24/7 Manhattan Beach Critical Ransomware
Malware Assessment and Repair Experts

Ransomware : Your Worst IT Nightmare
Ransomware has become a modern cyber pandemic that presents an extinction-level threat for businesses unprepared for an assault. Multiple generations of ransomware like the CrySIS, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for many years and continue to inflict damage. The latest variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, as well as daily as yet unnamed viruses, not only do encryption of online data but also infiltrate many configured system restores and backups. Files synchronized to the cloud can also be corrupted. In a vulnerable environment, this can render automated restore operations impossible and effectively knocks the entire system back to square one.

Getting back applications and information after a ransomware event becomes a sprint against the clock as the targeted business struggles to contain the damage, clear the ransomware, and resume mission-critical activity. Due to the fact that ransomware requires time to replicate, attacks are usually launched on weekends and holidays, when penetrations may take more time to recognize. This compounds the difficulty of rapidly marshalling and orchestrating a knowledgeable mitigation team.

Progent provides a range of help services for securing enterprises from crypto-ransomware penetrations. Among these are staff education to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of modern security appliances with machine learning capabilities from SentinelOne to discover and extinguish day-zero cyber attacks automatically. Progent in addition can provide the assistance of expert ransomware recovery professionals with the talent and commitment to rebuild a compromised network as rapidly as possible.

Progent's Ransomware Restoration Support Services
Soon after a ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that criminal gangs will respond with the needed keys to decipher any of your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their files even after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to re-install the mission-critical components of your IT environment. Absent the availability of essential system backups, this calls for a wide complement of skills, well-coordinated project management, and the capability to work 24x7 until the recovery project is complete.

For twenty years, Progent has provided certified expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned high-level certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial management and ERP applications. This breadth of experience affords Progent the skills to rapidly understand important systems and organize the remaining components of your network system after a crypto-ransomware event and assemble them into a functioning network.

Progent's security team utilizes powerful project management tools to orchestrate the sophisticated restoration process. Progent appreciates the importance of acting rapidly and in concert with a client's management and Information Technology team members to assign priority to tasks and to get the most important services back on line as soon as possible.

Customer Case Study: A Successful Ransomware Virus Response
A customer engaged Progent after their network was taken over by the Ryuk ransomware. Ryuk is thought to have been created by North Korean state hackers, possibly using techniques exposed from the United States NSA organization. Ryuk goes after specific businesses with little or no tolerance for disruption and is among the most lucrative versions of ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer based in Chicago with around 500 workers. The Ryuk event had shut down all company operations and manufacturing processes. Most of the client's backups had been directly accessible at the time of the intrusion and were damaged. The client was actively seeking loans for paying the ransom (in excess of $200,000) and wishfully thinking for good luck, but in the end brought in Progent.

Progent worked together with the client to rapidly assess and prioritize the mission critical elements that needed to be recovered to make it possible to resume company functions:

• Windows Active Directory
• Electronic Messaging
• Accounting/MRP

In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then initiated rebuilding and hard drive recovery on needed systems. All Microsoft Exchange Server schema and configuration information were intact, which accelerated the restore of Exchange. Progent was able to collect intact OST files (Outlook Email Off-Line Folder Files) on various workstations and laptops to recover email messages. A recent off-line backup of the customer's accounting/ERP systems made it possible to return these required applications back on-line. Although major work remained to recover totally from the Ryuk damage, essential services were recovered quickly:

Over the next couple of weeks key milestones in the recovery project were completed in close cooperation between Progent consultants and the client:

• Self-hosted web sites were brought back up without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million historical messages was spun up and available for users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control functions were 100% restored.
• A new Palo Alto 850 firewall was brought online.
• Ninety percent of the desktop computers were functioning as before the incident.

Conclusion
A likely enterprise-killing catastrophe was dodged due to dedicated professionals, a broad range of knowledge, and close teamwork. Although upon completion of forensics the ransomware virus penetration described here should have been identified and stopped with up-to-date security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and properly executed incident response procedures for information backup and applying software patches, the reality remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware incident, remember that Progent's roster of professionals has proven experience in ransomware virus blocking, remediation, and information systems recovery.

To review or download a PDF version of this customer story, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Manhattan Beach a portfolio of remote monitoring and security evaluation services to help you to reduce your vulnerability to crypto-ransomware. These services utilize next-generation artificial intelligence technology to detect zero-day strains of crypto-ransomware that are able to escape detection by traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to create leading-edge IT resilience. Progent handles the daily monitoring and maintenance for you, so your network expands easily without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT team can be your complete technology safety net. Entry-level packages include remote monitoring and management, security, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management technology to help keep your IT system running efficiently by tracking the health of vital computers that drive your business network. When ProSight LAN Watch detects an issue, an alert is sent automatically to your designated IT management staff and your Progent consultant so that all potential issues can be resolved before they can disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for managing your network, server, and desktop devices by providing an environment for streamlining common time-consuming jobs. These include health monitoring, update management, automated remediation, endpoint setup, backup and restore, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it transmits an alert to your designated IT personnel and your assigned Progent technical consultant so that emerging problems can be taken care of before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to map out, monitor, enhance and debug their connectivity appliances such as routers, firewalls, and access points plus servers, printers, client computers and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network diagrams are kept current, copies and manages the configuration of virtually all devices on your network, monitors performance, and sends notices when issues are detected. By automating tedious management and troubleshooting activities, WAN Watch can knock hours off common chores like network mapping, expanding your network, locating appliances that need important software patches, or isolating performance problems. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time and in-depth management reporting tools created to work with the leading ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize critical issues like inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with leading backup software providers to produce ProSight Data Protection Services, a family of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and track your backup operations and allow non-disruptive backup and fast restoration of critical files/folders, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business protect against data loss caused by equipment failures, natural calamities, fire, malware such as ransomware, human error, malicious insiders, or application bugs. Managed backup services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to identify which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of top information security companies to provide web-based management and world-class security for all your inbound and outbound email. The powerful architecture of Email Guard combines cloud-based filtering with an on-premises security gateway appliance to provide complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based malware. The cloud filter serves as a first line of defense and keeps most threats from reaching your network firewall. This reduces your vulnerability to inbound threats and conserves system bandwidth and storage space. Email Guard's on-premises gateway device provides a further level of inspection for incoming email. For outbound email, the onsite security gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local gateway can also assist Microsoft Exchange Server to track and protect internal email traffic that stays within your corporate firewall. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA services incorporate Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication. Duo enables one-tap identity verification with iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you log into a protected online account and enter your password you are requested to verify your identity via a unit that only you have and that uses a separate network channel. A wide range of out-of-band devices can be utilized for this added means of ID validation such as a smartphone or wearable, a hardware/software token, a landline phone, etc. You can designate multiple verification devices. To find out more about ProSight Duo two-factor identity validation services, visit Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Service Center: Call Center Managed Services
  Progent's Support Desk services permit your IT staff to outsource Call Center services to Progent or split activity for Service Desk support seamlessly between your internal support staff and Progent's nationwide roster of certified IT support engineers and subject matter experts. Progent's Shared Help Desk Service provides a smooth supplement to your internal IT support organization. End user interaction with the Service Desk, delivery of support services, issue escalation, ticket generation and tracking, performance measurement, and maintenance of the support database are consistent whether issues are taken care of by your core support organization, by Progent's team, or both. Learn more about Progent's outsourced/co-managed Call Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates next generation behavior-based machine learning tools to defend endpoint devices as well as servers and VMs against modern malware assaults like ransomware and email phishing, which easily escape traditional signature-matching anti-virus tools. Progent ASM services safeguard local and cloud-based resources and offers a unified platform to manage the entire malware attack lifecycle including filtering, detection, mitigation, cleanup, and forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered attacks. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, retrieve and safeguard data about your IT infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be alerted about upcoming expirations of SSLs or warranties. By cleaning up and managing your network documentation, you can eliminate up to 50% of time wasted looking for vital information about your network. ProSight IT Asset Management features a centralized location for holding and collaborating on all documents related to managing your business network like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports advanced automation for gathering and relating IT information. Whether you're making enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you require the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management offer organizations of any size a flexible and affordable alternative for assessing, validating, scheduling, implementing, and tracking software and firmware updates to your dynamic information system. Besides optimizing the security and reliability of your IT environment, Progent's patch management services allow your in-house IT team to focus on line-of-business initiatives and tasks that deliver maximum business value from your information network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a protected Tier III data center on a fast virtual machine host set up and maintained by Progent's IT support professionals. Under the ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the apps. Since the system is virtualized, it can be ported easily to an alternate hardware environment without requiring a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that incorporates SentinelOne's cutting edge behavior machine learning technology to defend physical and virtual endpoint devices against modern malware attacks like ransomware and email phishing, which routinely escape traditional signature-matching anti-virus products. ProSight Active Security Monitoring safeguards local and cloud-based resources and provides a single platform to address the complete threat progression including protection, detection, mitigation, cleanup, and forensics. Top features include one-click rollback using Windows VSS and automatic system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection services deliver economical multi-layer protection for physical servers and virtual machines, desktops, smartphones, and Exchange Server. ProSight ESP utilizes contextual security and advanced heuristics for continuously monitoring and reacting to security assaults from all attack vectors. ProSight ESP offers firewall protection, penetration alerts, endpoint management, and web filtering through cutting-edge technologies incorporated within one agent accessible from a unified console. Progent's data protection and virtualization experts can assist you to design and configure a ProSight ESP environment that meets your company's unique needs and that helps you prove compliance with government and industry data protection regulations. Progent will help you define and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that require immediate attention. Progent can also assist your company to set up and test a backup and restore system such as ProSight Data Protection Services so you can get back in business rapidly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange email filtering.