24-Hour San Mateo Immediate Crypto-Ransomware
Infection Damage Assessment and Restoration Services

Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that poses an existential threat for businesses of all sizes poorly prepared for an attack. Versions of ransomware like the Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been circulating for years and still cause havoc. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, as well as frequent as yet unnamed viruses, not only encrypt on-line files but also infect many available system restores and backups. Information synchronized to the cloud can also be encrypted. In a poorly designed data protection solution, this can render automatic recovery hopeless and basically knocks the network back to square one.

Retrieving applications and information following a crypto-ransomware intrusion becomes a race against the clock as the victim tries its best to stop lateral movement, remove the ransomware, and restore mission-critical operations. Since crypto-ransomware requires time to move laterally, assaults are frequently sprung during nights and weekends, when successful penetrations typically take more time to detect. This compounds the difficulty of rapidly assembling and coordinating a capable mitigation team.

Progent has a variety of support services for protecting businesses from ransomware events. These include team member education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of the latest generation security appliances with artificial intelligence capabilities from SentinelOne to discover and suppress day-zero cyber threats automatically. Progent also can provide the assistance of experienced crypto-ransomware recovery professionals with the talent and perseverance to rebuild a compromised system as soon as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a ransomware event, paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will respond with the needed codes to unencrypt all your data. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to setup from scratch the essential components of your Information Technology environment. Absent the availability of full information backups, this calls for a broad range of skills, well-coordinated project management, and the ability to work non-stop until the task is finished.

For decades, Progent has offered professional Information Technology services for companies across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have attained high-level certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial systems and ERP applications. This breadth of expertise affords Progent the capability to quickly identify necessary systems and re-organize the surviving components of your Information Technology system after a ransomware attack and rebuild them into an operational network.

Progent's recovery team of experts utilizes state-of-the-art project management applications to orchestrate the complex restoration process. Progent appreciates the urgency of acting swiftly and in unison with a customer's management and IT resources to prioritize tasks and to get critical applications back on-line as soon as possible.

Customer Story: A Successful Ransomware Intrusion Response
A customer sought out Progent after their network was taken over by the Ryuk crypto-ransomware. Ryuk is generally considered to have been created by Northern Korean government sponsored cybercriminals, possibly using technology exposed from the United States National Security Agency. Ryuk attacks specific organizations with little or no room for disruption and is one of the most profitable iterations of ransomware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in the Chicago metro area and has around 500 staff members. The Ryuk intrusion had disabled all essential operations and manufacturing processes. Most of the client's data protection had been on-line at the time of the attack and were destroyed. The client was taking steps for paying the ransom demand (exceeding $200,000) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked with the customer to rapidly understand and assign priority to the most important services that had to be recovered in order to restart departmental operations:

• Active Directory
• Microsoft Exchange Server
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then accomplished rebuilding and hard drive recovery on critical servers. All Exchange Server schema and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to collect intact OST data files (Microsoft Outlook Offline Folder Files) on user PCs and laptops to recover email messages. A not too old offline backup of the customer's accounting/MRP software made it possible to restore these required services back available to users. Although a large amount of work still had to be done to recover completely from the Ryuk virus, core services were returned to operations quickly:

Throughout the following few weeks critical milestones in the restoration process were accomplished through tight cooperation between Progent engineers and the customer:

• In-house web applications were restored without losing any data.
• The MailStore Microsoft Exchange Server containing more than 4 million archived messages was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory functions were 100% functional.
• A new Palo Alto 850 firewall was deployed.
• 90% of the user desktops were fully operational.

Conclusion
A possible business-killing catastrophe was avoided by hard-working experts, a broad range of subject matter expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration described here should have been prevented with modern cyber security systems and best practices, team training, and appropriate incident response procedures for backup and proper patching controls, the reality is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's roster of professionals has extensive experience in ransomware virus defense, cleanup, and information systems recovery.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers businesses in San Mateo a range of remote monitoring and security evaluation services to help you to reduce your vulnerability to crypto-ransomware. These services incorporate modern AI technology to detect zero-day variants of ransomware that are able to evade traditional signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent takes care of the necessary monitoring and management for you, so your network expands smoothly without holding you back. For a low and predictable monthly subscription, Progent's experienced IT group can be your complete technology safety net. Entry-level packages include remote monitoring and management (RMM), security, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management techniques to keep your IT system operating at peak levels by tracking the health of vital assets that drive your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your designated IT management staff and your Progent engineering consultant so all potential issues can be resolved before they can disrupt productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for managing your client-server infrastructure by offering an environment for performing common tedious jobs. These can include health monitoring, update management, automated remediation, endpoint configuration, backup and recovery, anti-virus response, remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alarm to your designated IT management personnel and your Progent technical consultant so potential problems can be taken care of before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized organizations to map, track, reconfigure and troubleshoot their connectivity hardware such as routers, firewalls, and wireless controllers as well as servers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that network diagrams are kept current, captures and manages the configuration of virtually all devices on your network, monitors performance, and generates alerts when potential issues are discovered. By automating complex management and troubleshooting activities, ProSight WAN Watch can cut hours off common tasks such as making network diagrams, expanding your network, finding appliances that require important updates, or resolving performance problems. Learn more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time and in-depth reporting utilities created to work with the top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues like inconsistent support follow-through or machines with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has partnered with advanced backup technology companies to produce ProSight Data Protection Services, a family of management offerings that deliver backup-as-a-service. ProSight DPS services manage and monitor your data backup operations and enable non-disruptive backup and rapid restoration of vital files/folders, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business recover from data loss resulting from hardware failures, natural calamities, fire, malware such as ransomware, human error, malicious insiders, or application glitches. Managed backup services available in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of top information security vendors to provide centralized control and comprehensive security for your inbound and outbound email. The powerful structure of Progent's Email Guard integrates cloud-based filtering with a local gateway device to offer complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne threats. The Cloud Protection Layer serves as a preliminary barricade and blocks most unwanted email from reaching your security perimeter. This decreases your exposure to external attacks and conserves system bandwidth and storage. Email Guard's on-premises security gateway device adds a further layer of inspection for inbound email. For outgoing email, the local gateway provides anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Exchange Server to monitor and protect internal email traffic that stays within your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo technology to protect against password theft through the use of two-factor authentication. Duo enables single-tap identity verification with iOS, Android, and other personal devices. With 2FA, when you log into a secured online account and enter your password you are requested to confirm your identity on a device that only you possess and that is accessed using a different network channel. A wide selection of devices can be used as this added means of ID validation including a smartphone or watch, a hardware token, a landline telephone, etc. You may designate multiple validation devices. To learn more about ProSight Duo identity validation services, go to Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Call Desk: Help Desk Managed Services
  Progent's Help Desk managed services permit your information technology staff to outsource Support Desk services to Progent or divide activity for support services transparently between your in-house network support team and Progent's nationwide roster of certified IT support technicians, engineers and subject matter experts. Progent's Shared Service Desk provides a smooth extension of your in-house IT support resources. Client access to the Help Desk, delivery of support, problem escalation, trouble ticket creation and updates, efficiency measurement, and management of the support database are cohesive whether incidents are taken care of by your in-house support staff, by Progent's team, or by a combination. Find out more about Progent's outsourced/shared Help Desk services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that utilizes next generation behavior machine learning tools to defend endpoints and physical and virtual servers against modern malware assaults like ransomware and file-less exploits, which routinely evade traditional signature-based anti-virus tools. Progent ASM services protect local and cloud-based resources and provides a unified platform to address the entire malware attack progression including filtering, identification, containment, remediation, and forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, find and protect data about your IT infrastructure, procedures, applications, and services. You can quickly locate passwords or serial numbers and be warned about impending expirations of SSLs or domains. By updating and organizing your network documentation, you can save as much as 50% of time wasted trying to find critical information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and collaborating on all documents required for managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're planning enhancements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the data you require the instant you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of all sizes a flexible and cost-effective alternative for evaluating, testing, scheduling, implementing, and documenting updates to your ever-evolving information network. Besides maximizing the protection and functionality of your IT network, Progent's patch management services allow your in-house IT team to focus on more strategic projects and tasks that derive the highest business value from your network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a protected fault tolerant data center on a high-performance virtual host configured and managed by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be ported immediately to a different hardware solution without requiring a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior machine learning technology to guard physical and virtual endpoints against new malware assaults like ransomware and email phishing, which routinely escape legacy signature-based anti-virus products. ProSight ASM protects local and cloud-based resources and provides a unified platform to manage the entire malware attack lifecycle including blocking, infiltration detection, containment, remediation, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection services deliver affordable in-depth security for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP uses contextual security and modern behavior analysis for continuously monitoring and reacting to cyber assaults from all vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, endpoint control, and web filtering through leading-edge technologies incorporated within one agent accessible from a single console. Progent's security and virtualization consultants can help you to design and configure a ProSight ESP environment that addresses your company's unique needs and that allows you demonstrate compliance with government and industry information protection standards. Progent will help you define and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that require immediate action. Progent's consultants can also assist you to install and verify a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover rapidly from a potentially disastrous cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange email filtering.