Honolulu 24/7 Immediate Crypto
Computer Malware Detection and Removal Consulting

Ransomware : Your Worst IT Nightmare
Ransomware has become an escalating cyberplague that represents an extinction-level threat for organizations unprepared for an assault. Different versions of ransomware such as Reveton, Fusob, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and still inflict havoc. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, plus more as yet unnamed malware, not only do encryption of online files but also infiltrate any available system protection mechanisms. Data synchronized to off-site disaster recovery sites can also be encrypted. In a poorly designed system, it can render automatic restore operations useless and basically sets the network back to square one.

Restoring programs and information after a crypto-ransomware attack becomes a sprint against the clock as the targeted organization fights to contain the damage, cleanup the virus, and resume enterprise-critical operations. Due to the fact that crypto-ransomware takes time to move laterally, attacks are usually launched during nights and weekends, when successful attacks tend to take longer to detect. This compounds the difficulty of rapidly marshalling and orchestrating a qualified mitigation team.

Progent has an assortment of help services for protecting organizations from ransomware attacks. These include staff education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of modern security solutions with machine learning technology from SentinelOne to identify and disable new cyber threats intelligently. Progent in addition provides the assistance of expert ransomware recovery professionals with the talent and perseverance to re-deploy a compromised network as soon as possible.

Progent's Crypto-Ransomware Recovery Services
After a crypto-ransomware attack, sending the ransom in cryptocurrency does not ensure that criminal gangs will provide the needed codes to decipher any of your files. Kaspersky Labs ascertained that seventeen percent of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to setup from scratch the essential parts of your Information Technology environment. Without the availability of complete data backups, this calls for a broad range of skills, professional project management, and the capability to work continuously until the recovery project is completed.

For two decades, Progent has made available expert IT services for businesses across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have attained advanced certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in accounting and ERP applications. This breadth of experience gives Progent the capability to quickly ascertain necessary systems and re-organize the surviving parts of your network environment after a ransomware event and rebuild them into an operational network.

Progent's security team uses top notch project management applications to coordinate the complex restoration process. Progent understands the urgency of working swiftly and in unison with a customer's management and IT team members to assign priority to tasks and to put key services back online as fast as possible.

Client Case Study: A Successful Ransomware Intrusion Recovery
A business contacted Progent after their organization was attacked by the Ryuk crypto-ransomware. Ryuk is generally considered to have been launched by North Korean state cybercriminals, suspected of using algorithms leaked from the U.S. NSA organization. Ryuk seeks specific organizations with limited ability to sustain operational disruption and is one of the most profitable iterations of ransomware viruses. High publicized targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer located in Chicago with about 500 workers. The Ryuk attack had brought down all business operations and manufacturing processes. The majority of the client's backups had been directly accessible at the time of the intrusion and were eventually encrypted. The client was pursuing financing for paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for good luck, but in the end brought in Progent.

Progent worked with the customer to rapidly determine and prioritize the critical services that needed to be restored to make it possible to resume company operations:

• Microsoft Active Directory
• Exchange Server
• Accounting/MRP

Within two days, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then assisted with reinstallations and storage recovery on the most important systems. All Exchange Server schema and configuration information were intact, which facilitated the rebuild of Exchange. Progent was able to locate local OST files (Microsoft Outlook Offline Folder Files) on team desktop computers and laptops to recover mail information. A not too old off-line backup of the businesses financials/ERP software made it possible to return these required applications back on-line. Although a large amount of work was left to recover fully from the Ryuk attack, essential systems were returned to operations rapidly:

During the next couple of weeks important milestones in the recovery process were completed through tight collaboration between Progent team members and the client:

• In-house web sites were restored without losing any information.
• The MailStore Microsoft Exchange Server containing more than four million archived messages was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control functions were 100 percent recovered.
• A new Palo Alto 850 security appliance was brought on-line.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A likely enterprise-killing catastrophe was dodged with top-tier experts, a broad spectrum of IT skills, and tight collaboration. Although in post mortem the ransomware penetration detailed here should have been disabled with up-to-date cyber security solutions and NIST Cybersecurity Framework best practices, user and IT administrator education, and well designed security procedures for data backup and applying software patches, the fact remains that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware virus, feel confident that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and data recovery.

To review or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide companies in Honolulu a range of online monitoring and security assessment services designed to assist you to reduce your vulnerability to ransomware. These services utilize next-generation machine learning capability to detect new variants of ransomware that are able to evade traditional signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to achieve leading-edge network resilience. Progent handles the necessary monitoring and management for you, so your network scales readily without holding you back. For a low and predictable monthly price, Progent's experienced IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management, security, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) techniques to help keep your IT system running at peak levels by tracking the state of vital computers that power your information system. When ProSight LAN Watch detects an issue, an alarm is transmitted automatically to your specified IT management personnel and your assigned Progent engineering consultant so all looming issues can be resolved before they have a chance to impact productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for managing your network, server, and desktop devices by providing an environment for performing common tedious tasks. These include health monitoring, patch management, automated remediation, endpoint setup, backup and recovery, A/V response, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your specified IT management staff and your Progent technical consultant so emerging issues can be fixed before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for smaller organizations to map out, track, optimize and troubleshoot their networking appliances like switches, firewalls, and wireless controllers as well as servers, printers, endpoints and other devices. Incorporating state-of-the-art RMM technology, WAN Watch makes sure that network maps are kept updated, captures and manages the configuration information of almost all devices connected to your network, tracks performance, and generates alerts when problems are detected. By automating complex management and troubleshooting processes, ProSight WAN Watch can knock hours off common tasks like making network diagrams, expanding your network, locating appliances that need important updates, or identifying the cause of performance issues. Find out more details about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time management reporting tools designed to work with the industry's top ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-up or machines with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with advanced backup software providers to create ProSight Data Protection Services, a portfolio of subscription-based management offerings that deliver backup-as-a-service. ProSight DPS products manage and track your data backup operations and allow transparent backup and fast recovery of vital files, applications, images, plus VMs. ProSight DPS lets your business avoid data loss caused by hardware failures, natural calamities, fire, cyber attacks like ransomware, user mistakes, ill-intentioned employees, or application bugs. Managed backup services available in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading information security companies to provide web-based management and world-class protection for all your inbound and outbound email. The hybrid architecture of Progent's Email Guard combines a Cloud Protection Layer with a local gateway device to offer advanced defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The cloud filter serves as a preliminary barricade and blocks the vast majority of threats from making it to your security perimeter. This decreases your exposure to inbound threats and conserves system bandwidth and storage space. Email Guard's on-premises security gateway device adds a further layer of inspection for incoming email. For outgoing email, the onsite gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Exchange Server to track and protect internal email that originates and ends inside your corporate firewall. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo MFA services utilize Cisco's Duo technology to protect against password theft through the use of two-factor authentication (2FA). Duo supports single-tap identity verification with Apple iOS, Google Android, and other personal devices. Using 2FA, whenever you sign into a secured online account and give your password you are requested to confirm your identity on a device that only you possess and that is accessed using a different ("out-of-band") network channel. A broad selection of devices can be used for this second means of authentication including a smartphone or wearable, a hardware token, a landline telephone, etc. You can register multiple validation devices. For more information about Duo identity validation services, go to Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Service Center: Help Desk Managed Services
  Progent's Support Center managed services enable your IT group to outsource Support Desk services to Progent or divide responsibilities for support services transparently between your in-house support group and Progent's nationwide roster of IT service engineers and subject matter experts (SMEs). Progent's Shared Service Desk provides a transparent extension of your core support staff. User access to the Service Desk, delivery of support, issue escalation, trouble ticket generation and tracking, performance metrics, and maintenance of the service database are cohesive regardless of whether incidents are resolved by your internal IT support organization, by Progent, or by a combination. Find out more about Progent's outsourced/co-managed Service Center services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes next generation behavior analysis tools to defend endpoints as well as servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily get by traditional signature-matching anti-virus tools. Progent ASM services protect on-premises and cloud-based resources and provides a unified platform to address the entire malware attack progression including protection, detection, containment, remediation, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new threats. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, find and protect data about your IT infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be warned automatically about impending expirations of SSLs or warranties. By updating and managing your IT documentation, you can save as much as half of time wasted searching for critical information about your IT network. ProSight IT Asset Management includes a common location for holding and collaborating on all documents related to managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT data. Whether you're planning improvements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the information you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management provide businesses of all sizes a flexible and affordable solution for assessing, validating, scheduling, applying, and tracking updates to your dynamic IT system. Besides optimizing the protection and reliability of your computer network, Progent's patch management services allow your in-house IT staff to concentrate on more strategic projects and tasks that deliver maximum business value from your information network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a protected Tier III data center on a fast virtual machine host configured and maintained by Progent's network support experts. With the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the apps. Since the environment is virtualized, it can be ported easily to a different hardware environment without requiring a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior-based analysis technology to defend physical and virtual endpoint devices against modern malware attacks like ransomware and file-less exploits, which routinely get by traditional signature-matching anti-virus products. ProSight ASM safeguards local and cloud resources and provides a single platform to address the entire threat lifecycle including filtering, infiltration detection, mitigation, remediation, and forensics. Key capabilities include one-click rollback using Windows VSS and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services deliver ultra-affordable multi-layer protection for physical servers and virtual machines, workstations, mobile devices, and Microsoft Exchange. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and reacting to cyber assaults from all vectors. ProSight ESP delivers firewall protection, penetration alerts, endpoint control, and web filtering through leading-edge technologies incorporated within a single agent managed from a unified console. Progent's data protection and virtualization consultants can assist your business to plan and configure a ProSight ESP deployment that addresses your organization's unique needs and that helps you achieve and demonstrate compliance with legal and industry data security standards. Progent will assist you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for immediate attention. Progent's consultants can also help you to install and verify a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange email filtering.