24/7/365 Manaus Emergency Crypto
Malware Damage Assessment and Remediation Support

Crypto-Ransomware : Your Worst IT Disaster
Ransomware has become a modern cyber pandemic that represents an existential threat for businesses vulnerable to an attack. Different iterations of ransomware such as Dharma, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for many years and still inflict havoc. More recent variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, plus frequent as yet unnamed viruses, not only do encryption of on-line critical data but also infiltrate many available system backup. Files synchronized to cloud environments can also be ransomed. In a vulnerable environment, it can render automatic recovery impossible and effectively knocks the entire system back to zero.

Getting back services and data following a ransomware event becomes a race against the clock as the targeted business tries its best to stop the spread, clear the crypto-ransomware, and restore enterprise-critical activity. Since crypto-ransomware takes time to move laterally, penetrations are frequently launched on weekends, when successful attacks tend to take longer to detect. This compounds the difficulty of promptly marshalling and organizing a knowledgeable mitigation team.

Progent makes available an assortment of support services for protecting organizations from crypto-ransomware penetrations. These include team education to help identify and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with installation of next-generation security gateways with AI technology from SentinelOne to detect and quarantine day-zero cyber threats automatically. Progent also can provide the services of expert ransomware recovery professionals with the skills and commitment to reconstruct a breached system as soon as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware attack, paying the ransom in cryptocurrency does not guarantee that criminal gangs will respond with the needed keys to decipher all your data. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their information after having paid the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to re-install the vital elements of your Information Technology environment. Absent access to full information backups, this calls for a broad range of skills, well-coordinated team management, and the willingness to work continuously until the recovery project is complete.

For two decades, Progent has provided certified expert Information Technology services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have been awarded high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of expertise provides Progent the ability to knowledgably identify important systems and consolidate the remaining pieces of your IT system following a crypto-ransomware event and assemble them into an operational system.

Progent's ransomware group has powerful project management applications to coordinate the complicated restoration process. Progent understands the urgency of acting quickly and together with a customer's management and Information Technology resources to prioritize tasks and to put the most important applications back on-line as fast as possible.

Business Case Study: A Successful Crypto-Ransomware Incident Restoration
A client hired Progent after their organization was penetrated by the Ryuk ransomware virus. Ryuk is generally considered to have been developed by Northern Korean state sponsored criminal gangs, suspected of adopting technology exposed from America's NSA organization. Ryuk seeks specific organizations with little ability to sustain operational disruption and is among the most profitable instances of crypto-ransomware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in the Chicago metro area with around 500 workers. The Ryuk penetration had frozen all business operations and manufacturing processes. Most of the client's information backups had been on-line at the beginning of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but in the end reached out to Progent.

Progent worked together with the customer to quickly assess and prioritize the most important applications that had to be recovered to make it possible to restart company operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to recover Active Directory to its pre-attack state. Progent then completed rebuilding and storage recovery on key systems. All Microsoft Exchange Server data and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to locate non-encrypted OST files (Microsoft Outlook Offline Data Files) on team PCs to recover email information. A not too old off-line backup of the customer's financials/MRP software made them able to recover these vital programs back on-line. Although significant work was left to recover totally from the Ryuk event, essential systems were restored rapidly:

Over the next couple of weeks critical milestones in the restoration project were achieved in tight collaboration between Progent team members and the customer:

• In-house web applications were restored without losing any information.
• The MailStore Exchange Server exceeding four million historical messages was spun up and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/AR/Inventory capabilities were completely recovered.
• A new Palo Alto 850 security appliance was set up.
• 90% of the user desktops were being used by staff.

Conclusion
A probable business-ending disaster was averted with results-oriented experts, a wide array of technical expertise, and tight collaboration. Although in post mortem the crypto-ransomware penetration described here should have been disabled with current cyber security solutions and ISO/IEC 27001 best practices, user training, and well designed security procedures for information protection and proper patching controls, the fact remains that state-sponsored hackers from China, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware attack, remember that Progent's team of professionals has proven experience in ransomware virus blocking, mitigation, and file recovery.

To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Manaus a variety of online monitoring and security evaluation services designed to help you to reduce your vulnerability to ransomware. These services utilize modern AI capability to detect zero-day strains of crypto-ransomware that are able to evade traditional signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent takes care of the daily monitoring and management for you, so your system scales readily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's experienced IT group can be your dependable technology safety net. Entry-level plans include remote monitoring and management (RMM), security, automatic monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to advanced solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) techniques to keep your IT system operating efficiently by checking the state of vital assets that drive your business network. When ProSight LAN Watch detects an issue, an alarm is sent automatically to your designated IT management personnel and your assigned Progent engineering consultant so that any potential issues can be resolved before they can disrupt your network. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven solution for managing your client-server infrastructure by providing an environment for streamlining common time-consuming tasks. These include health monitoring, patch management, automated remediation, endpoint deployment, backup and restore, anti-virus protection, remote access, standard and custom scripts, resource inventory, endpoint status reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alarm to your designated IT staff and your assigned Progent consultant so that emerging problems can be taken care of before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for smaller organizations to map out, track, reconfigure and troubleshoot their connectivity hardware such as switches, firewalls, and access points plus servers, client computers and other networked devices. Using cutting-edge RMM technology, ProSight WAN Watch makes sure that network maps are always current, captures and manages the configuration of virtually all devices connected to your network, tracks performance, and generates notices when potential issues are detected. By automating time-consuming network management processes, WAN Watch can knock hours off common tasks like network mapping, reconfiguring your network, locating appliances that need critical software patches, or identifying the cause of performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time and in-depth management reporting plug-ins designed to integrate with the top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with advanced backup software companies to create ProSight Data Protection Services (DPS), a selection of management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS services manage and track your data backup operations and enable transparent backup and fast restoration of important files/folders, apps, images, plus VMs. ProSight DPS helps you protect against data loss caused by hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, user error, ill-intentioned insiders, or software bugs. Managed backup services available in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to identify which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the technology of top data security vendors to deliver centralized control and comprehensive security for your email traffic. The hybrid architecture of Progent's Email Guard combines a Cloud Protection Layer with a local gateway device to offer complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The cloud filter acts as a first line of defense and blocks the vast majority of unwanted email from making it to your network firewall. This decreases your exposure to external threats and conserves network bandwidth and storage. Email Guard's onsite gateway appliance provides a further layer of inspection for incoming email. For outgoing email, the onsite gateway provides anti-virus and anti-spam filtering, DLP, and email encryption. The local gateway can also assist Exchange Server to track and protect internal email traffic that originates and ends inside your corporate firewall. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo MFA service plans incorporate Cisco's Duo technology to defend against stolen passwords by using two-factor authentication. Duo enables single-tap identity confirmation on iOS, Android, and other out-of-band devices. Using Duo 2FA, when you log into a protected online account and enter your password you are asked to confirm who you are on a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A broad range of devices can be utilized for this added means of authentication such as an iPhone or Android or watch, a hardware token, a landline telephone, etc. You can designate several validation devices. For details about Duo identity authentication services, see Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Desk: Help Desk Managed Services
  Progent's Call Desk services allow your information technology group to offload Call Center services to Progent or split responsibilities for Help Desk services seamlessly between your internal support resources and Progent's nationwide pool of certified IT support engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a smooth extension of your internal network support team. User access to the Help Desk, delivery of technical assistance, issue escalation, ticket creation and updates, performance measurement, and management of the service database are cohesive whether incidents are resolved by your in-house network support group, by Progent, or both. Learn more about Progent's outsourced/shared Service Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that utilizes cutting edge behavior-based analysis tools to defend endpoints and servers and VMs against new malware attacks like ransomware and file-less exploits, which routinely evade legacy signature-matching AV products. Progent ASM services protect on-premises and cloud-based resources and provides a unified platform to automate the complete threat progression including filtering, identification, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, find and safeguard data related to your IT infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSLs or domains. By cleaning up and organizing your IT documentation, you can save up to half of time thrown away trying to find critical information about your network. ProSight IT Asset Management features a common repository for holding and sharing all documents related to managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT data. Whether you're making improvements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the information you require the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide organizations of all sizes a versatile and cost-effective alternative for evaluating, testing, scheduling, implementing, and documenting software and firmware updates to your ever-evolving information network. Besides maximizing the protection and reliability of your computer environment, Progent's patch management services permit your in-house IT team to concentrate on line-of-business initiatives and activities that deliver the highest business value from your network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host set up and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting service model, the client owns the data, the OS software, and the applications. Because the environment is virtualized, it can be moved easily to a different hosting solution without requiring a lengthy and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's next generation behavior-based analysis tools to guard physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which easily evade legacy signature-matching anti-virus products. ProSight ASM protects on-premises and cloud resources and offers a single platform to manage the entire threat lifecycle including blocking, detection, mitigation, cleanup, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services deliver economical in-depth security for physical and virtual servers, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced heuristics for round-the-clock monitoring and responding to security threats from all attack vectors. ProSight ESP delivers firewall protection, penetration alarms, endpoint control, and web filtering via cutting-edge tools incorporated within a single agent managed from a unified console. Progent's security and virtualization experts can help your business to plan and implement a ProSight ESP environment that meets your company's specific needs and that helps you achieve and demonstrate compliance with legal and industry data security standards. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that require immediate action. Progent's consultants can also help you to set up and test a backup and restore solution such as ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange filtering.