Aurora 24x7 Emergency Crypto
Infection Identification and Remediation Experts

Ransomware : Your Crippling IT Nightmare
Ransomware has become a modern cyberplague that represents an existential threat for businesses poorly prepared for an attack. Multiple generations of ransomware like the Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for a long time and continue to inflict destruction. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, plus additional as yet unnamed viruses, not only encrypt online critical data but also infiltrate any accessible system protection mechanisms. Information synched to the cloud can also be corrupted. In a vulnerable data protection solution, this can make any restoration useless and basically sets the entire system back to zero.

Getting back online programs and data following a ransomware attack becomes a sprint against time as the targeted organization tries its best to contain the damage, remove the ransomware, and resume mission-critical activity. Due to the fact that crypto-ransomware needs time to move laterally, assaults are frequently launched during nights and weekends, when successful penetrations typically take more time to notice. This compounds the difficulty of rapidly mobilizing and coordinating a qualified response team.

Progent makes available a range of solutions for securing enterprises from ransomware attacks. Among these are team education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of next-generation security gateways with machine learning technology from SentinelOne to identify and extinguish new cyber threats rapidly. Progent also can provide the assistance of experienced crypto-ransomware recovery professionals with the skills and perseverance to rebuild a breached network as rapidly as possible.

Progent's Ransomware Restoration Help
After a ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will return the codes to unencrypt any of your information. Kaspersky determined that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The alternative is to setup from scratch the mission-critical parts of your Information Technology environment. Without access to complete system backups, this requires a broad range of skills, well-coordinated team management, and the ability to work non-stop until the recovery project is completed.

For two decades, Progent has provided expert IT services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained advanced industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with financial systems and ERP application software. This breadth of experience affords Progent the skills to efficiently understand necessary systems and organize the surviving parts of your IT system after a ransomware penetration and configure them into an operational system.

Progent's security team utilizes top notch project management applications to orchestrate the complex restoration process. Progent understands the urgency of working rapidly and together with a customer's management and Information Technology resources to assign priority to tasks and to get the most important services back on line as fast as possible.

Client Story: A Successful Ransomware Intrusion Restoration
A client engaged Progent after their company was attacked by the Ryuk crypto-ransomware. Ryuk is thought to have been deployed by North Korean government sponsored hackers, possibly using strategies exposed from America's National Security Agency. Ryuk targets specific businesses with limited ability to sustain operational disruption and is one of the most lucrative iterations of ransomware. Major victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago and has around 500 workers. The Ryuk penetration had shut down all company operations and manufacturing capabilities. Most of the client's system backups had been on-line at the start of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (more than $200K) and hoping for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the customer to rapidly determine and assign priority to the most important areas that had to be restored in order to continue company functions:

• Active Directory (AD)
• Microsoft Exchange Email
• Accounting/MRP

In less than 2 days, Progent was able to rebuild Active Directory to its pre-virus state. Progent then charged ahead with setup and storage recovery on key servers. All Exchange ties and attributes were intact, which accelerated the restore of Exchange. Progent was also able to locate local OST data files (Outlook Offline Folder Files) on user workstations and laptops in order to recover mail information. A not too old offline backup of the customer's financials/ERP software made it possible to restore these essential services back online for users. Although a lot of work remained to recover completely from the Ryuk event, essential systems were recovered quickly:

During the following month critical milestones in the restoration process were achieved in tight collaboration between Progent engineers and the client:

• Internal web sites were restored without losing any information.
• The MailStore Microsoft Exchange Server containing more than four million archived messages was restored to operations and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory modules were 100% operational.
• A new Palo Alto Networks 850 firewall was brought online.
• 90% of the desktops and laptops were functioning as before the incident.

Conclusion
A probable enterprise-killing disaster was evaded with top-tier professionals, a wide spectrum of subject matter expertise, and tight collaboration. Although in hindsight the ransomware virus penetration detailed here could have been identified and disabled with modern cyber security technology solutions and NIST Cybersecurity Framework best practices, user training, and appropriate security procedures for data backup and proper patching controls, the reality is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware incursion, feel confident that Progent's team of professionals has a proven track record in ransomware virus defense, remediation, and file recovery.

To read or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Aurora a variety of remote monitoring and security assessment services to assist you to minimize your vulnerability to ransomware. These services utilize next-generation machine learning technology to uncover zero-day strains of ransomware that can evade legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent handles the necessary monitoring and maintenance for you, so your network scales easily without holding you back. For an affordable and predictable monthly price, Progent's experienced IT group can be your dependable technology safety net. Entry-level plans include remote monitoring and management (RMM), security, automatic monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management techniques to help keep your IT system running efficiently by checking the health of critical computers that drive your information system. When ProSight LAN Watch detects a problem, an alarm is sent automatically to your designated IT personnel and your assigned Progent consultant so that all potential problems can be resolved before they can disrupt productivity. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for monitoring and managing your client-server infrastructure by providing tools for performing common time-consuming jobs. These include health checking, patch management, automated repairs, endpoint configuration, backup and restore, anti-virus defense, remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alert to your specified IT personnel and your assigned Progent technical consultant so that emerging problems can be fixed before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for smaller businesses to diagram, monitor, reconfigure and debug their networking hardware like routers, firewalls, and wireless controllers plus servers, printers, client computers and other devices. Incorporating state-of-the-art RMM technology, WAN Watch ensures that network diagrams are kept updated, copies and manages the configuration information of virtually all devices on your network, tracks performance, and sends notices when problems are discovered. By automating complex management processes, WAN Watch can knock hours off ordinary tasks such as network mapping, reconfiguring your network, finding appliances that require important software patches, or isolating performance bottlenecks. Learn more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time and in-depth management reporting plug-ins designed to work with the industry's leading ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize key issues like inconsistent support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore software companies to produce ProSight Data Protection Services (DPS), a selection of subscription-based management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS products automate and track your data backup processes and allow non-disruptive backup and fast recovery of vital files/folders, applications, images, plus virtual machines. ProSight DPS lets your business protect against data loss caused by equipment breakdown, natural calamities, fire, cyber attacks like ransomware, human mistakes, ill-intentioned employees, or software bugs. Managed services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of top data security companies to provide web-based control and world-class protection for all your email traffic. The powerful structure of Email Guard managed service integrates cloud-based filtering with an on-premises security gateway appliance to offer complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. The cloud filter serves as a preliminary barricade and blocks the vast majority of threats from making it to your network firewall. This decreases your vulnerability to external threats and conserves system bandwidth and storage. Email Guard's onsite security gateway appliance adds a further level of analysis for incoming email. For outbound email, the onsite gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also assist Exchange Server to track and protect internal email that originates and ends within your security perimeter. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans utilize Cisco's Duo cloud technology to defend against stolen passwords by using two-factor authentication (2FA). Duo supports one-tap identity confirmation with iOS, Google Android, and other out-of-band devices. Using 2FA, whenever you sign into a secured online account and enter your password you are asked to verify your identity via a unit that only you possess and that uses a different network channel. A broad range of out-of-band devices can be used as this added means of ID validation such as a smartphone or watch, a hardware token, a landline phone, etc. You can register several validation devices. To learn more about ProSight Duo two-factor identity authentication services, see Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Center: Call Center Managed Services
  Progent's Help Center services enable your IT group to offload Call Center services to Progent or divide responsibilities for support services transparently between your internal support team and Progent's nationwide pool of IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a transparent extension of your corporate support staff. End user interaction with the Service Desk, provision of technical assistance, issue escalation, ticket generation and tracking, performance measurement, and maintenance of the support database are cohesive regardless of whether issues are resolved by your in-house support group, by Progent, or both. Read more about Progent's outsourced/shared Call Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection solution that incorporates cutting edge behavior analysis technology to guard endpoint devices and servers and VMs against modern malware attacks such as ransomware and email phishing, which routinely escape traditional signature-matching AV products. Progent ASM services protect local and cloud-based resources and offers a unified platform to address the complete threat progression including blocking, detection, mitigation, remediation, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered attacks. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, retrieve and protect information related to your network infrastructure, processes, applications, and services. You can quickly find passwords or IP addresses and be alerted automatically about upcoming expirations of SSLs or warranties. By cleaning up and managing your IT infrastructure documentation, you can eliminate up to half of time wasted trying to find vital information about your network. ProSight IT Asset Management features a centralized repository for holding and collaborating on all documents related to managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT data. Whether you're planning enhancements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer businesses of all sizes a versatile and cost-effective solution for assessing, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving IT system. Besides maximizing the protection and functionality of your computer network, Progent's patch management services allow your in-house IT staff to concentrate on more strategic initiatives and tasks that derive maximum business value from your information network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host configured and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the OS platforms, and the apps. Since the system is virtualized, it can be ported immediately to an alternate hosting solution without a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which easily evade legacy signature-matching anti-virus products. ProSight ASM protects local and cloud-based resources and provides a single platform to automate the complete threat progression including filtering, identification, mitigation, cleanup, and forensics. Top features include one-click rollback using Windows VSS and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection services deliver affordable in-depth security for physical servers and virtual machines, desktops, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and reacting to security threats from all vectors. ProSight ESP provides firewall protection, intrusion alerts, endpoint control, and web filtering via cutting-edge tools packaged within one agent accessible from a single control. Progent's security and virtualization experts can assist your business to plan and configure a ProSight ESP deployment that meets your organization's specific needs and that helps you prove compliance with government and industry data security standards. Progent will assist you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that call for urgent attention. Progent can also help you to set up and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange filtering.