Belo Horizonte 24/7 Emergency Ransomware
Computer Malware Damage Assessment and Recovery Consulting

Ransomware : Your Worst IT Catastrophe
Ransomware has become a too-frequent cyber pandemic that represents an existential threat for organizations unprepared for an assault. Different versions of crypto-ransomware such as Reveton, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for years and continue to inflict havoc. Modern variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, as well as frequent unnamed newcomers, not only do encryption of online data but also infiltrate all available system restores and backups. Information synchronized to cloud environments can also be held hostage. In a vulnerable system, this can render automated recovery useless and basically sets the network back to square one.

Getting back services and data following a ransomware intrusion becomes a sprint against time as the targeted business tries its best to stop lateral movement, remove the virus, and restore mission-critical activity. Because crypto-ransomware takes time to spread, attacks are usually launched at night, when attacks typically take more time to uncover. This compounds the difficulty of promptly assembling and organizing a qualified mitigation team.

Progent makes available an assortment of help services for protecting enterprises from crypto-ransomware penetrations. Among these are staff education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus installation of next-generation security solutions with artificial intelligence technology from SentinelOne to identify and quarantine zero-day cyber attacks intelligently. Progent in addition can provide the assistance of veteran ransomware recovery professionals with the talent and perseverance to restore a compromised system as quickly as possible.

Progent's Ransomware Recovery Support Services
Soon after a ransomware penetration, paying the ransom in cryptocurrency does not guarantee that cyber hackers will return the needed codes to decrypt any of your data. Kaspersky estimated that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to setup from scratch the vital components of your Information Technology environment. Absent access to essential system backups, this requires a wide complement of IT skills, top notch team management, and the ability to work continuously until the task is completed.

For two decades, Progent has provided professional IT services for companies across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial management and ERP application software. This breadth of expertise gives Progent the capability to efficiently understand critical systems and organize the remaining pieces of your IT environment following a crypto-ransomware penetration and configure them into a functioning network.

Progent's recovery team of experts uses best of breed project management tools to coordinate the sophisticated restoration process. Progent appreciates the urgency of working quickly and in concert with a customer's management and Information Technology staff to assign priority to tasks and to get key systems back online as soon as possible.

Customer Case Study: A Successful Ransomware Attack Recovery
A small business escalated to Progent after their company was crashed by Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean state hackers, suspected of using strategies leaked from the United States National Security Agency. Ryuk seeks specific businesses with limited ability to sustain disruption and is among the most profitable iterations of crypto-ransomware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company located in the Chicago metro area and has around 500 staff members. The Ryuk intrusion had frozen all essential operations and manufacturing processes. The majority of the client's system backups had been online at the start of the intrusion and were destroyed. The client considered paying the ransom (more than two hundred thousand dollars) and praying for good luck, but ultimately utilized Progent.

Progent worked with the client to rapidly identify and prioritize the key systems that needed to be recovered to make it possible to restart company functions:

• Windows Active Directory
• Electronic Messaging
• MRP System

In less than 2 days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then performed rebuilding and storage recovery on key systems. All Microsoft Exchange Server schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to find non-encrypted OST files (Microsoft Outlook Offline Data Files) on user workstations in order to recover email information. A recent offline backup of the businesses accounting software made them able to restore these essential programs back online. Although significant work was left to recover completely from the Ryuk damage, the most important services were returned to operations rapidly:

Over the following month key milestones in the restoration process were made through tight cooperation between Progent team members and the client:

• In-house web sites were restored with no loss of information.
• The MailStore Exchange Server exceeding 4 million historical emails was spun up and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory functions were completely restored.
• A new Palo Alto 850 security appliance was installed.
• Ninety percent of the desktops and laptops were back into operation.

Conclusion
A likely business-ending disaster was avoided due to dedicated experts, a wide array of subject matter expertise, and close teamwork. Although upon completion of forensics the ransomware virus penetration described here should have been stopped with up-to-date cyber security systems and NIST Cybersecurity Framework best practices, team education, and properly executed incident response procedures for information backup and proper patching controls, the fact is that state-sponsored cyber criminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware virus, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, mitigation, and information systems disaster recovery.

To read or download a PDF version of this customer case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Belo Horizonte a range of remote monitoring and security evaluation services designed to assist you to reduce your vulnerability to ransomware. These services utilize next-generation AI capability to detect new strains of ransomware that are able to get past legacy signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the necessary monitoring and management for you, so your system scales smoothly without holding you back. For a low and predictable monthly subscription, Progent's experienced IT group can be your complete technology safety net. Entry-level plans include remote monitoring and management, security, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) technology to keep your network operating at peak levels by tracking the health of critical assets that power your business network. When ProSight LAN Watch detects an issue, an alert is transmitted immediately to your specified IT management personnel and your Progent engineering consultant so all looming problems can be resolved before they can disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for monitoring and managing your network, server, and desktop devices by providing an environment for streamlining common time-consuming tasks. These can include health monitoring, patch management, automated repairs, endpoint setup, backup and recovery, A/V defense, secure remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alarm to your specified IT management staff and your assigned Progent consultant so that potential problems can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it simple and affordable for small and mid-sized businesses to map, track, optimize and troubleshoot their connectivity appliances such as routers and switches, firewalls, and load balancers plus servers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network maps are kept updated, captures and manages the configuration information of virtually all devices on your network, tracks performance, and generates alerts when issues are discovered. By automating time-consuming management and troubleshooting processes, WAN Watch can knock hours off ordinary tasks such as network mapping, reconfiguring your network, finding appliances that require important software patches, or isolating performance bottlenecks. Find out more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of real-time and in-depth reporting plug-ins created to integrate with the leading ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-through or machines with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software providers to produce ProSight Data Protection Services, a selection of management offerings that provide backup-as-a-service (BaaS). ProSight DPS products automate and monitor your backup processes and allow non-disruptive backup and rapid restoration of vital files/folders, applications, images, plus VMs. ProSight DPS lets your business avoid data loss caused by equipment breakdown, natural calamities, fire, malware like ransomware, human error, malicious employees, or software bugs. Managed services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of top data security vendors to provide centralized management and world-class security for your email traffic. The hybrid structure of Progent's Email Guard combines cloud-based filtering with an on-premises gateway device to provide complete defense against spam, viruses, Dos Attacks, DHAs, and other email-based threats. The cloud filter serves as a preliminary barricade and blocks most unwanted email from reaching your network firewall. This decreases your vulnerability to inbound attacks and conserves network bandwidth and storage. Email Guard's onsite gateway appliance adds a further level of inspection for inbound email. For outgoing email, the local security gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local gateway can also help Microsoft Exchange Server to track and safeguard internal email that stays inside your security perimeter. For more information, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo technology to protect against password theft through the use of two-factor authentication. Duo supports single-tap identity verification with Apple iOS, Android, and other out-of-band devices. Using Duo 2FA, when you sign into a protected application and give your password you are asked to verify who you are on a device that only you have and that uses a different network channel. A broad selection of devices can be used as this second means of authentication such as an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You may register several verification devices. To learn more about Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Call Center services allow your information technology staff to offload Help Desk services to Progent or split activity for Service Desk support seamlessly between your in-house support staff and Progent's nationwide roster of certified IT support engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a transparent extension of your in-house IT support group. Client interaction with the Service Desk, provision of support services, problem escalation, ticket creation and tracking, efficiency measurement, and maintenance of the support database are cohesive whether incidents are resolved by your in-house support resources, by Progent's team, or a mix of the two. Read more about Progent's outsourced/shared Service Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior-based machine learning technology to defend endpoint devices and physical and virtual servers against new malware attacks such as ransomware and file-less exploits, which easily escape traditional signature-matching AV tools. Progent Active Security Monitoring services safeguard local and cloud resources and offers a single platform to automate the entire malware attack progression including protection, infiltration detection, containment, remediation, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, find and protect data related to your IT infrastructure, procedures, applications, and services. You can quickly find passwords or IP addresses and be warned about impending expirations of SSLs or domains. By updating and organizing your IT infrastructure documentation, you can eliminate as much as 50% of time wasted looking for vital information about your network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents related to managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and relating IT data. Whether you're making enhancements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you require as soon as you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer organizations of all sizes a flexible and cost-effective solution for evaluating, validating, scheduling, applying, and documenting updates to your dynamic information network. In addition to maximizing the security and reliability of your IT environment, Progent's patch management services allow your in-house IT staff to focus on line-of-business projects and tasks that derive maximum business value from your information network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual host set up and managed by Progent's network support experts. Under the ProSight Virtual Hosting model, the client owns the data, the operating system software, and the applications. Since the system is virtualized, it can be moved immediately to a different hardware solution without a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior-based machine learning tools to defend physical and virtual endpoints against modern malware assaults such as ransomware and email phishing, which routinely evade traditional signature-matching anti-virus tools. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a single platform to address the entire threat progression including protection, detection, containment, remediation, and post-attack forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable multi-layer protection for physical servers and VMs, desktops, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and reacting to cyber threats from all attack vectors. ProSight ESP offers firewall protection, intrusion alarms, endpoint management, and web filtering via leading-edge tools incorporated within one agent managed from a single control. Progent's data protection and virtualization experts can assist you to design and implement a ProSight ESP deployment that meets your organization's specific requirements and that helps you prove compliance with legal and industry data protection regulations. Progent will assist you specify and configure policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that call for immediate attention. Progent can also assist your company to install and test a backup and restore system like ProSight Data Protection Services (DPS) so you can get back in business rapidly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange email filtering.