24/7/365 Nashville Urgent Ransomware
Infection Detection and Restoration Consulting

Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a modern cyber pandemic that presents an existential danger for businesses of all sizes poorly prepared for an attack. Versions of crypto-ransomware such as CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for a long time and continue to inflict havoc. The latest versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, as well as daily unnamed newcomers, not only encrypt on-line data but also infect many accessible system protection mechanisms. Data replicated to the cloud can also be corrupted. In a poorly designed system, this can render automatic recovery useless and effectively knocks the datacenter back to zero.

Recovering services and data after a crypto-ransomware intrusion becomes a race against the clock as the victim struggles to contain, cleanup the crypto-ransomware, and resume business-critical operations. Because ransomware needs time to move laterally, assaults are often sprung during nights and weekends, when penetrations are likely to take longer to detect. This multiplies the difficulty of promptly marshalling and organizing a capable response team.

Progent has a variety of help services for securing enterprises from ransomware penetrations. Among these are team member education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of modern security solutions with machine learning technology from SentinelOne to detect and disable zero-day cyber attacks quickly. Progent also provides the services of seasoned crypto-ransomware recovery consultants with the skills and perseverance to rebuild a breached network as rapidly as possible.

Progent's Ransomware Recovery Help
Soon after a ransomware attack, sending the ransom demands in cryptocurrency does not guarantee that distant criminals will respond with the keys to decipher all your data. Kaspersky determined that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to piece back together the key elements of your Information Technology environment. Absent access to complete information backups, this requires a wide range of skills, well-coordinated project management, and the capability to work 24x7 until the job is done.

For decades, Progent has offered expert IT services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained top certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have earned internationally-renowned industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of experience gives Progent the skills to knowledgably determine necessary systems and re-organize the surviving pieces of your IT environment following a crypto-ransomware attack and configure them into a functioning system.

Progent's security group uses state-of-the-art project management systems to orchestrate the complex recovery process. Progent appreciates the urgency of acting swiftly and in unison with a client's management and IT team members to prioritize tasks and to put key systems back on-line as soon as humanly possible.

Case Study: A Successful Ransomware Attack Response
A customer contacted Progent after their network was attacked by Ryuk ransomware. Ryuk is believed to have been developed by Northern Korean government sponsored cybercriminals, suspected of adopting strategies exposed from the United States NSA organization. Ryuk seeks specific organizations with little tolerance for operational disruption and is among the most lucrative incarnations of ransomware malware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing company located in the Chicago metro area with about 500 staff members. The Ryuk intrusion had disabled all business operations and manufacturing processes. Most of the client's backups had been directly accessible at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (exceeding two hundred thousand dollars) and praying for good luck, but ultimately utilized Progent.

Progent worked hand in hand the customer to quickly determine and prioritize the essential elements that had to be restored in order to resume departmental functions:

• Active Directory (AD)
• Microsoft Exchange Email
• Financials/MRP

In less than 2 days, Progent was able to rebuild Windows Active Directory to its pre-virus state. Progent then charged ahead with setup and storage recovery on mission critical applications. All Microsoft Exchange Server ties and attributes were intact, which accelerated the restore of Exchange. Progent was able to find local OST files (Microsoft Outlook Offline Data Files) on team workstations to recover mail data. A recent off-line backup of the businesses manufacturing software made it possible to return these vital applications back on-line. Although major work still had to be done to recover totally from the Ryuk damage, essential services were restored quickly:

Throughout the following month important milestones in the recovery project were achieved through tight collaboration between Progent team members and the customer:

• In-house web applications were restored without losing any data.
• The MailStore Server with over four million historical messages was spun up and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables/Inventory modules were completely recovered.
• A new Palo Alto Networks 850 firewall was brought online.
• Most of the desktop computers were functioning as before the incident.

Conclusion
A possible company-ending catastrophe was averted due to top-tier professionals, a broad range of IT skills, and close teamwork. Although upon completion of forensics the ransomware virus attack detailed here could have been shut down with advanced cyber security technology and best practices, user training, and well thought out security procedures for information protection and proper patching controls, the fact remains that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's roster of experts has proven experience in crypto-ransomware virus blocking, remediation, and data restoration.

To read or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Nashville a range of online monitoring and security assessment services designed to help you to minimize the threat from ransomware. These services include modern machine learning capability to uncover new strains of ransomware that can escape detection by legacy signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to achieve advanced network resilience. Progent takes care of the daily monitoring and maintenance for you, so your system expands easily without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management (RMM), security, automatic monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-in-class solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) techniques to keep your network running at peak levels by checking the health of critical computers that drive your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent immediately to your specified IT management staff and your Progent consultant so all looming problems can be resolved before they have a chance to impact productivity. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for monitoring and managing your client-server infrastructure by providing an environment for streamlining common tedious tasks. These can include health monitoring, patch management, automated remediation, endpoint deployment, backup and recovery, A/V response, secure remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alert to your designated IT management personnel and your Progent consultant so emerging issues can be taken care of before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for smaller businesses to map out, monitor, optimize and troubleshoot their connectivity appliances such as routers, firewalls, and wireless controllers as well as servers, printers, client computers and other networked devices. Incorporating state-of-the-art RMM technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are kept updated, captures and displays the configuration information of almost all devices connected to your network, tracks performance, and generates notices when problems are discovered. By automating complex network management processes, WAN Watch can cut hours off common chores like making network diagrams, expanding your network, locating devices that require important updates, or identifying the cause of performance problems. Find out more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of in-depth reporting plug-ins created to integrate with the industry's leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-through or endpoints with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup technology companies to produce ProSight Data Protection Services (DPS), a portfolio of subscription-based management offerings that deliver backup-as-a-service. ProSight DPS products manage and track your data backup operations and enable transparent backup and rapid recovery of vital files/folders, apps, images, plus VMs. ProSight DPS helps you avoid data loss resulting from hardware breakdown, natural disasters, fire, malware like ransomware, human error, malicious employees, or software glitches. Managed services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent expert can assist you to determine which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top information security vendors to deliver web-based control and comprehensive protection for all your inbound and outbound email. The hybrid architecture of Email Guard combines cloud-based filtering with an on-premises gateway appliance to provide complete defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based threats. The cloud filter serves as a first line of defense and blocks most threats from reaching your security perimeter. This decreases your vulnerability to inbound attacks and conserves system bandwidth and storage. Email Guard's on-premises security gateway device provides a further level of inspection for inbound email. For outgoing email, the local gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also assist Microsoft Exchange Server to track and safeguard internal email that originates and ends inside your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo technology to defend against compromised passwords by using two-factor authentication. Duo supports one-tap identity verification on iOS, Android, and other personal devices. Using 2FA, when you log into a secured application and give your password you are asked to confirm your identity via a unit that only you possess and that uses a separate network channel. A broad selection of devices can be utilized as this added means of authentication such as a smartphone or watch, a hardware/software token, a landline telephone, etc. You can register several verification devices. To learn more about ProSight Duo two-factor identity authentication services, go to Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Service Center: Call Center Managed Services
  Progent's Call Desk managed services enable your IT group to offload Call Center services to Progent or split responsibilities for support services transparently between your in-house support group and Progent's nationwide pool of IT service engineers and subject matter experts. Progent's Shared Help Desk Service provides a transparent extension of your internal IT support staff. Client access to the Help Desk, provision of support, problem escalation, ticket creation and updates, efficiency measurement, and management of the service database are cohesive whether incidents are taken care of by your corporate support staff, by Progent's team, or a mix of the two. Learn more about Progent's outsourced/co-managed Service Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior machine learning technology to defend endpoints as well as servers and VMs against new malware attacks like ransomware and file-less exploits, which routinely evade legacy signature-matching AV products. Progent ASM services protect on-premises and cloud-based resources and provides a single platform to address the complete malware attack lifecycle including protection, identification, mitigation, remediation, and post-attack forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against new attacks. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, find and safeguard information related to your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or IP addresses and be alerted automatically about upcoming expirations of SSL certificates or warranties. By updating and organizing your IT infrastructure documentation, you can eliminate up to 50% of time thrown away trying to find critical information about your network. ProSight IT Asset Management features a common location for holding and sharing all documents required for managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and relating IT information. Whether you're making improvements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the data you need as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide organizations of all sizes a versatile and affordable alternative for assessing, validating, scheduling, implementing, and documenting updates to your dynamic information network. Besides optimizing the security and reliability of your IT environment, Progent's software/firmware update management services allow your in-house IT staff to focus on line-of-business initiatives and activities that deliver maximum business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a protected Tier III data center on a high-performance virtual machine host set up and maintained by Progent's IT support experts. With the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the applications. Since the environment is virtualized, it can be ported easily to a different hosting solution without a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's cutting edge behavior analysis tools to guard physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which routinely evade traditional signature-matching anti-virus tools. ProSight ASM safeguards on-premises and cloud resources and offers a unified platform to address the complete threat progression including blocking, identification, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable in-depth protection for physical and virtual servers, desktops, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to cyber threats from all attack vectors. ProSight ESP delivers two-way firewall protection, intrusion alerts, device management, and web filtering via cutting-edge technologies packaged within a single agent managed from a unified console. Progent's data protection and virtualization consultants can assist you to design and configure a ProSight ESP environment that meets your company's unique needs and that helps you achieve and demonstrate compliance with government and industry information protection regulations. Progent will assist you define and configure security policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that require immediate attention. Progent's consultants can also help your company to set up and verify a backup and restore system such as ProSight Data Protection Services so you can recover quickly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange filtering.