in cryptocurrency does not guarantee that distant criminals will return the needed codes to decrypt all your files. Kaspersky ascertained that 17% of ransomware victims never recovered their files after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to setup from scratch the key elements of your Information Technology environment. Without the availability of full information backups, this calls for a wide complement of IT skills, well-coordinated team management, and the ability to work non-stop until the recovery project is over.

For twenty years, Progent has offered certified expert IT services for companies throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded top certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with accounting and ERP applications. This breadth of experience provides Progent the capability to knowledgably ascertain important systems and consolidate the surviving components of your Information Technology system following a ransomware attack and assemble them into an operational system.

Progent's security team uses best of breed project management applications to orchestrate the complex restoration process. Progent appreciates the urgency of working swiftly and in unison with a client's management and IT staff to assign priority to tasks and to put key systems back on line as soon as possible.

Client Case Study: A Successful Ransomware Incident Response
A business hired Progent after their network was taken over by Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state criminal gangs, suspected of using strategies leaked from the United States NSA organization. Ryuk targets specific organizations with little or no ability to sustain operational disruption and is among the most profitable examples of ransomware malware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in Chicago with around 500 staff members. The Ryuk penetration had disabled all business operations and manufacturing capabilities. Most of the client's system backups had been on-line at the start of the attack and were damaged. The client considered paying the ransom (exceeding $200,000) and wishfully thinking for the best, but in the end reached out to Progent.

Progent worked together with the client to rapidly determine and prioritize the key systems that needed to be restored in order to continue business functions:

• Active Directory
• Email
• Financials/MRP

Within 48 hours, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then completed rebuilding and hard drive recovery on essential servers. All Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to find intact OST data files (Microsoft Outlook Offline Data Files) on team PCs and laptops to recover mail information. A not too old offline backup of the client's manufacturing software made them able to recover these essential programs back online for users. Although a large amount of work still had to be done to recover totally from the Ryuk attack, critical services were recovered rapidly:

Throughout the next couple of weeks critical milestones in the restoration project were made in close collaboration between Progent consultants and the customer:

• Internal web applications were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server exceeding 4 million archived messages was brought online and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory capabilities were 100 percent operational.
• A new Palo Alto 850 firewall was brought on-line.
• 90% of the desktops and laptops were being used by staff.

Conclusion
A probable business catastrophe was averted through the efforts of dedicated experts, a wide spectrum of technical expertise, and close teamwork. Although in analyzing the event afterwards the ransomware virus incident detailed here would have been stopped with up-to-date cyber security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and appropriate security procedures for information backup and applying software patches, the fact remains that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware penetration, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, mitigation, and data restoration.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Morgan Hill a variety of remote monitoring and security evaluation services to help you to reduce the threat from ransomware. These services utilize modern machine learning capability to detect zero-day strains of ransomware that can get past legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to create leading-edge IT resilience. Progent handles the necessary monitoring and management for you, so your network scales smoothly without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Entry-level packages include remote monitoring and management (RMM), cybersecurity, monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management techniques to keep your IT system running efficiently by checking the state of vital assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alert is transmitted automatically to your designated IT staff and your Progent engineering consultant so that all looming problems can be addressed before they can impact your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven solution for monitoring and managing your network, server, and desktop devices by providing tools for performing common tedious tasks. These include health checking, update management, automated repairs, endpoint setup, backup and recovery, A/V defense, secure remote access, built-in and custom scripts, asset inventory, endpoint status reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it sends an alert to your specified IT staff and your Progent consultant so that potential issues can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it simple and affordable for smaller organizations to map out, track, enhance and debug their connectivity hardware such as switches, firewalls, and access points plus servers, endpoints and other networked devices. Incorporating cutting-edge RMM technology, WAN Watch makes sure that infrastructure topology diagrams are always current, captures and manages the configuration of virtually all devices connected to your network, monitors performance, and generates alerts when potential issues are discovered. By automating time-consuming network management processes, WAN Watch can knock hours off ordinary tasks like making network diagrams, expanding your network, finding appliances that require critical updates, or identifying the cause of performance issues. Find out more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time and in-depth management reporting tools designed to work with the leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues like spotty support follow-through or machines with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore technology providers to produce ProSight Data Protection Services (DPS), a selection of management offerings that deliver backup-as-a-service. ProSight DPS services manage and track your data backup processes and allow non-disruptive backup and rapid restoration of vital files, applications, system images, and virtual machines. ProSight DPS lets you protect against data loss caused by equipment failures, natural calamities, fire, malware like ransomware, user mistakes, ill-intentioned employees, or software glitches. Managed services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to identify which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of leading information security companies to deliver web-based management and world-class protection for your inbound and outbound email. The powerful architecture of Email Guard combines a Cloud Protection Layer with an on-premises gateway device to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The Cloud Protection Layer serves as a preliminary barricade and blocks most unwanted email from making it to your network firewall. This decreases your vulnerability to inbound threats and conserves system bandwidth and storage space. Email Guard's on-premises gateway appliance adds a further level of inspection for incoming email. For outbound email, the local gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to monitor and safeguard internal email traffic that stays inside your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to protect against stolen passwords by using two-factor authentication. Duo supports single-tap identity verification with iOS, Android, and other personal devices. Using 2FA, when you sign into a protected application and give your password you are asked to verify who you are on a unit that only you have and that is accessed using a separate network channel. A broad selection of out-of-band devices can be utilized for this second form of authentication such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You can designate several validation devices. To learn more about Duo identity authentication services, go to Cisco Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Service Desk: Support Desk Managed Services
  Progent's Help Desk managed services permit your IT team to offload Call Center services to Progent or split responsibilities for Help Desk services transparently between your in-house support resources and Progent's extensive roster of IT support technicians, engineers and subject matter experts. Progent's Shared Help Desk Service offers a seamless supplement to your corporate network support resources. End user access to the Service Desk, provision of support services, problem escalation, ticket generation and tracking, efficiency measurement, and management of the service database are consistent whether issues are taken care of by your core network support group, by Progent, or both. Find out more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that utilizes next generation behavior analysis tools to guard endpoint devices and servers and VMs against new malware assaults such as ransomware and file-less exploits, which easily escape legacy signature-based anti-virus products. Progent ASM services protect local and cloud resources and provides a unified platform to address the complete malware attack lifecycle including blocking, detection, mitigation, remediation, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, retrieve and protect data about your IT infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be warned about impending expirations of SSLs ,domains or warranties. By updating and organizing your IT infrastructure documentation, you can save as much as 50% of time wasted searching for vital information about your IT network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents related to managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT data. Whether you're making improvements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need as soon as you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management offer organizations of all sizes a versatile and affordable alternative for evaluating, validating, scheduling, implementing, and tracking updates to your ever-evolving information system. In addition to optimizing the security and reliability of your computer environment, Progent's patch management services free up time for your in-house IT team to focus on line-of-business initiatives and activities that deliver the highest business value from your network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a protected Tier III data center on a fast virtual machine host configured and maintained by Progent's network support professionals. With the ProSight Virtual Hosting model, the customer owns the data, the operating system platforms, and the applications. Because the system is virtualized, it can be moved immediately to an alternate hosting environment without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not tied one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior-based machine learning technology to guard physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-matching anti-virus products. ProSight ASM safeguards on-premises and cloud resources and provides a single platform to automate the entire threat lifecycle including filtering, detection, containment, cleanup, and forensics. Top features include one-click rollback using Windows VSS and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection managed services deliver ultra-affordable multi-layer security for physical servers and VMs, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and responding to cyber threats from all attack vectors. ProSight ESP offers firewall protection, intrusion alerts, endpoint control, and web filtering via leading-edge tools packaged within one agent accessible from a unified console. Progent's security and virtualization experts can assist your business to design and configure a ProSight ESP environment that addresses your organization's unique requirements and that allows you demonstrate compliance with legal and industry data security standards. Progent will help you specify and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that call for urgent action. Progent can also help your company to set up and test a backup and disaster recovery system like ProSight Data Protection Services so you can get back in business rapidly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange filtering.