24/7 Fresno Emergency Ransomware
Computer Malware Identification and Recovery Services

Ransomware : Your Crippling IT Disaster
Ransomware has become an escalating cyber pandemic that poses an extinction-level threat for businesses of all sizes vulnerable to an attack. Different iterations of ransomware such as CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and still cause damage. Recent versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, along with more as yet unnamed viruses, not only do encryption of online data but also infiltrate many configured system restores and backups. Information synchronized to off-site disaster recovery sites can also be corrupted. In a vulnerable system, it can make automatic restore operations useless and basically knocks the network back to zero.

Restoring services and data after a ransomware event becomes a sprint against the clock as the targeted organization fights to contain the damage, eradicate the virus, and restore business-critical activity. Because ransomware requires time to spread, assaults are usually sprung during nights and weekends, when successful penetrations in many cases take more time to detect. This multiplies the difficulty of quickly assembling and orchestrating a capable response team.

Progent offers an assortment of support services for protecting enterprises from ransomware attacks. These include team member training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of the latest generation security solutions with artificial intelligence capabilities from SentinelOne to identify and quarantine new cyber attacks rapidly. Progent also provides the services of veteran ransomware recovery professionals with the talent and commitment to reconstruct a breached network as rapidly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a ransomware event, paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will provide the needed keys to decrypt all your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their data after having paid the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to piece back together the critical components of your IT environment. Absent the availability of essential information backups, this requires a broad complement of IT skills, top notch team management, and the capability to work continuously until the job is over.

For decades, Progent has provided professional IT services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial systems and ERP applications. This breadth of experience gives Progent the capability to rapidly understand important systems and re-organize the surviving parts of your Information Technology environment following a ransomware penetration and configure them into a functioning system.

Progent's ransomware team deploys top notch project management systems to coordinate the complicated restoration process. Progent understands the urgency of acting swiftly and in concert with a customer's management and IT team members to assign priority to tasks and to get key services back online as fast as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Virus Response
A customer sought out Progent after their network system was crashed by the Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean state cybercriminals, possibly adopting techniques leaked from America's National Security Agency. Ryuk goes after specific businesses with little or no room for disruption and is among the most profitable versions of ransomware viruses. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturer based in Chicago and has about 500 workers. The Ryuk attack had frozen all business operations and manufacturing processes. Most of the client's system backups had been online at the start of the attack and were destroyed. The client was actively seeking loans for paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but in the end called Progent.

Progent worked hand in hand the customer to rapidly determine and assign priority to the critical services that needed to be restored in order to restart company functions:

• Active Directory
• Email
• Accounting and Manufacturing Software

Within 2 days, Progent was able to recover Active Directory to its pre-penetration state. Progent then accomplished rebuilding and hard drive recovery on mission critical applications. All Exchange Server schema and attributes were usable, which greatly helped the rebuild of Exchange. Progent was also able to collect intact OST data files (Outlook Email Off-Line Folder Files) on team workstations to recover mail data. A recent offline backup of the client's accounting/ERP systems made it possible to recover these required programs back on-line. Although a large amount of work was left to recover totally from the Ryuk attack, essential systems were recovered quickly:

Over the next couple of weeks important milestones in the recovery process were accomplished through close cooperation between Progent engineers and the customer:

• Self-hosted web sites were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server exceeding four million historical messages was brought online and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/AR/Inventory functions were completely recovered.
• A new Palo Alto 850 security appliance was installed and configured.
• 90% of the desktops and laptops were functioning as before the incident.

Conclusion
A likely business extinction disaster was averted through the efforts of dedicated experts, a broad range of IT skills, and close collaboration. Although upon completion of forensics the ransomware incident described here could have been stopped with advanced cyber security systems and best practices, user education, and well thought out incident response procedures for backup and applying software patches, the fact remains that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's team of experts has extensive experience in ransomware virus defense, removal, and information systems restoration.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Fresno a portfolio of online monitoring and security evaluation services to assist you to minimize your vulnerability to ransomware. These services include next-generation machine learning capability to uncover new variants of ransomware that can get past traditional signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create advanced network resilience. Progent handles the necessary monitoring and management for you, so your network expands smoothly without becoming an obstacle. For a low and predictable monthly price, Progent's full-service IT team can be your dependable technology safety net. Basic plans include remote monitoring and management, security, automatic monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management technology to keep your network running efficiently by checking the health of vital assets that power your information system. When ProSight LAN Watch detects an issue, an alert is transmitted immediately to your designated IT staff and your Progent consultant so any potential problems can be resolved before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for managing your client-server infrastructure by providing tools for streamlining common tedious tasks. These include health monitoring, update management, automated repairs, endpoint deployment, backup and recovery, A/V response, secure remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your specified IT staff and your Progent consultant so that emerging problems can be fixed before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized businesses to map, track, enhance and troubleshoot their connectivity appliances like switches, firewalls, and load balancers plus servers, printers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that network diagrams are always updated, copies and displays the configuration of virtually all devices on your network, monitors performance, and generates notices when potential issues are detected. By automating tedious network management processes, ProSight WAN Watch can cut hours off ordinary tasks like network mapping, reconfiguring your network, finding appliances that require critical software patches, or isolating performance issues. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of real-time reporting tools designed to work with the leading ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues like inconsistent support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with advanced backup software providers to produce ProSight Data Protection Services (DPS), a selection of management offerings that provide backup-as-a-service (BaaS). ProSight DPS products automate and track your data backup operations and allow transparent backup and fast restoration of critical files/folders, apps, system images, plus VMs. ProSight DPS lets your business protect against data loss resulting from hardware failures, natural calamities, fire, malware like ransomware, user error, ill-intentioned insiders, or application glitches. Managed backup services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top data security vendors to provide web-based management and comprehensive security for your inbound and outbound email. The hybrid architecture of Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway appliance to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. The cloud filter acts as a first line of defense and blocks the vast majority of unwanted email from making it to your security perimeter. This reduces your vulnerability to inbound attacks and saves network bandwidth and storage. Email Guard's on-premises security gateway appliance provides a deeper layer of analysis for incoming email. For outgoing email, the onsite security gateway offers anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local security gateway can also assist Microsoft Exchange Server to track and safeguard internal email traffic that originates and ends inside your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA managed services utilize Cisco's Duo technology to protect against stolen passwords by using two-factor authentication. Duo enables single-tap identity confirmation with iOS, Android, and other personal devices. Using Duo 2FA, when you sign into a protected online account and enter your password you are asked to confirm who you are via a unit that only you have and that uses a different ("out-of-band") network channel. A broad selection of out-of-band devices can be used as this second form of ID validation including an iPhone or Android or watch, a hardware token, a landline telephone, etc. You may register multiple verification devices. For details about Duo two-factor identity validation services, refer to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Service Desk: Help Desk Managed Services
  Progent's Help Desk managed services allow your information technology team to offload Call Center services to Progent or divide responsibilities for Service Desk support transparently between your in-house network support resources and Progent's nationwide roster of certified IT service technicians, engineers and subject matter experts. Progent's Shared Service Desk provides a transparent supplement to your core support group. Client interaction with the Help Desk, delivery of support, issue escalation, ticket creation and updates, performance metrics, and management of the support database are consistent whether incidents are taken care of by your core IT support organization, by Progent, or by a combination. Learn more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior-based analysis tools to guard endpoints as well as servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-matching anti-virus tools. Progent ASM services safeguard on-premises and cloud-based resources and provides a unified platform to manage the complete malware attack lifecycle including filtering, infiltration detection, containment, cleanup, and post-attack forensics. Key capabilities include single-click rollback with Windows VSS and automatic system-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, find and protect data related to your network infrastructure, procedures, business apps, and services. You can instantly locate passwords or serial numbers and be alerted about upcoming expirations of SSLs ,domains or warranties. By updating and managing your IT documentation, you can save up to 50% of time thrown away looking for vital information about your IT network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents related to managing your network infrastructure such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and associating IT data. Whether you're planning improvements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need when you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer organizations of any size a flexible and cost-effective solution for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your ever-evolving IT network. In addition to optimizing the security and functionality of your computer network, Progent's patch management services permit your IT staff to concentrate on more strategic projects and activities that derive the highest business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a protected Tier III data center on a fast virtual machine host set up and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system platforms, and the applications. Since the system is virtualized, it can be moved easily to a different hardware environment without a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not locked into one hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoint devices against new malware attacks such as ransomware and file-less exploits, which routinely escape legacy signature-matching AV products. ProSight ASM safeguards local and cloud-based resources and offers a unified platform to manage the entire threat progression including protection, infiltration detection, containment, remediation, and forensics. Key capabilities include one-click rollback with Windows VSS and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services deliver economical in-depth protection for physical servers and virtual machines, workstations, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and responding to cyber assaults from all vectors. ProSight ESP provides firewall protection, intrusion alerts, device management, and web filtering through cutting-edge tools packaged within one agent accessible from a unified console. Progent's security and virtualization consultants can assist you to plan and configure a ProSight ESP deployment that meets your organization's specific needs and that helps you demonstrate compliance with legal and industry information protection regulations. Progent will assist you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that call for immediate action. Progent can also assist you to set up and test a backup and restore system like ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange email filtering.