Perth 24-Hour Emergency Crypto-Ransomware
Infection Identification and Repair Experts

Ransomware : Your Crippling IT Nightmare
Crypto-Ransomware has become an escalating cyberplague that represents an enterprise-level threat for organizations unprepared for an assault. Multiple generations of crypto-ransomware such as CryptoLocker, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and still cause havoc. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, as well as more unnamed viruses, not only encrypt on-line information but also infiltrate many available system protection mechanisms. Data replicated to off-site disaster recovery sites can also be encrypted. In a vulnerable data protection solution, it can make any restoration useless and basically sets the datacenter back to zero.

Getting back on-line applications and data after a ransomware outage becomes a race against time as the targeted organization tries its best to contain, clear the ransomware, and resume enterprise-critical activity. Because ransomware requires time to move laterally, penetrations are frequently sprung during nights and weekends, when successful attacks tend to take longer to uncover. This compounds the difficulty of quickly assembling and orchestrating a qualified response team.

Progent makes available an assortment of solutions for securing organizations from ransomware events. These include team member training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of the latest generation security solutions with machine learning technology from SentinelOne to detect and extinguish zero-day cyber threats intelligently. Progent also can provide the services of seasoned ransomware recovery engineers with the skills and perseverance to re-deploy a compromised network as quickly as possible.

Progent's Ransomware Restoration Services
Following a ransomware event, even paying the ransom in cryptocurrency does not ensure that criminal gangs will respond with the needed keys to decipher all your information. Kaspersky ascertained that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to re-install the vital parts of your IT environment. Absent the availability of complete data backups, this requires a wide range of IT skills, well-coordinated project management, and the ability to work 24x7 until the task is complete.

For twenty years, Progent has provided expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have attained high-level certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of experience provides Progent the capability to quickly determine critical systems and organize the remaining components of your network environment following a crypto-ransomware event and assemble them into a functioning system.

Progent's ransomware team uses powerful project management tools to orchestrate the complex recovery process. Progent knows the urgency of acting quickly and in unison with a customer's management and IT team members to assign priority to tasks and to put critical systems back on line as fast as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Intrusion Response
A small business hired Progent after their organization was crashed by the Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean government sponsored hackers, possibly adopting techniques leaked from America's National Security Agency. Ryuk attacks specific companies with limited tolerance for disruption and is among the most lucrative instances of ransomware malware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in the Chicago metro area with about 500 staff members. The Ryuk event had frozen all company operations and manufacturing processes. The majority of the client's data protection had been on-line at the beginning of the attack and were destroyed. The client was taking steps for paying the ransom (in excess of two hundred thousand dollars) and hoping for good luck, but in the end reached out to Progent.

Progent worked together with the client to rapidly assess and prioritize the key applications that had to be restored in order to restart company operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• MRP System

In less than 48 hours, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then accomplished rebuilding and storage recovery of mission critical servers. All Exchange schema and configuration information were usable, which accelerated the restore of Exchange. Progent was able to find local OST data files (Outlook Offline Data Files) on various desktop computers and laptops in order to recover email messages. A recent off-line backup of the customer's financials/MRP systems made it possible to return these essential services back servicing users. Although significant work needed to be completed to recover fully from the Ryuk event, critical services were restored rapidly:

Over the next few weeks important milestones in the restoration process were achieved through close cooperation between Progent team members and the customer:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Server with over 4 million historical emails was spun up and available for users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory capabilities were fully operational.
• A new Palo Alto 850 firewall was installed.
• Ninety percent of the desktop computers were fully operational.

Conclusion
A likely company-ending catastrophe was avoided with results-oriented professionals, a broad spectrum of knowledge, and tight teamwork. Although in post mortem the crypto-ransomware incident described here should have been identified and disabled with advanced cyber security systems and NIST Cybersecurity Framework best practices, staff training, and well designed incident response procedures for backup and proper patching controls, the fact remains that government-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's team of experts has substantial experience in ransomware virus defense, remediation, and information systems recovery.

To review or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers businesses in Perth a range of remote monitoring and security assessment services designed to assist you to reduce your vulnerability to crypto-ransomware. These services include modern AI technology to uncover new strains of crypto-ransomware that can escape detection by legacy signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent handles the necessary monitoring and management for you, so your network scales smoothly without becoming an obstacle. For a low and predictable monthly price, Progent's experienced IT team can be your dependable technology safety net. Basic packages include RMM, security, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management technology to keep your network running at peak levels by checking the state of critical assets that power your information system. When ProSight LAN Watch detects a problem, an alert is sent automatically to your specified IT management staff and your assigned Progent engineering consultant so all looming issues can be addressed before they can impact your network. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven platform for monitoring and managing your client-server infrastructure by providing tools for performing common tedious tasks. These can include health checking, update management, automated repairs, endpoint deployment, backup and recovery, A/V defense, remote access, built-in and custom scripts, asset inventory, endpoint profile reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your specified IT management personnel and your Progent technical consultant so that potential issues can be fixed before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized businesses to map out, track, enhance and debug their networking hardware such as switches, firewalls, and wireless controllers as well as servers, printers, endpoints and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that network maps are kept updated, copies and displays the configuration of virtually all devices on your network, tracks performance, and sends notices when problems are detected. By automating complex management and troubleshooting processes, ProSight WAN Watch can cut hours off common tasks like making network diagrams, expanding your network, locating devices that require important software patches, or isolating performance issues. Learn more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time and in-depth management reporting tools designed to integrate with the industry's top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with leading backup technology providers to produce ProSight Data Protection Services (DPS), a selection of subscription-based management offerings that deliver backup-as-a-service. ProSight DPS products manage and track your data backup processes and allow non-disruptive backup and rapid restoration of vital files, applications, images, plus VMs. ProSight DPS helps you avoid data loss caused by hardware breakdown, natural disasters, fire, cyber attacks like ransomware, user mistakes, ill-intentioned insiders, or application bugs. Managed services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to determine which of these managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of leading information security companies to provide centralized management and world-class security for your inbound and outbound email. The powerful structure of Progent's Email Guard managed service combines cloud-based filtering with an on-premises security gateway appliance to offer complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The Cloud Protection Layer serves as a preliminary barricade and keeps most unwanted email from reaching your network firewall. This decreases your vulnerability to external threats and conserves system bandwidth and storage. Email Guard's onsite gateway device provides a further layer of analysis for inbound email. For outbound email, the onsite gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The local gateway can also help Microsoft Exchange Server to track and protect internal email traffic that originates and ends within your security perimeter. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication services incorporate Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication. Duo supports single-tap identity confirmation on iOS, Android, and other personal devices. Using Duo 2FA, whenever you sign into a secured application and enter your password you are asked to verify who you are via a unit that only you have and that uses a separate network channel. A wide selection of out-of-band devices can be utilized for this added form of ID validation including a smartphone or wearable, a hardware token, a landline telephone, etc. You may register multiple validation devices. For more information about ProSight Duo identity authentication services, visit Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Center: Call Center Managed Services
  Progent's Support Desk managed services allow your information technology team to offload Call Center services to Progent or split responsibilities for Service Desk support transparently between your internal support group and Progent's nationwide pool of IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a transparent supplement to your corporate support resources. User interaction with the Help Desk, delivery of support, issue escalation, ticket creation and updates, performance metrics, and management of the support database are cohesive regardless of whether issues are resolved by your internal IT support resources, by Progent's team, or a mix of the two. Read more about Progent's outsourced/shared Service Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates next generation behavior machine learning technology to guard endpoint devices and servers and VMs against modern malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-based anti-virus products. Progent ASM services safeguard on-premises and cloud resources and provides a single platform to manage the complete threat lifecycle including filtering, detection, mitigation, remediation, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and safeguard information about your network infrastructure, processes, applications, and services. You can instantly locate passwords or IP addresses and be alerted about upcoming expirations of SSLs or domains. By updating and organizing your IT documentation, you can save up to 50% of time wasted looking for vital information about your IT network. ProSight IT Asset Management features a common repository for holding and collaborating on all documents required for managing your business network such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT data. Whether you're planning improvements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the knowledge you need as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer businesses of all sizes a versatile and cost-effective solution for assessing, validating, scheduling, implementing, and documenting updates to your dynamic IT system. In addition to optimizing the security and functionality of your computer network, Progent's patch management services allow your in-house IT staff to concentrate on more strategic initiatives and activities that deliver the highest business value from your information network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual host configured and maintained by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the applications. Because the system is virtualized, it can be ported immediately to a different hardware environment without a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior-based machine learning tools to guard physical and virtual endpoints against modern malware assaults such as ransomware and file-less exploits, which routinely get by legacy signature-matching AV tools. ProSight Active Security Monitoring safeguards local and cloud-based resources and offers a unified platform to manage the complete threat lifecycle including protection, detection, mitigation, cleanup, and post-attack forensics. Key capabilities include one-click rollback with Windows VSS and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection services offer economical multi-layer protection for physical servers and virtual machines, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP offers firewall protection, intrusion alerts, device control, and web filtering via cutting-edge technologies incorporated within a single agent managed from a unified control. Progent's data protection and virtualization experts can help your business to plan and implement a ProSight ESP deployment that addresses your organization's specific requirements and that allows you demonstrate compliance with legal and industry data protection standards. Progent will assist you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that require immediate action. Progent can also assist your company to set up and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange email filtering.