24-7 Plano Immediate Crypto-Ransomware
Malware Assessment and Restoration Support

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a too-frequent cyberplague that represents an existential danger for businesses unprepared for an attack. Multiple generations of ransomware like the Dharma, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been circulating for many years and continue to cause destruction. The latest strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with daily unnamed malware, not only encrypt online data files but also infiltrate any available system protection. Information replicated to the cloud can also be encrypted. In a poorly designed environment, it can make automated restoration useless and basically knocks the entire system back to zero.

Getting back online services and data following a crypto-ransomware attack becomes a sprint against time as the targeted business tries its best to contain, eradicate the crypto-ransomware, and resume business-critical operations. Because ransomware needs time to move laterally, assaults are often sprung during weekends and nights, when attacks are likely to take more time to discover. This compounds the difficulty of quickly marshalling and coordinating a qualified response team.

Progent makes available a variety of services for protecting enterprises from ransomware events. These include user training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of modern security appliances with artificial intelligence capabilities from SentinelOne to identify and quarantine day-zero cyber threats rapidly. Progent also provides the assistance of expert crypto-ransomware recovery professionals with the track record and perseverance to restore a breached system as quickly as possible.

Progent's Ransomware Restoration Help
After a crypto-ransomware attack, even paying the ransom in cryptocurrency does not guarantee that cyber criminals will provide the needed keys to unencrypt any of your information. Kaspersky Labs ascertained that seventeen percent of crypto-ransomware victims never restored their information after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to piece back together the key parts of your IT environment. Without the availability of complete system backups, this calls for a wide complement of skill sets, top notch team management, and the capability to work continuously until the job is completed.

For two decades, Progent has provided professional Information Technology services for companies across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have attained advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial systems and ERP software solutions. This breadth of experience provides Progent the capability to quickly determine critical systems and organize the remaining pieces of your network system after a ransomware attack and rebuild them into an operational network.

Progent's security group has powerful project management applications to coordinate the complicated restoration process. Progent knows the urgency of working quickly and together with a customer's management and Information Technology staff to assign priority to tasks and to put key applications back on line as fast as possible.

Client Story: A Successful Ransomware Incident Response
A customer contacted Progent after their organization was taken over by Ryuk ransomware. Ryuk is believed to have been launched by North Korean state sponsored cybercriminals, possibly adopting strategies leaked from the United States National Security Agency. Ryuk attacks specific businesses with limited tolerance for operational disruption and is among the most profitable iterations of ransomware. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in Chicago with about 500 workers. The Ryuk event had disabled all essential operations and manufacturing capabilities. Most of the client's information backups had been on-line at the start of the intrusion and were eventually encrypted. The client was evaluating paying the ransom demand (more than $200K) and wishfully thinking for the best, but ultimately called Progent.

Progent worked with the client to quickly determine and prioritize the key systems that had to be recovered to make it possible to restart departmental operations:

• Windows Active Directory
• Electronic Messaging
• Accounting/MRP

In less than 2 days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then assisted with setup and storage recovery of essential applications. All Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to find non-encrypted OST data files (Microsoft Outlook Offline Data Files) on user workstations in order to recover mail information. A not too old off-line backup of the customer's accounting/MRP systems made it possible to restore these required applications back online. Although major work needed to be completed to recover totally from the Ryuk virus, essential services were restored rapidly:

Throughout the next month critical milestones in the restoration project were made through tight collaboration between Progent consultants and the client:

• Self-hosted web sites were brought back up with no loss of data.
• The MailStore Exchange Server with over 4 million historical emails was brought on-line and available for users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory capabilities were fully operational.
• A new Palo Alto 850 security appliance was brought on-line.
• 90% of the user desktops and notebooks were fully operational.

Conclusion
A likely company-ending catastrophe was evaded by results-oriented experts, a broad range of knowledge, and close collaboration. Although in post mortem the crypto-ransomware attack detailed here should have been identified and blocked with modern security systems and NIST Cybersecurity Framework best practices, user education, and properly executed security procedures for information backup and proper patching controls, the fact is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware attack, remember that Progent's team of professionals has substantial experience in ransomware virus blocking, removal, and data restoration.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Plano a portfolio of remote monitoring and security evaluation services designed to assist you to reduce your vulnerability to ransomware. These services incorporate modern AI capability to detect zero-day variants of crypto-ransomware that can evade legacy signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to create advanced network resilience. Progent handles the necessary monitoring and maintenance for you, so your system scales readily without holding you back. For an affordable and predictable monthly price, Progent's experienced IT group can be your complete technology safety net. Basic plans include remote monitoring and management, cybersecurity, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management technology to help keep your network operating efficiently by tracking the state of vital assets that power your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your specified IT management staff and your Progent consultant so all potential problems can be addressed before they have a chance to disrupt productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for managing your client-server infrastructure by providing an environment for streamlining common time-consuming jobs. These can include health monitoring, patch management, automated remediation, endpoint configuration, backup and restore, A/V defense, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alarm to your designated IT management staff and your assigned Progent consultant so that potential problems can be fixed before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized businesses to diagram, track, enhance and troubleshoot their connectivity hardware such as routers and switches, firewalls, and load balancers as well as servers, printers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that network diagrams are kept updated, copies and manages the configuration information of almost all devices connected to your network, tracks performance, and generates alerts when problems are detected. By automating time-consuming management and troubleshooting processes, WAN Watch can cut hours off common tasks like making network diagrams, expanding your network, locating appliances that need important updates, or isolating performance problems. Find out more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time reporting utilities created to work with the leading ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as spotty support follow-up or machines with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup software companies to create ProSight Data Protection Services, a selection of management outsourcing plans that provide backup-as-a-service. ProSight DPS products automate and monitor your data backup operations and allow non-disruptive backup and rapid restoration of critical files, apps, system images, plus Hyper-V and VMware virtual machines. ProSight DPS helps your business avoid data loss resulting from equipment failures, natural disasters, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned insiders, or application glitches. Managed services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of leading data security companies to provide centralized management and world-class protection for all your email traffic. The powerful architecture of Email Guard managed service combines cloud-based filtering with a local gateway device to provide complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. Email Guard's Cloud Protection Layer acts as a first line of defense and keeps most unwanted email from reaching your security perimeter. This reduces your vulnerability to external attacks and saves system bandwidth and storage. Email Guard's onsite gateway appliance adds a further level of analysis for incoming email. For outbound email, the on-premises gateway offers AV and anti-spam protection, DLP, and email encryption. The local gateway can also help Exchange Server to track and safeguard internal email traffic that originates and ends within your security perimeter. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA managed services utilize Cisco's Duo cloud technology to defend against password theft by using two-factor authentication (2FA). Duo supports one-tap identity verification with Apple iOS, Android, and other personal devices. With 2FA, whenever you sign into a secured application and enter your password you are asked to verify who you are on a unit that only you have and that uses a separate network channel. A broad range of out-of-band devices can be used for this second means of authentication such as an iPhone or Android or wearable, a hardware/software token, a landline phone, etc. You may designate several verification devices. To find out more about ProSight Duo identity authentication services, visit Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Service Desk: Help Desk Managed Services
  Progent's Support Desk managed services permit your IT group to outsource Support Desk services to Progent or split responsibilities for Help Desk services seamlessly between your internal support group and Progent's extensive pool of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a transparent extension of your in-house network support resources. User access to the Help Desk, delivery of support services, issue escalation, ticket generation and updates, performance measurement, and management of the service database are cohesive whether incidents are resolved by your core support staff, by Progent, or a mix of the two. Find out more about Progent's outsourced/co-managed Service Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior-based analysis technology to guard endpoints and servers and VMs against new malware attacks such as ransomware and file-less exploits, which routinely get by traditional signature-based anti-virus tools. Progent ASM services protect on-premises and cloud-based resources and offers a unified platform to automate the complete malware attack progression including blocking, detection, mitigation, remediation, and forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and safeguard data related to your network infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be alerted automatically about impending expirations of SSL certificates or warranties. By cleaning up and managing your IT documentation, you can eliminate up to half of time thrown away looking for critical information about your IT network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents related to managing your network infrastructure such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and relating IT data. Whether you're making improvements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you need as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide businesses of any size a versatile and affordable solution for evaluating, testing, scheduling, implementing, and documenting software and firmware updates to your ever-evolving IT system. In addition to maximizing the security and functionality of your computer network, Progent's software/firmware update management services free up time for your IT staff to focus on more strategic projects and activities that deliver maximum business value from your network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host configured and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the customer owns the data, the operating system software, and the applications. Since the environment is virtualized, it can be ported immediately to an alternate hardware environment without a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not tied one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection service that incorporates SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which routinely get by traditional signature-based AV products. ProSight Active Security Monitoring safeguards local and cloud-based resources and offers a single platform to manage the entire malware attack lifecycle including filtering, identification, containment, remediation, and forensics. Top capabilities include single-click rollback using Windows VSS and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer affordable in-depth protection for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP uses contextual security and advanced machine learning for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP offers two-way firewall protection, intrusion alerts, endpoint control, and web filtering through leading-edge tools incorporated within one agent managed from a single console. Progent's security and virtualization consultants can assist you to design and configure a ProSight ESP deployment that meets your organization's specific needs and that helps you demonstrate compliance with government and industry data security standards. Progent will help you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that require immediate attention. Progent can also help you to set up and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange email filtering.