Oklahoma CIty 24-Hour Immediate Crypto-Ransomware
Computer Malware Identification and Restoration Support

Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a too-frequent cyberplague that presents an existential danger for organizations unprepared for an assault. Different versions of ransomware such as Dharma, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been replicating for a long time and still cause havoc. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Egregor, along with additional unnamed malware, not only do encryption of online information but also infiltrate any accessible system protection. Data synchronized to off-site disaster recovery sites can also be held hostage. In a poorly designed environment, it can render any restoration hopeless and effectively knocks the network back to square one.

Getting back applications and information after a ransomware intrusion becomes a race against the clock as the victim struggles to stop lateral movement, eradicate the crypto-ransomware, and resume mission-critical activity. Since crypto-ransomware requires time to replicate, penetrations are often sprung on weekends and holidays, when successful attacks are likely to take longer to recognize. This multiplies the difficulty of quickly assembling and organizing a knowledgeable mitigation team.

Progent provides an assortment of solutions for securing businesses from ransomware penetrations. Among these are staff training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of the latest generation security solutions with artificial intelligence capabilities from SentinelOne to identify and disable zero-day cyber threats automatically. Progent in addition provides the assistance of veteran ransomware recovery engineers with the track record and perseverance to restore a breached network as urgently as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a crypto-ransomware event, sending the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will return the needed keys to unencrypt all your files. Kaspersky determined that seventeen percent of crypto-ransomware victims never restored their information after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to piece back together the vital elements of your Information Technology environment. Without access to full data backups, this requires a broad complement of skill sets, professional project management, and the willingness to work 24x7 until the job is finished.

For twenty years, Progent has offered expert Information Technology services for businesses across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded top industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial systems and ERP application software. This breadth of expertise provides Progent the skills to quickly identify necessary systems and re-organize the remaining components of your network environment following a ransomware attack and rebuild them into an operational system.

Progent's recovery team of experts deploys state-of-the-art project management systems to orchestrate the sophisticated recovery process. Progent understands the importance of working quickly and in concert with a client's management and Information Technology resources to assign priority to tasks and to put the most important systems back online as soon as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Virus Response
A business contacted Progent after their company was crashed by the Ryuk ransomware virus. Ryuk is believed to have been launched by Northern Korean government sponsored hackers, possibly adopting strategies leaked from the U.S. National Security Agency. Ryuk seeks specific organizations with little or no tolerance for disruption and is among the most lucrative iterations of ransomware. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturer based in Chicago with around 500 workers. The Ryuk penetration had frozen all company operations and manufacturing capabilities. Most of the client's system backups had been online at the start of the attack and were destroyed. The client considered paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for the best, but in the end brought in Progent.

Progent worked with the customer to rapidly identify and assign priority to the essential areas that needed to be addressed to make it possible to continue company functions:

• Active Directory (AD)
• Electronic Mail
• Financials/MRP

Within 2 days, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then completed setup and storage recovery on critical applications. All Exchange data and attributes were intact, which greatly helped the rebuild of Exchange. Progent was also able to find intact OST files (Microsoft Outlook Offline Folder Files) on user PCs to recover email messages. A recent offline backup of the customer's manufacturing software made it possible to return these vital services back on-line. Although significant work remained to recover fully from the Ryuk attack, critical systems were returned to operations quickly:

During the following month important milestones in the recovery process were accomplished through tight collaboration between Progent consultants and the client:

• Self-hosted web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server with over four million archived emails was spun up and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control functions were 100% operational.
• A new Palo Alto 850 firewall was installed and configured.
• 90% of the desktop computers were functioning as before the incident.

Conclusion
A likely business-killing disaster was avoided by top-tier experts, a broad array of knowledge, and close teamwork. Although in hindsight the ransomware virus attack detailed here should have been identified and stopped with current security systems and NIST Cybersecurity Framework best practices, user education, and appropriate incident response procedures for data backup and proper patching controls, the reality remains that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware incursion, remember that Progent's team of professionals has proven experience in crypto-ransomware virus defense, removal, and information systems recovery.

To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Oklahoma CIty a portfolio of online monitoring and security evaluation services to help you to reduce your vulnerability to ransomware. These services utilize modern AI technology to uncover new strains of ransomware that can evade legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent handles the necessary monitoring and maintenance for you, so your system expands easily without holding you back. For a low and predictable monthly subscription, Progent's experienced IT team can be your complete technology safety net. Entry-level packages include remote monitoring and management (RMM), security, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management technology to help keep your IT system running efficiently by checking the state of vital assets that drive your information system. When ProSight LAN Watch detects a problem, an alert is sent automatically to your designated IT management staff and your assigned Progent consultant so that any looming issues can be addressed before they have a chance to disrupt productivity. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven platform for managing your client-server infrastructure by offering an environment for streamlining common tedious jobs. These include health checking, patch management, automated remediation, endpoint deployment, backup and restore, A/V protection, remote access, standard and custom scripts, asset inventory, endpoint status reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alarm to your designated IT management staff and your assigned Progent technical consultant so that potential issues can be taken care of before they interfere with your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for small and mid-sized businesses to map out, track, reconfigure and debug their networking hardware such as switches, firewalls, and wireless controllers as well as servers, printers, client computers and other devices. Incorporating cutting-edge RMM technology, WAN Watch makes sure that network maps are always updated, captures and displays the configuration information of virtually all devices on your network, tracks performance, and sends alerts when problems are detected. By automating tedious network management processes, WAN Watch can cut hours off ordinary chores like making network diagrams, expanding your network, locating devices that need important software patches, or resolving performance issues. Find out more about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of real-time and in-depth management reporting utilities created to work with the top ticketing and remote network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as spotty support follow-up or machines with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup/restore technology providers to create ProSight Data Protection Services (DPS), a selection of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS products manage and monitor your backup operations and allow non-disruptive backup and rapid recovery of vital files, apps, images, plus virtual machines. ProSight DPS lets you avoid data loss resulting from equipment breakdown, natural calamities, fire, cyber attacks such as ransomware, human mistakes, malicious insiders, or software bugs. Managed backup services in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the technology of top information security vendors to provide web-based management and comprehensive security for your inbound and outbound email. The powerful structure of Progent's Email Guard integrates a Cloud Protection Layer with a local gateway device to provide complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based threats. Email Guard's cloud filter acts as a first line of defense and blocks the vast majority of unwanted email from reaching your security perimeter. This reduces your vulnerability to external attacks and saves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a deeper layer of analysis for incoming email. For outgoing email, the on-premises gateway provides AV and anti-spam protection, protection against data leaks, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to monitor and protect internal email that stays within your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA managed services utilize Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication. Duo supports single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. Using 2FA, when you sign into a secured online account and give your password you are requested to verify who you are via a unit that only you have and that uses a different ("out-of-band") network channel. A broad range of out-of-band devices can be used as this added means of authentication including a smartphone or watch, a hardware token, a landline telephone, etc. You can register several verification devices. To learn more about Duo identity authentication services, visit Cisco Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Service Desk: Help Desk Managed Services
  Progent's Support Desk managed services allow your information technology group to outsource Call Center services to Progent or divide responsibilities for support services transparently between your internal network support team and Progent's nationwide pool of certified IT support engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a transparent supplement to your internal support resources. End user interaction with the Help Desk, delivery of technical assistance, escalation, trouble ticket creation and tracking, efficiency metrics, and management of the service database are consistent whether incidents are taken care of by your internal network support resources, by Progent's team, or by a combination. Read more about Progent's outsourced/shared Help Desk services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior-based analysis technology to guard endpoint devices as well as servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-based AV tools. Progent Active Security Monitoring services safeguard local and cloud-based resources and offers a single platform to manage the entire threat progression including filtering, infiltration detection, containment, cleanup, and forensics. Key capabilities include one-click rollback with Windows VSS and automatic system-wide immunization against new threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, find and safeguard data about your IT infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be alerted about upcoming expirations of SSL certificates or warranties. By cleaning up and managing your IT documentation, you can eliminate up to 50% of time wasted searching for vital information about your network. ProSight IT Asset Management includes a centralized location for storing and collaborating on all documents related to managing your network infrastructure like recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and associating IT data. Whether you're planning enhancements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you require the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and affordable solution for assessing, validating, scheduling, implementing, and tracking updates to your dynamic information system. Besides maximizing the protection and functionality of your computer environment, Progent's software/firmware update management services allow your IT team to concentrate on more strategic projects and tasks that deliver the highest business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected Tier III data center on a fast virtual host configured and managed by Progent's network support professionals. With the ProSight Virtual Hosting model, the customer owns the data, the OS software, and the applications. Because the environment is virtualized, it can be ported immediately to a different hosting solution without requiring a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior analysis technology to defend physical and virtual endpoints against modern malware assaults such as ransomware and email phishing, which routinely get by legacy signature-based anti-virus tools. ProSight Active Security Monitoring safeguards local and cloud-based resources and offers a single platform to manage the entire malware attack progression including protection, infiltration detection, containment, remediation, and forensics. Top capabilities include one-click rollback using Windows VSS and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable in-depth protection for physical servers and virtual machines, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and reacting to security assaults from all vectors. ProSight ESP offers two-way firewall protection, intrusion alerts, device management, and web filtering via leading-edge tools packaged within a single agent managed from a unified control. Progent's security and virtualization experts can help your business to plan and implement a ProSight ESP deployment that addresses your organization's specific needs and that allows you prove compliance with legal and industry information protection standards. Progent will help you specify and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that require urgent attention. Progent can also assist you to install and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can recover quickly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange filtering.