Clearwater 24x7 Emergency Ransomware
Computer Malware Damage Assessment and Restoration Support

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a modern cyber pandemic that represents an existential danger for businesses of all sizes vulnerable to an attack. Different versions of ransomware like the CryptoLocker, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and continue to inflict destruction. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, as well as frequent as yet unnamed newcomers, not only encrypt online data but also infiltrate most accessible system backups. Data replicated to off-site disaster recovery sites can also be held hostage. In a poorly architected data protection solution, it can make any recovery useless and basically sets the entire system back to square one.

Restoring services and information after a ransomware attack becomes a race against the clock as the targeted business tries its best to contain the damage, clear the ransomware, and restore mission-critical activity. Due to the fact that ransomware requires time to replicate, penetrations are frequently launched during weekends and nights, when penetrations tend to take longer to uncover. This compounds the difficulty of rapidly mobilizing and orchestrating a qualified mitigation team.

Progent makes available a range of solutions for securing organizations from crypto-ransomware penetrations. These include user education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of the latest generation security solutions with AI technology from SentinelOne to discover and disable zero-day cyber threats intelligently. Progent also can provide the services of expert crypto-ransomware recovery consultants with the track record and commitment to rebuild a breached network as soon as possible.

Progent's Ransomware Restoration Services
Subsequent to a crypto-ransomware invasion, paying the ransom demands in cryptocurrency does not ensure that merciless criminals will return the needed keys to decrypt all your files. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to setup from scratch the critical components of your IT environment. Without access to essential data backups, this calls for a wide complement of skills, professional team management, and the capability to work non-stop until the recovery project is done.

For two decades, Progent has provided certified expert Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have earned advanced industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of expertise affords Progent the capability to quickly ascertain important systems and organize the remaining pieces of your network system after a ransomware penetration and assemble them into a functioning system.

Progent's recovery team utilizes best of breed project management systems to coordinate the complex recovery process. Progent appreciates the importance of acting quickly and in concert with a customer's management and Information Technology resources to assign priority to tasks and to put essential systems back on-line as soon as possible.

Client Story: A Successful Ransomware Virus Response
A business contacted Progent after their company was attacked by Ryuk ransomware virus. Ryuk is thought to have been created by North Korean government sponsored criminal gangs, suspected of using strategies exposed from the United States NSA organization. Ryuk goes after specific businesses with little or no room for disruption and is among the most profitable instances of crypto-ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturer located in the Chicago metro area with about 500 workers. The Ryuk event had paralyzed all essential operations and manufacturing processes. The majority of the client's backups had been online at the start of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (more than two hundred thousand dollars) and praying for good luck, but in the end made the decision to use Progent.

Progent worked hand in hand the customer to quickly understand and assign priority to the mission critical systems that needed to be restored to make it possible to restart business functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to recover Active Directory services to its pre-virus state. Progent then helped perform rebuilding and hard drive recovery on needed servers. All Exchange ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Off-Line Data Files) on various workstations to recover email messages. A not too old offline backup of the businesses manufacturing systems made it possible to return these required applications back available to users. Although a large amount of work still had to be done to recover totally from the Ryuk attack, critical services were recovered quickly:

During the next few weeks critical milestones in the recovery project were achieved in close cooperation between Progent engineers and the client:

• In-house web sites were restored without losing any data.
• The MailStore Microsoft Exchange Server exceeding four million archived messages was brought online and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory capabilities were 100 percent operational.
• A new Palo Alto 850 security appliance was installed and configured.
• Ninety percent of the user workstations were fully operational.

Conclusion
A potential company-ending catastrophe was evaded through the efforts of hard-working experts, a wide range of technical expertise, and tight teamwork. Although upon completion of forensics the ransomware virus penetration detailed here would have been identified and disabled with modern security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and well thought out security procedures for data backup and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware penetration, remember that Progent's team of professionals has proven experience in ransomware virus blocking, removal, and data restoration.

To read or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Clearwater a portfolio of online monitoring and security assessment services designed to help you to minimize your vulnerability to crypto-ransomware. These services include next-generation artificial intelligence capability to uncover new strains of ransomware that are able to escape detection by legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your system scales readily without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT group can be your dependable technology safety net. Entry-level plans include remote monitoring and management (RMM), security, automatic monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-in-class solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management (RMM) technology to keep your IT system operating at peak levels by tracking the health of critical assets that power your business network. When ProSight LAN Watch detects a problem, an alert is sent immediately to your specified IT staff and your Progent consultant so all looming issues can be addressed before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven solution for managing your network, server, and desktop devices by providing an environment for performing common time-consuming jobs. These include health monitoring, patch management, automated remediation, endpoint deployment, backup and recovery, anti-virus defense, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it transmits an alert to your specified IT staff and your assigned Progent consultant so emerging problems can be fixed before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized organizations to diagram, monitor, reconfigure and debug their networking appliances such as routers and switches, firewalls, and wireless controllers plus servers, endpoints and other devices. Using cutting-edge RMM technology, WAN Watch makes sure that infrastructure topology diagrams are kept current, copies and displays the configuration of almost all devices on your network, tracks performance, and sends notices when problems are discovered. By automating complex management processes, ProSight WAN Watch can knock hours off common tasks like making network diagrams, reconfiguring your network, locating devices that require critical updates, or resolving performance problems. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of in-depth management reporting utilities created to work with the industry's top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues such as inconsistent support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has partnered with leading backup software companies to create ProSight Data Protection Services (DPS), a family of management outsourcing plans that provide backup-as-a-service. ProSight DPS services manage and track your backup processes and allow transparent backup and rapid restoration of vital files, apps, system images, and VMs. ProSight DPS helps your business avoid data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks like ransomware, human error, ill-intentioned employees, or software bugs. Managed backup services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to determine which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading information security vendors to provide web-based control and world-class security for your inbound and outbound email. The hybrid architecture of Email Guard integrates a Cloud Protection Layer with an on-premises security gateway device to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. Email Guard's Cloud Protection Layer acts as a preliminary barricade and blocks the vast majority of unwanted email from reaching your network firewall. This decreases your vulnerability to external attacks and conserves network bandwidth and storage space. Email Guard's onsite gateway appliance adds a deeper level of inspection for incoming email. For outgoing email, the local gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local security gateway can also assist Exchange Server to monitor and protect internal email traffic that originates and ends within your corporate firewall. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo MFA managed services utilize Cisco's Duo technology to defend against compromised passwords by using two-factor authentication (2FA). Duo supports single-tap identity verification on iOS, Android, and other personal devices. Using 2FA, when you sign into a protected online account and give your password you are requested to confirm who you are on a unit that only you have and that is accessed using a separate network channel. A wide selection of devices can be utilized as this second means of authentication including a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can register several validation devices. For more information about Duo two-factor identity validation services, refer to Cisco Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Help Center: Call Center Managed Services
  Progent's Call Center services allow your IT staff to outsource Support Desk services to Progent or divide activity for support services transparently between your in-house network support resources and Progent's nationwide pool of certified IT service engineers and subject matter experts. Progent's Shared Help Desk Service provides a transparent extension of your core support team. Client interaction with the Service Desk, provision of support services, problem escalation, trouble ticket generation and updates, performance measurement, and management of the service database are consistent whether incidents are taken care of by your internal support group, by Progent, or a mix of the two. Read more about Progent's outsourced/shared Call Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates next generation behavior machine learning tools to guard endpoints as well as servers and VMs against modern malware attacks like ransomware and file-less exploits, which routinely get by legacy signature-based anti-virus tools. Progent Active Security Monitoring services protect local and cloud-based resources and provides a unified platform to automate the complete threat lifecycle including blocking, detection, containment, cleanup, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against new attacks. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, retrieve and protect information related to your IT infrastructure, procedures, applications, and services. You can quickly locate passwords or IP addresses and be alerted automatically about upcoming expirations of SSLs or warranties. By cleaning up and managing your IT infrastructure documentation, you can eliminate as much as 50% of time thrown away searching for critical information about your IT network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents related to managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're planning improvements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you need as soon as you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of all sizes a versatile and affordable solution for assessing, validating, scheduling, applying, and tracking updates to your dynamic information system. Besides maximizing the security and reliability of your IT network, Progent's software/firmware update management services free up time for your in-house IT staff to focus on line-of-business projects and activities that derive maximum business value from your information network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual host configured and maintained by Progent's IT support experts. Under Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the OS software, and the applications. Because the environment is virtualized, it can be moved easily to a different hardware environment without requiring a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior-based analysis tools to guard physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which easily get by legacy signature-matching AV tools. ProSight ASM protects local and cloud-based resources and offers a unified platform to address the complete threat lifecycle including blocking, identification, containment, remediation, and forensics. Top capabilities include single-click rollback with Windows VSS and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection managed services offer ultra-affordable multi-layer security for physical servers and VMs, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and responding to security threats from all attack vectors. ProSight ESP provides two-way firewall protection, penetration alarms, device control, and web filtering through leading-edge tools packaged within a single agent accessible from a single console. Progent's security and virtualization consultants can assist you to design and configure a ProSight ESP deployment that meets your organization's unique needs and that helps you demonstrate compliance with legal and industry information protection regulations. Progent will assist you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that require urgent attention. Progent's consultants can also help your company to set up and test a backup and restore solution like ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange filtering.