Scottsdale 24-7 Urgent Crypto
Malware Damage Assessment and Restoration Experts

Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become a modern cyber pandemic that presents an enterprise-level danger for businesses of all sizes vulnerable to an attack. Multiple generations of ransomware such as CryptoLocker, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to cause harm. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, as well as additional as yet unnamed viruses, not only do encryption of online data but also infect all available system protection mechanisms. Data synched to the cloud can also be corrupted. In a poorly designed data protection solution, this can make any restoration hopeless and basically knocks the network back to zero.

Getting back services and data following a crypto-ransomware outage becomes a race against time as the targeted organization fights to stop lateral movement, eradicate the virus, and resume mission-critical activity. Because ransomware requires time to move laterally, attacks are frequently sprung on weekends and holidays, when penetrations tend to take more time to detect. This multiplies the difficulty of promptly mobilizing and coordinating a qualified response team.

Progent has an assortment of support services for securing organizations from ransomware events. These include staff training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of the latest generation security solutions with machine learning capabilities from SentinelOne to discover and suppress zero-day cyber threats rapidly. Progent also provides the services of experienced crypto-ransomware recovery professionals with the talent and commitment to restore a compromised environment as urgently as possible.

Progent's Ransomware Recovery Support Services
Following a crypto-ransomware invasion, paying the ransom demands in cryptocurrency does not ensure that cyber hackers will return the needed keys to unencrypt any of your information. Kaspersky determined that seventeen percent of ransomware victims never restored their data after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to setup from scratch the vital components of your Information Technology environment. Without the availability of full system backups, this calls for a wide complement of skill sets, professional project management, and the ability to work 24x7 until the job is done.

For twenty years, Progent has made available expert IT services for businesses throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded advanced certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of expertise affords Progent the skills to quickly ascertain necessary systems and organize the surviving parts of your network system after a ransomware penetration and configure them into an operational network.

Progent's recovery group uses powerful project management applications to coordinate the complex restoration process. Progent knows the urgency of acting quickly and in unison with a client's management and Information Technology team members to prioritize tasks and to put essential services back on line as fast as possible.

Client Story: A Successful Ransomware Incident Restoration
A business engaged Progent after their network system was attacked by the Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean government sponsored cybercriminals, possibly using approaches leaked from the U.S. National Security Agency. Ryuk attacks specific organizations with little or no tolerance for operational disruption and is one of the most profitable incarnations of ransomware viruses. Major victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer located in the Chicago metro area and has around 500 staff members. The Ryuk intrusion had brought down all business operations and manufacturing capabilities. The majority of the client's backups had been online at the start of the intrusion and were damaged. The client was evaluating paying the ransom (in excess of $200,000) and wishfully thinking for good luck, but ultimately called Progent.

Progent worked with the client to quickly understand and assign priority to the essential areas that had to be addressed to make it possible to resume departmental operations:

• Microsoft Active Directory
• Exchange Server
• Financials/MRP

In less than 2 days, Progent was able to restore Active Directory services to its pre-attack state. Progent then accomplished setup and storage recovery on critical applications. All Exchange ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to find intact OST data files (Outlook Offline Folder Files) on team workstations and laptops to recover email data. A recent offline backup of the businesses accounting systems made them able to restore these vital applications back available to users. Although a lot of work remained to recover completely from the Ryuk attack, core systems were returned to operations quickly:

Throughout the following couple of weeks important milestones in the recovery project were completed through tight cooperation between Progent team members and the customer:

• In-house web sites were returned to operation with no loss of information.
• The MailStore Server with over four million archived messages was spun up and available for users.
• CRM/Product Ordering/Invoicing/AP/Accounts Receivables/Inventory functions were completely operational.
• A new Palo Alto Networks 850 security appliance was set up.
• Ninety percent of the desktop computers were fully operational.

Conclusion
A potential business-ending disaster was evaded by results-oriented experts, a wide range of knowledge, and tight teamwork. Although in retrospect the ransomware attack described here should have been identified and stopped with modern cyber security solutions and NIST Cybersecurity Framework best practices, user education, and appropriate security procedures for data protection and applying software patches, the fact is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware incident, feel confident that Progent's roster of experts has substantial experience in ransomware virus defense, cleanup, and file disaster recovery.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Scottsdale a portfolio of online monitoring and security assessment services to help you to reduce the threat from ransomware. These services utilize next-generation machine learning technology to uncover zero-day strains of ransomware that can evade traditional signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to create leading-edge IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your network scales smoothly without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Entry-level plans include remote monitoring and management, security, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management techniques to keep your network operating efficiently by checking the health of critical assets that drive your business network. When ProSight LAN Watch uncovers a problem, an alert is transmitted immediately to your specified IT management personnel and your Progent engineering consultant so any potential problems can be resolved before they have a chance to impact productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based solution for managing your network, server, and desktop devices by providing tools for performing common time-consuming jobs. These can include health checking, update management, automated repairs, endpoint setup, backup and recovery, anti-virus defense, remote access, built-in and custom scripts, asset inventory, endpoint profile reports, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alarm to your specified IT personnel and your assigned Progent technical consultant so emerging issues can be taken care of before they impact productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to diagram, monitor, enhance and debug their connectivity hardware such as switches, firewalls, and load balancers plus servers, printers, client computers and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that infrastructure topology diagrams are always updated, captures and displays the configuration of virtually all devices connected to your network, monitors performance, and generates notices when problems are detected. By automating time-consuming management processes, WAN Watch can cut hours off ordinary tasks such as network mapping, expanding your network, finding appliances that need important updates, or isolating performance issues. Learn more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time reporting tools designed to work with the top ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with advanced backup technology providers to produce ProSight Data Protection Services, a family of subscription-based offerings that provide backup-as-a-service (BaaS). ProSight DPS services manage and track your backup operations and allow non-disruptive backup and fast restoration of important files, apps, system images, plus VMs. ProSight DPS lets your business avoid data loss caused by equipment failures, natural disasters, fire, malware such as ransomware, human error, malicious employees, or software bugs. Managed backup services available in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the technology of top information security companies to deliver web-based management and comprehensive protection for all your email traffic. The hybrid structure of Email Guard integrates cloud-based filtering with an on-premises security gateway device to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The cloud filter acts as a first line of defense and blocks the vast majority of threats from reaching your network firewall. This decreases your exposure to inbound threats and conserves network bandwidth and storage. Email Guard's onsite gateway appliance adds a further layer of analysis for incoming email. For outgoing email, the on-premises security gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also assist Exchange Server to track and protect internal email that stays within your security perimeter. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication services incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication (2FA). Duo supports one-tap identity confirmation on Apple iOS, Android, and other personal devices. Using 2FA, when you log into a secured online account and enter your password you are asked to verify who you are on a unit that only you have and that is accessed using a separate network channel. A wide selection of devices can be utilized as this added form of ID validation such as a smartphone or watch, a hardware token, a landline phone, etc. You can designate several verification devices. For details about ProSight Duo identity validation services, go to Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Service Center: Support Desk Managed Services
  Progent's Help Center managed services enable your information technology team to outsource Call Center services to Progent or split activity for Help Desk services seamlessly between your in-house network support team and Progent's nationwide roster of IT service engineers and subject matter experts (SMEs). Progent's Shared Service Desk provides a seamless extension of your internal support group. End user interaction with the Help Desk, provision of support, escalation, trouble ticket creation and updates, efficiency measurement, and maintenance of the service database are consistent whether incidents are taken care of by your internal network support organization, by Progent, or a mix of the two. Find out more about Progent's outsourced/co-managed Service Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection solution that utilizes next generation behavior machine learning tools to defend endpoint devices as well as servers and VMs against new malware assaults like ransomware and file-less exploits, which easily evade traditional signature-based AV tools. Progent ASM services safeguard local and cloud resources and offers a unified platform to address the complete malware attack lifecycle including protection, detection, mitigation, cleanup, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, retrieve and protect data about your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSLs or domains. By updating and organizing your IT infrastructure documentation, you can save as much as half of time thrown away looking for critical information about your IT network. ProSight IT Asset Management includes a common location for storing and sharing all documents related to managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT information. Whether you're making improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the data you require the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of any size a versatile and cost-effective solution for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your dynamic IT network. In addition to maximizing the security and reliability of your computer environment, Progent's software/firmware update management services permit your in-house IT team to focus on more strategic projects and tasks that deliver maximum business value from your network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host configured and managed by Progent's network support professionals. With Progent's ProSight Virtual Hosting service model, the client owns the data, the OS platforms, and the apps. Because the system is virtualized, it can be ported easily to a different hosting solution without requiring a lengthy and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior-based analysis technology to guard physical and virtual endpoints against modern malware attacks like ransomware and email phishing, which easily escape legacy signature-matching AV tools. ProSight ASM protects local and cloud resources and provides a unified platform to manage the entire malware attack lifecycle including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Key features include one-click rollback with Windows VSS and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver affordable multi-layer protection for physical servers and VMs, workstations, mobile devices, and Exchange email. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, device control, and web filtering via cutting-edge technologies incorporated within a single agent accessible from a unified control. Progent's data protection and virtualization experts can assist you to design and configure a ProSight ESP environment that addresses your organization's specific needs and that allows you achieve and demonstrate compliance with government and industry data protection regulations. Progent will assist you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require immediate attention. Progent's consultants can also assist your company to set up and test a backup and restore solution such as ProSight Data Protection Services so you can recover rapidly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.