Albuquerque 24/7 Emergency Crypto
Computer Virus Damage Assessment and Recovery Experts

Ransomware : Your Crippling IT Nightmare
Ransomware has become a too-frequent cyberplague that represents an extinction-level threat for organizations unprepared for an attack. Different versions of ransomware such as Dharma, Fusob, Locky, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to cause havoc. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, along with frequent as yet unnamed viruses, not only do encryption of on-line critical data but also infiltrate any accessible system protection mechanisms. Information replicated to off-site disaster recovery sites can also be encrypted. In a vulnerable system, it can make automated restore operations hopeless and effectively sets the datacenter back to zero.

Restoring programs and information after a ransomware event becomes a sprint against time as the targeted business tries its best to stop lateral movement, cleanup the virus, and resume enterprise-critical operations. Due to the fact that ransomware takes time to spread, attacks are often sprung on weekends and holidays, when penetrations typically take longer to recognize. This compounds the difficulty of promptly assembling and organizing a capable mitigation team.

Progent has an assortment of solutions for protecting businesses from crypto-ransomware events. These include user training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of the latest generation security gateways with AI capabilities from SentinelOne to detect and suppress new cyber threats intelligently. Progent in addition offers the services of experienced crypto-ransomware recovery professionals with the track record and commitment to restore a breached environment as quickly as possible.

Progent's Ransomware Restoration Support Services
After a crypto-ransomware attack, sending the ransom in cryptocurrency does not guarantee that criminal gangs will provide the codes to decipher all your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to setup from scratch the key parts of your IT environment. Without the availability of complete system backups, this requires a wide range of IT skills, well-coordinated team management, and the ability to work continuously until the recovery project is complete.

For two decades, Progent has offered professional IT services for companies throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded high-level certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of experience gives Progent the skills to efficiently understand important systems and consolidate the surviving components of your computer network system after a ransomware attack and rebuild them into a functioning network.

Progent's ransomware team utilizes powerful project management applications to coordinate the sophisticated recovery process. Progent understands the importance of acting rapidly and together with a client's management and IT resources to prioritize tasks and to put essential systems back online as soon as possible.

Client Case Study: A Successful Crypto-Ransomware Virus Recovery
A client engaged Progent after their company was taken over by Ryuk ransomware. Ryuk is generally considered to have been launched by Northern Korean government sponsored cybercriminals, suspected of adopting strategies exposed from the U.S. NSA organization. Ryuk seeks specific organizations with little or no room for disruption and is among the most profitable examples of crypto-ransomware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in the Chicago metro area with about 500 staff members. The Ryuk penetration had disabled all company operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the time of the attack and were damaged. The client was evaluating paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for the best, but in the end engaged Progent.

Progent worked together with the customer to rapidly understand and prioritize the essential areas that needed to be recovered to make it possible to resume company operations:

• Active Directory
• Microsoft Exchange Email
• MRP System

Within 2 days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then initiated reinstallations and hard drive recovery of the most important applications. All Exchange schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was also able to collect non-encrypted OST data files (Outlook Email Off-Line Data Files) on user desktop computers and laptops to recover email information. A recent off-line backup of the customer's financials/MRP systems made them able to recover these vital programs back on-line. Although a large amount of work remained to recover completely from the Ryuk damage, critical services were recovered quickly:

During the next couple of weeks important milestones in the restoration project were completed through close collaboration between Progent engineers and the customer:

• Self-hosted web sites were brought back up with no loss of information.
• The MailStore Server exceeding four million archived messages was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control modules were completely restored.
• A new Palo Alto 850 security appliance was brought online.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A potential enterprise-killing catastrophe was evaded due to top-tier professionals, a broad spectrum of IT skills, and tight collaboration. Although in hindsight the ransomware incident detailed here would have been prevented with current security technology solutions and ISO/IEC 27001 best practices, user and IT administrator education, and well thought out incident response procedures for information protection and applying software patches, the fact remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has substantial experience in crypto-ransomware virus defense, mitigation, and file restoration.

To read or download a PDF version of this customer story, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Albuquerque a portfolio of online monitoring and security assessment services designed to assist you to reduce your vulnerability to ransomware. These services include modern artificial intelligence capability to detect new variants of ransomware that are able to escape detection by legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve leading-edge network resilience. Progent handles the necessary monitoring and maintenance for you, so your system expands readily without holding you back. For a low and predictable monthly price, Progent's experienced IT team can be your complete technology safety net. Entry-level plans include RMM, security, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) techniques to keep your IT system running at peak levels by tracking the state of vital computers that power your information system. When ProSight LAN Watch uncovers an issue, an alarm is transmitted immediately to your designated IT staff and your Progent engineering consultant so that all looming issues can be addressed before they have a chance to impact your network. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your client-server infrastructure by offering an environment for streamlining common time-consuming tasks. These include health monitoring, update management, automated remediation, endpoint configuration, backup and recovery, anti-virus protection, secure remote access, standard and custom scripts, asset inventory, endpoint status reporting, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alert to your designated IT staff and your Progent technical consultant so that emerging issues can be fixed before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for small and mid-sized organizations to map, monitor, reconfigure and debug their networking appliances such as routers, firewalls, and wireless controllers plus servers, endpoints and other networked devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that infrastructure topology maps are kept current, copies and displays the configuration information of virtually all devices on your network, monitors performance, and sends notices when problems are detected. By automating complex management processes, WAN Watch can cut hours off ordinary chores such as network mapping, expanding your network, finding devices that require important software patches, or identifying the cause of performance issues. Find out more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of in-depth reporting utilities created to integrate with the leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues like spotty support follow-up or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore technology providers to produce ProSight Data Protection Services, a family of offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and track your data backup operations and allow transparent backup and rapid recovery of critical files, apps, system images, and VMs. ProSight DPS helps you protect against data loss resulting from equipment failures, natural disasters, fire, cyber attacks like ransomware, user mistakes, ill-intentioned insiders, or software bugs. Managed services in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these fully managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of leading data security companies to provide centralized control and world-class security for all your inbound and outbound email. The powerful architecture of Email Guard combines cloud-based filtering with a local gateway device to provide advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The cloud filter serves as a preliminary barricade and keeps most unwanted email from reaching your security perimeter. This decreases your exposure to external attacks and conserves network bandwidth and storage. Email Guard's onsite security gateway device adds a further level of inspection for incoming email. For outgoing email, the local gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also assist Exchange Server to monitor and safeguard internal email that stays within your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo technology to defend against stolen passwords through the use of two-factor authentication. Duo supports single-tap identity verification with iOS, Android, and other out-of-band devices. Using Duo 2FA, whenever you sign into a secured application and enter your password you are asked to confirm your identity on a device that only you have and that is accessed using a different ("out-of-band") network channel. A broad selection of devices can be used for this added means of authentication including a smartphone or watch, a hardware/software token, a landline telephone, etc. You may register several validation devices. To learn more about ProSight Duo two-factor identity authentication services, see Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Center: Call Center Managed Services
  Progent's Help Center managed services enable your information technology staff to outsource Help Desk services to Progent or split responsibilities for Help Desk services transparently between your in-house support team and Progent's extensive pool of IT service engineers and subject matter experts. Progent's Shared Service Desk offers a transparent supplement to your corporate network support group. User interaction with the Service Desk, delivery of technical assistance, problem escalation, ticket generation and updates, efficiency measurement, and management of the support database are consistent whether incidents are resolved by your core IT support staff, by Progent's team, or both. Read more about Progent's outsourced/co-managed Call Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes next generation behavior-based machine learning technology to guard endpoints and physical and virtual servers against new malware assaults such as ransomware and email phishing, which routinely get by legacy signature-based anti-virus products. Progent Active Security Monitoring services protect local and cloud-based resources and offers a unified platform to address the complete threat lifecycle including protection, infiltration detection, mitigation, cleanup, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, retrieve and safeguard data related to your network infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSLs or domains. By updating and managing your IT documentation, you can eliminate as much as half of time thrown away looking for critical information about your IT network. ProSight IT Asset Management includes a centralized location for storing and collaborating on all documents related to managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and relating IT information. Whether you're planning enhancements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the knowledge you need the instant you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of all sizes a versatile and cost-effective alternative for evaluating, validating, scheduling, implementing, and tracking software and firmware updates to your ever-evolving information system. Besides maximizing the protection and reliability of your IT environment, Progent's software/firmware update management services permit your IT team to focus on more strategic projects and activities that deliver the highest business value from your network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a secure fault tolerant data center on a high-performance virtual machine host configured and maintained by Progent's network support experts. Under Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the OS platforms, and the applications. Since the environment is virtualized, it can be ported easily to an alternate hardware solution without requiring a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior analysis technology to guard physical and virtual endpoint devices against new malware attacks such as ransomware and file-less exploits, which easily get by traditional signature-matching anti-virus tools. ProSight ASM protects on-premises and cloud resources and offers a single platform to automate the complete threat lifecycle including filtering, infiltration detection, mitigation, remediation, and post-attack forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection managed services offer ultra-affordable multi-layer protection for physical servers and VMs, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced machine learning for round-the-clock monitoring and reacting to cyber assaults from all vectors. ProSight ESP offers firewall protection, intrusion alerts, endpoint management, and web filtering via cutting-edge tools packaged within a single agent managed from a unified console. Progent's security and virtualization experts can help you to plan and configure a ProSight ESP environment that meets your company's specific requirements and that helps you demonstrate compliance with government and industry information security regulations. Progent will assist you specify and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that call for immediate attention. Progent's consultants can also help you to set up and test a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange email filtering.