24x7x365 Panama City Urgent Crypto-Ransomware
Computer Virus Damage Assessment and Removal Consulting

Ransomware : Your Worst IT Nightmare
Crypto-Ransomware has become a modern cyberplague that presents an extinction-level danger for businesses vulnerable to an attack. Multiple generations of crypto-ransomware like the CrySIS, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and continue to cause havoc. Recent versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, plus more unnamed viruses, not only do encryption of on-line critical data but also infiltrate any accessible system protection mechanisms. Information synchronized to cloud environments can also be encrypted. In a vulnerable data protection solution, it can make automatic recovery hopeless and basically knocks the datacenter back to zero.

Getting back online services and data following a crypto-ransomware outage becomes a race against time as the targeted organization tries its best to stop lateral movement, cleanup the ransomware, and resume business-critical operations. Due to the fact that crypto-ransomware requires time to replicate, penetrations are frequently launched during weekends and nights, when successful attacks may take more time to recognize. This compounds the difficulty of quickly mobilizing and organizing a knowledgeable mitigation team.

Progent offers a variety of support services for securing organizations from ransomware attacks. These include user training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of the latest generation security gateways with artificial intelligence technology from SentinelOne to identify and disable zero-day cyber attacks quickly. Progent also provides the services of experienced ransomware recovery engineers with the skills and commitment to re-deploy a breached system as soon as possible.

Progent's Ransomware Restoration Help
Subsequent to a crypto-ransomware invasion, paying the ransom in cryptocurrency does not provide any assurance that distant criminals will respond with the needed keys to decrypt any or all of your data. Kaspersky ascertained that seventeen percent of ransomware victims never recovered their data even after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The alternative is to re-install the vital components of your Information Technology environment. Absent the availability of essential data backups, this calls for a broad complement of IT skills, top notch project management, and the ability to work non-stop until the job is finished.

For twenty years, Progent has offered certified expert Information Technology services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained advanced industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial systems and ERP application software. This breadth of experience provides Progent the ability to knowledgably ascertain critical systems and integrate the surviving components of your IT environment after a ransomware event and assemble them into a functioning network.

Progent's recovery team uses state-of-the-art project management tools to orchestrate the sophisticated restoration process. Progent appreciates the urgency of acting quickly and together with a client's management and Information Technology team members to assign priority to tasks and to put key services back online as fast as possible.

Customer Story: A Successful Ransomware Intrusion Restoration
A business engaged Progent after their network system was attacked by the Ryuk ransomware. Ryuk is thought to have been launched by Northern Korean state cybercriminals, possibly using approaches leaked from America's NSA organization. Ryuk seeks specific companies with little or no ability to sustain disruption and is one of the most lucrative examples of ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing business located in Chicago with about 500 employees. The Ryuk intrusion had shut down all business operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the time of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and wishfully thinking for the best, but in the end made the decision to use Progent.

Progent worked together with the customer to quickly understand and prioritize the key services that needed to be restored in order to continue business functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to recover Active Directory to its pre-intrusion state. Progent then assisted with setup and hard drive recovery on needed applications. All Exchange Server schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to collect local OST files (Outlook Email Offline Data Files) on staff desktop computers and laptops in order to recover email information. A recent off-line backup of the client's financials/MRP software made it possible to restore these required applications back on-line. Although major work was left to recover completely from the Ryuk event, critical services were restored quickly:

During the following couple of weeks critical milestones in the restoration process were made through close cooperation between Progent engineers and the customer:

• Internal web sites were restored without losing any information.
• The MailStore Server with over 4 million archived emails was restored to operations and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control functions were completely functional.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the user desktops and notebooks were back into operation.

Conclusion
A potential business extinction disaster was averted with results-oriented professionals, a wide array of knowledge, and tight teamwork. Although upon completion of forensics the ransomware virus attack detailed here could have been identified and blocked with up-to-date security technology and ISO/IEC 27001 best practices, user training, and well designed incident response procedures for data protection and keeping systems up to date with security patches, the reality remains that state-sponsored hackers from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware virus, feel confident that Progent's team of professionals has proven experience in ransomware virus defense, remediation, and information systems disaster recovery.

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Panama City a range of remote monitoring and security evaluation services to help you to reduce your vulnerability to crypto-ransomware. These services incorporate modern AI technology to detect new strains of ransomware that can escape detection by legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to create advanced network resilience. Progent handles the necessary monitoring and management for you, so your network scales easily without becoming an obstacle. For an affordable and predictable monthly price, Progent's full-service IT group can be your dependable technology safety net. Entry-level plans include RMM, security, automatic monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates state-of-the-art remote monitoring and management technology to help keep your network running efficiently by tracking the state of vital computers that power your business network. When ProSight LAN Watch uncovers a problem, an alarm is transmitted automatically to your designated IT staff and your assigned Progent engineering consultant so any looming issues can be addressed before they can disrupt productivity. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven solution for monitoring and managing your client-server infrastructure by offering an environment for performing common tedious tasks. These include health checking, update management, automated repairs, endpoint setup, backup and recovery, A/V protection, remote access, standard and custom scripts, resource inventory, endpoint profile reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alarm to your designated IT personnel and your assigned Progent consultant so emerging issues can be taken care of before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for smaller businesses to map out, monitor, optimize and debug their networking appliances such as routers, firewalls, and load balancers as well as servers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that infrastructure topology maps are always updated, copies and manages the configuration information of virtually all devices connected to your network, monitors performance, and generates alerts when problems are detected. By automating time-consuming management activities, ProSight WAN Watch can cut hours off common chores such as making network diagrams, reconfiguring your network, finding devices that require important software patches, or resolving performance issues. Learn more details about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of real-time and in-depth reporting tools created to integrate with the industry's leading ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues such as inconsistent support follow-through or machines with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with advanced backup software providers to create ProSight Data Protection Services, a selection of management offerings that provide backup-as-a-service (BaaS). ProSight DPS products automate and monitor your data backup processes and allow transparent backup and fast restoration of critical files, apps, system images, and VMs. ProSight DPS lets you recover from data loss resulting from hardware breakdown, natural disasters, fire, malware like ransomware, human mistakes, malicious employees, or application glitches. Managed backup services available in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of top data security vendors to provide web-based control and world-class security for your email traffic. The hybrid structure of Email Guard integrates a Cloud Protection Layer with a local gateway device to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. Email Guard's cloud filter acts as a preliminary barricade and keeps the vast majority of unwanted email from making it to your network firewall. This decreases your exposure to inbound threats and conserves network bandwidth and storage. Email Guard's on-premises gateway appliance adds a further layer of inspection for inbound email. For outbound email, the local security gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also assist Exchange Server to monitor and protect internal email that originates and ends inside your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA services utilize Cisco's Duo technology to protect against compromised passwords by using two-factor authentication. Duo enables single-tap identity confirmation on Apple iOS, Android, and other out-of-band devices. Using 2FA, whenever you log into a secured application and give your password you are asked to confirm your identity on a device that only you have and that is accessed using a different network channel. A wide range of devices can be utilized as this added form of ID validation including a smartphone or wearable, a hardware token, a landline phone, etc. You may register multiple validation devices. For details about Duo identity authentication services, see Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Desk: Support Desk Managed Services
  Progent's Call Desk services enable your information technology staff to offload Help Desk services to Progent or split responsibilities for Help Desk services transparently between your internal support resources and Progent's nationwide pool of certified IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a smooth extension of your in-house support staff. End user access to the Help Desk, delivery of support services, problem escalation, trouble ticket creation and tracking, performance measurement, and maintenance of the service database are cohesive regardless of whether issues are resolved by your internal support resources, by Progent, or both. Find out more about Progent's outsourced/co-managed Help Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates next generation behavior-based machine learning technology to defend endpoint devices as well as servers and VMs against new malware assaults such as ransomware and email phishing, which routinely escape legacy signature-based anti-virus products. Progent Active Security Monitoring services safeguard local and cloud resources and offers a single platform to address the entire malware attack progression including blocking, identification, containment, cleanup, and forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new threats. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, find and safeguard data about your IT infrastructure, procedures, applications, and services. You can instantly locate passwords or IP addresses and be alerted about upcoming expirations of SSLs or domains. By updating and organizing your IT documentation, you can save as much as half of time spent trying to find critical information about your network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents required for managing your network infrastructure such as standard operating procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT information. Whether you're making improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the data you need when you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide businesses of any size a flexible and cost-effective alternative for assessing, testing, scheduling, implementing, and documenting updates to your ever-evolving information system. Besides maximizing the security and reliability of your IT environment, Progent's software/firmware update management services allow your IT staff to focus on line-of-business projects and tasks that derive the highest business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host configured and maintained by Progent's network support professionals. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the apps. Since the system is virtualized, it can be moved easily to an alternate hardware environment without requiring a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoints against new malware attacks such as ransomware and file-less exploits, which routinely get by traditional signature-matching AV products. ProSight ASM safeguards local and cloud resources and offers a single platform to automate the entire threat lifecycle including protection, identification, containment, cleanup, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable in-depth protection for physical servers and virtual machines, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and advanced machine learning for continuously monitoring and responding to cyber assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, endpoint control, and web filtering through leading-edge tools incorporated within one agent accessible from a unified console. Progent's security and virtualization consultants can assist you to plan and implement a ProSight ESP deployment that meets your organization's unique requirements and that allows you achieve and demonstrate compliance with legal and industry data security regulations. Progent will help you define and implement policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that call for immediate action. Progent can also assist you to install and verify a backup and restore system such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange filtering.