24-7 Norfolk Immediate Crypto-Ransomware
Virus Identification and Remediation Experts

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyberplague that represents an extinction-level danger for organizations unprepared for an attack. Different versions of crypto-ransomware such as CrySIS, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for years and continue to inflict destruction. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, plus additional unnamed newcomers, not only do encryption of online files but also infiltrate all available system protection mechanisms. Data synched to off-site disaster recovery sites can also be held hostage. In a poorly designed data protection solution, this can make automated restoration useless and effectively sets the datacenter back to square one.

Getting back online programs and data following a crypto-ransomware intrusion becomes a sprint against the clock as the targeted organization tries its best to contain the damage, clear the crypto-ransomware, and restore business-critical activity. Since ransomware requires time to move laterally, assaults are usually sprung during weekends and nights, when successful attacks typically take more time to discover. This multiplies the difficulty of rapidly assembling and coordinating a capable response team.

Progent has a variety of services for securing enterprises from ransomware penetrations. These include team education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of the latest generation security gateways with artificial intelligence technology from SentinelOne to identify and suppress new threats rapidly. Progent also can provide the assistance of experienced ransomware recovery engineers with the talent and perseverance to reconstruct a breached network as rapidly as possible.

Progent's Crypto-Ransomware Restoration Services
After a ransomware attack, sending the ransom in cryptocurrency does not guarantee that criminal gangs will respond with the codes to unencrypt any or all of your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their information after having paid the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The other path is to piece back together the mission-critical components of your IT environment. Absent access to full data backups, this calls for a broad range of skills, top notch team management, and the ability to work 24x7 until the recovery project is completed.

For decades, Progent has offered professional IT services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned high-level industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP applications. This breadth of experience provides Progent the skills to efficiently identify necessary systems and organize the remaining parts of your IT environment after a ransomware attack and assemble them into a functioning system.

Progent's recovery group deploys powerful project management tools to orchestrate the complicated restoration process. Progent knows the importance of working quickly and in unison with a customer's management and IT staff to assign priority to tasks and to put essential systems back on line as soon as humanly possible.

Case Study: A Successful Ransomware Penetration Response
A customer contacted Progent after their network system was brought down by Ryuk ransomware. Ryuk is thought to have been launched by Northern Korean state sponsored criminal gangs, suspected of adopting technology leaked from America's NSA organization. Ryuk seeks specific companies with limited ability to sustain operational disruption and is among the most lucrative examples of ransomware viruses. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company based in Chicago and has about 500 employees. The Ryuk penetration had brought down all business operations and manufacturing capabilities. Most of the client's backups had been on-line at the time of the attack and were destroyed. The client was evaluating paying the ransom demand (more than $200,000) and hoping for the best, but in the end utilized Progent.

Progent worked with the client to quickly identify and assign priority to the essential services that had to be recovered in order to continue company functions:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to re-build Active Directory services to its pre-attack state. Progent then initiated reinstallations and storage recovery on key systems. All Exchange Server ties and attributes were usable, which greatly helped the restore of Exchange. Progent was able to locate intact OST files (Outlook Email Offline Folder Files) on staff desktop computers and laptops in order to recover email data. A not too old offline backup of the client's accounting/MRP systems made it possible to return these vital applications back servicing users. Although major work remained to recover totally from the Ryuk event, the most important systems were recovered quickly:

Over the following couple of weeks important milestones in the recovery process were made through tight cooperation between Progent engineers and the client:

• Internal web applications were restored with no loss of information.
• The MailStore Server with over 4 million archived emails was brought online and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were completely restored.
• A new Palo Alto Networks 850 firewall was brought online.
• 90% of the user desktops and notebooks were back into operation.

Conclusion
A probable company-ending disaster was averted through the efforts of dedicated professionals, a broad range of technical expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration described here could have been disabled with current cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and well designed security procedures for data backup and proper patching controls, the reality remains that government-sponsored hackers from Russia, China and elsewhere are relentless and will continue. If you do get hit by a ransomware incident, remember that Progent's roster of professionals has a proven track record in crypto-ransomware virus blocking, remediation, and data restoration.

To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Norfolk a variety of remote monitoring and security assessment services designed to assist you to reduce your vulnerability to ransomware. These services utilize next-generation AI technology to detect new variants of ransomware that are able to evade traditional signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to achieve advanced network resilience. Progent handles the daily monitoring and management for you, so your system expands readily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's experienced IT group can be your complete technology safety net. Entry-level packages include remote monitoring and management, security, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to keep your network running efficiently by checking the health of critical computers that power your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted immediately to your specified IT management staff and your Progent consultant so any looming issues can be addressed before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based solution for monitoring and managing your network, server, and desktop devices by providing an environment for performing common tedious tasks. These include health monitoring, patch management, automated repairs, endpoint configuration, backup and restore, anti-virus protection, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it transmits an alarm to your specified IT personnel and your assigned Progent consultant so emerging issues can be fixed before they impact productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to map out, track, optimize and troubleshoot their connectivity appliances such as routers, firewalls, and wireless controllers as well as servers, client computers and other networked devices. Using state-of-the-art RMM technology, ProSight WAN Watch ensures that network diagrams are kept current, copies and displays the configuration of almost all devices on your network, monitors performance, and generates alerts when problems are discovered. By automating time-consuming network management processes, ProSight WAN Watch can knock hours off common tasks like making network diagrams, reconfiguring your network, finding devices that need critical updates, or isolating performance issues. Find out more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of in-depth reporting utilities designed to work with the leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues like spotty support follow-up or machines with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with advanced backup/restore technology providers to produce ProSight Data Protection Services (DPS), a family of subscription-based offerings that provide backup-as-a-service (BaaS). ProSight DPS products automate and monitor your backup operations and allow non-disruptive backup and rapid recovery of vital files/folders, apps, system images, and virtual machines. ProSight DPS helps your business protect against data loss resulting from equipment breakdown, natural calamities, fire, malware such as ransomware, human mistakes, malicious insiders, or software glitches. Managed services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to determine which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading data security companies to provide web-based control and world-class security for your inbound and outbound email. The hybrid structure of Email Guard managed service integrates a Cloud Protection Layer with an on-premises gateway device to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's Cloud Protection Layer serves as a preliminary barricade and blocks most threats from reaching your security perimeter. This decreases your exposure to external threats and saves network bandwidth and storage. Email Guard's on-premises security gateway appliance adds a further layer of inspection for incoming email. For outgoing email, the local security gateway provides anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also assist Exchange Server to monitor and protect internal email traffic that stays within your corporate firewall. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication service plans utilize Cisco's Duo technology to protect against compromised passwords by using two-factor authentication (2FA). Duo enables one-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. With 2FA, whenever you log into a protected application and enter your password you are asked to confirm your identity via a unit that only you have and that is accessed using a different ("out-of-band") network channel. A broad selection of out-of-band devices can be utilized as this second form of ID validation such as an iPhone or Android or watch, a hardware/software token, a landline telephone, etc. You can designate multiple verification devices. To find out more about Duo identity validation services, go to Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Call Center services allow your IT team to offload Help Desk services to Progent or divide activity for Help Desk services seamlessly between your internal support group and Progent's nationwide pool of certified IT service engineers and subject matter experts. Progent's Shared Help Desk Service provides a smooth supplement to your in-house network support team. User access to the Service Desk, provision of technical assistance, issue escalation, ticket creation and tracking, performance metrics, and maintenance of the service database are cohesive whether incidents are resolved by your in-house network support organization, by Progent's team, or by a combination. Read more about Progent's outsourced/co-managed Help Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that utilizes cutting edge behavior machine learning technology to guard endpoint devices as well as physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which easily escape legacy signature-based AV products. Progent ASM services safeguard on-premises and cloud resources and provides a unified platform to automate the complete threat progression including blocking, identification, mitigation, cleanup, and forensics. Top capabilities include one-click rollback with Windows VSS and real-time network-wide immunization against newly discovered attacks. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, find and protect information related to your network infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be warned about upcoming expirations of SSLs or warranties. By updating and managing your IT documentation, you can save up to half of time thrown away trying to find vital information about your IT network. ProSight IT Asset Management features a centralized location for storing and collaborating on all documents related to managing your network infrastructure such as recommended procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and associating IT information. Whether you're making improvements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you need the instant you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a versatile and cost-effective alternative for assessing, validating, scheduling, implementing, and documenting updates to your dynamic IT network. Besides optimizing the security and functionality of your IT network, Progent's patch management services free up time for your in-house IT team to concentrate on more strategic projects and activities that deliver maximum business value from your network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a protected fault tolerant data center on a high-performance virtual host configured and maintained by Progent's IT support professionals. With Progent's ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system platforms, and the apps. Because the system is virtualized, it can be ported immediately to an alternate hosting environment without requiring a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not tied one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's next generation behavior machine learning tools to guard physical and virtual endpoint devices against modern malware assaults such as ransomware and email phishing, which routinely escape traditional signature-based AV tools. ProSight ASM safeguards on-premises and cloud resources and provides a single platform to manage the complete malware attack lifecycle including filtering, infiltration detection, mitigation, cleanup, and post-attack forensics. Key features include one-click rollback using Windows VSS and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection services deliver economical in-depth protection for physical servers and virtual machines, workstations, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and advanced machine learning for continuously monitoring and responding to security threats from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, device management, and web filtering via leading-edge technologies packaged within a single agent managed from a unified control. Progent's security and virtualization experts can assist you to plan and configure a ProSight ESP deployment that meets your organization's specific needs and that allows you achieve and demonstrate compliance with legal and industry data security regulations. Progent will assist you define and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that call for immediate action. Progent can also assist you to set up and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business rapidly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange email filtering.