24/7 Providence Urgent Crypto-Ransomware
Infection Detection and Repair Consulting

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a modern cyberplague that presents an enterprise-level threat for organizations poorly prepared for an attack. Different iterations of crypto-ransomware like the CryptoLocker, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for many years and still inflict destruction. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, as well as more as yet unnamed malware, not only do encryption of on-line information but also infect many configured system backups. Information synched to off-site disaster recovery sites can also be ransomed. In a vulnerable data protection solution, it can make any restoration impossible and effectively sets the entire system back to square one.

Getting back on-line applications and data after a ransomware event becomes a sprint against the clock as the victim fights to contain, eradicate the crypto-ransomware, and resume business-critical operations. Because crypto-ransomware needs time to replicate, penetrations are usually launched at night, when attacks typically take more time to notice. This multiplies the difficulty of quickly assembling and orchestrating a capable mitigation team.

Progent makes available an assortment of support services for protecting enterprises from ransomware attacks. These include team member education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, along with installation of next-generation security gateways with artificial intelligence technology from SentinelOne to identify and suppress day-zero cyber threats rapidly. Progent also can provide the assistance of expert ransomware recovery engineers with the talent and perseverance to re-deploy a breached environment as rapidly as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware invasion, even paying the ransom demands in cryptocurrency does not provide any assurance that merciless criminals will respond with the keys to decipher all your information. Kaspersky Labs ascertained that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to setup from scratch the critical parts of your IT environment. Absent the availability of complete data backups, this calls for a wide range of skill sets, professional team management, and the willingness to work continuously until the task is finished.

For two decades, Progent has offered professional IT services for businesses across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained high-level certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with accounting and ERP application software. This breadth of experience affords Progent the ability to rapidly ascertain critical systems and organize the remaining parts of your computer network environment after a ransomware penetration and rebuild them into an operational network.

Progent's ransomware group deploys best of breed project management tools to coordinate the complicated restoration process. Progent knows the importance of working swiftly and in concert with a customer's management and IT resources to prioritize tasks and to put key applications back on line as fast as humanly possible.

Case Study: A Successful Ransomware Incident Restoration
A client escalated to Progent after their company was attacked by the Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean state hackers, suspected of using techniques exposed from the U.S. National Security Agency. Ryuk attacks specific companies with limited tolerance for disruption and is among the most lucrative incarnations of ransomware viruses. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in the Chicago metro area with around 500 workers. The Ryuk intrusion had brought down all company operations and manufacturing processes. The majority of the client's information backups had been online at the start of the intrusion and were destroyed. The client was evaluating paying the ransom (exceeding $200K) and praying for the best, but ultimately made the decision to use Progent.

Progent worked with the customer to rapidly assess and prioritize the mission critical elements that needed to be recovered to make it possible to resume departmental functions:

• Active Directory (AD)
• Microsoft Exchange Server
• Accounting and Manufacturing Software

In less than two days, Progent was able to restore Windows Active Directory to its pre-attack state. Progent then charged ahead with reinstallations and hard drive recovery on needed systems. All Microsoft Exchange Server data and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to locate local OST files (Outlook Email Offline Folder Files) on staff PCs and laptops to recover email data. A not too old off-line backup of the client's accounting/MRP software made them able to return these required services back available to users. Although significant work was left to recover fully from the Ryuk virus, the most important services were recovered rapidly:

Throughout the following few weeks key milestones in the recovery project were completed through tight cooperation between Progent consultants and the client:

• Internal web applications were returned to operation without losing any information.
• The MailStore Server exceeding 4 million archived emails was spun up and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/AR/Inventory Control modules were completely operational.
• A new Palo Alto 850 firewall was brought on-line.
• Ninety percent of the user workstations were fully operational.

Conclusion
A likely business catastrophe was averted with top-tier professionals, a wide array of technical expertise, and tight teamwork. Although in post mortem the ransomware virus penetration described here would have been prevented with up-to-date cyber security systems and recognized best practices, team education, and properly executed incident response procedures for backup and applying software patches, the fact remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's roster of professionals has substantial experience in crypto-ransomware virus defense, cleanup, and file recovery.

To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Providence a portfolio of remote monitoring and security evaluation services to assist you to minimize your vulnerability to ransomware. These services utilize modern machine learning capability to detect new strains of ransomware that are able to evade legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to achieve advanced network resilience. Progent handles the daily monitoring and maintenance for you, so your system expands readily without holding you back. For an affordable and predictable monthly price, Progent's full-service IT team can be your dependable technology safety net. Entry-level plans include remote monitoring and management (RMM), security, monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to best-in-class solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management techniques to keep your IT system running at peak levels by tracking the health of vital computers that power your information system. When ProSight LAN Watch detects an issue, an alarm is transmitted automatically to your designated IT management staff and your assigned Progent consultant so all potential issues can be addressed before they can disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for monitoring and managing your client-server infrastructure by providing an environment for performing common tedious jobs. These can include health checking, patch management, automated repairs, endpoint configuration, backup and recovery, A/V defense, secure remote access, standard and custom scripts, resource inventory, endpoint status reports, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM spots a serious problem, it transmits an alarm to your specified IT staff and your Progent consultant so that potential issues can be fixed before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized businesses to map out, track, enhance and troubleshoot their connectivity hardware such as routers and switches, firewalls, and access points as well as servers, printers, client computers and other devices. Incorporating state-of-the-art RMM technology, ProSight WAN Watch ensures that infrastructure topology maps are kept updated, captures and displays the configuration of almost all devices on your network, tracks performance, and sends alerts when problems are discovered. By automating complex management and troubleshooting activities, ProSight WAN Watch can cut hours off common chores such as network mapping, reconfiguring your network, finding appliances that require important updates, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time management reporting plug-ins created to integrate with the industry's top ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues like inconsistent support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has partnered with leading backup technology providers to produce ProSight Data Protection Services, a selection of management offerings that provide backup-as-a-service. ProSight DPS products automate and monitor your backup operations and enable transparent backup and rapid restoration of critical files/folders, applications, system images, plus VMs. ProSight DPS helps you protect against data loss resulting from equipment failures, natural disasters, fire, malware such as ransomware, human mistakes, malicious insiders, or application bugs. Managed services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading data security companies to deliver centralized management and comprehensive protection for your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with an on-premises security gateway appliance to offer advanced defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne threats. Email Guard's Cloud Protection Layer serves as a preliminary barricade and blocks the vast majority of unwanted email from making it to your security perimeter. This reduces your exposure to external threats and conserves network bandwidth and storage. Email Guard's on-premises security gateway appliance adds a further layer of analysis for inbound email. For outgoing email, the on-premises gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also assist Exchange Server to monitor and protect internal email traffic that originates and ends within your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to protect against compromised passwords by using two-factor authentication (2FA). Duo enables one-tap identity confirmation on Apple iOS, Google Android, and other out-of-band devices. Using Duo 2FA, whenever you sign into a secured application and enter your password you are asked to verify your identity via a unit that only you have and that uses a different ("out-of-band") network channel. A broad range of devices can be utilized as this added means of authentication such as a smartphone or watch, a hardware/software token, a landline phone, etc. You can designate multiple verification devices. For more information about Duo identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Desk: Support Desk Managed Services
  Progent's Call Desk managed services permit your IT staff to outsource Call Center services to Progent or split activity for support services seamlessly between your internal support staff and Progent's nationwide roster of certified IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a transparent supplement to your core network support team. End user interaction with the Service Desk, delivery of technical assistance, problem escalation, ticket generation and updates, performance metrics, and management of the service database are cohesive regardless of whether issues are resolved by your in-house network support organization, by Progent, or by a combination. Find out more about Progent's outsourced/shared Call Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates next generation behavior machine learning technology to guard endpoints as well as physical and virtual servers against modern malware attacks like ransomware and email phishing, which routinely get by legacy signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and provides a single platform to manage the complete malware attack progression including filtering, identification, containment, remediation, and forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, find and protect data related to your network infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be warned about upcoming expirations of SSLs or warranties. By updating and managing your IT infrastructure documentation, you can save as much as 50% of time wasted trying to find vital information about your IT network. ProSight IT Asset Management features a centralized location for storing and collaborating on all documents required for managing your network infrastructure such as standard operating procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and associating IT information. Whether you're making enhancements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the information you require when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and affordable alternative for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your ever-evolving information network. Besides maximizing the protection and functionality of your IT environment, Progent's patch management services permit your IT staff to concentrate on more strategic projects and activities that deliver the highest business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a secure Tier III data center on a high-performance virtual host configured and maintained by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the client owns the data, the OS software, and the applications. Since the system is virtualized, it can be ported immediately to a different hosting environment without a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior analysis technology to defend physical and virtual endpoints against new malware attacks like ransomware and email phishing, which routinely evade legacy signature-based anti-virus tools. ProSight ASM protects local and cloud-based resources and provides a unified platform to automate the entire threat lifecycle including blocking, detection, containment, cleanup, and post-attack forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services offer affordable in-depth security for physical servers and virtual machines, desktops, smartphones, and Exchange Server. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and responding to security threats from all vectors. ProSight ESP offers two-way firewall protection, intrusion alarms, device control, and web filtering through leading-edge tools packaged within a single agent managed from a single control. Progent's security and virtualization consultants can assist you to design and implement a ProSight ESP environment that meets your company's unique requirements and that allows you prove compliance with legal and industry data protection regulations. Progent will assist you define and implement policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that call for immediate action. Progent can also help you to set up and verify a backup and restore system like ProSight Data Protection Services so you can recover quickly from a destructive cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange filtering.