24/7 Edison Urgent Crypto-Ransomware
Virus Detection and Recovery Consultants

Ransomware : Your Worst IT Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for organizations vulnerable to an attack. Versions of crypto-ransomware like the Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been replicating for a long time and continue to cause havoc. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, plus frequent unnamed malware, not only do encryption of on-line data but also infect all available system backups. Information synched to off-site disaster recovery sites can also be ransomed. In a poorly architected system, it can render automated restore operations useless and effectively knocks the datacenter back to zero.

Getting back on-line applications and data following a crypto-ransomware intrusion becomes a race against the clock as the victim struggles to stop the spread, eradicate the crypto-ransomware, and resume business-critical activity. Because ransomware takes time to spread, assaults are frequently sprung during weekends and nights, when penetrations typically take longer to detect. This multiplies the difficulty of promptly mobilizing and coordinating a capable mitigation team.

Progent makes available a variety of support services for protecting businesses from ransomware events. Among these are user education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of the latest generation security solutions with artificial intelligence technology from SentinelOne to detect and suppress day-zero cyber threats rapidly. Progent also provides the services of veteran ransomware recovery professionals with the skills and commitment to reconstruct a compromised system as rapidly as possible.

Progent's Ransomware Recovery Support Services
After a crypto-ransomware event, sending the ransom demands in cryptocurrency does not guarantee that cyber hackers will return the needed codes to unencrypt any of your information. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The other path is to setup from scratch the essential parts of your IT environment. Without access to complete data backups, this calls for a wide range of skill sets, well-coordinated project management, and the ability to work continuously until the task is finished.

For two decades, Progent has provided expert IT services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded top certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial management and ERP application software. This breadth of expertise gives Progent the skills to efficiently determine important systems and integrate the remaining components of your computer network system following a ransomware attack and assemble them into a functioning system.

Progent's recovery team utilizes powerful project management applications to coordinate the sophisticated recovery process. Progent appreciates the urgency of working quickly and in concert with a client's management and Information Technology team members to assign priority to tasks and to get essential systems back on line as fast as possible.

Client Case Study: A Successful Ransomware Attack Response
A business escalated to Progent after their company was attacked by the Ryuk ransomware virus. Ryuk is believed to have been launched by Northern Korean state sponsored criminal gangs, suspected of adopting strategies exposed from America's NSA organization. Ryuk seeks specific businesses with little or no ability to sustain operational disruption and is among the most lucrative versions of ransomware malware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing company located in Chicago with around 500 workers. The Ryuk intrusion had frozen all company operations and manufacturing processes. The majority of the client's information backups had been on-line at the time of the attack and were encrypted. The client was evaluating paying the ransom demand (more than $200K) and praying for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the client to rapidly assess and assign priority to the critical systems that had to be recovered in order to restart company operations:

• Active Directory (AD)
• Microsoft Exchange
• Accounting/MRP

Within 2 days, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then helped perform rebuilding and hard drive recovery of critical systems. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to find intact OST data files (Microsoft Outlook Offline Folder Files) on various desktop computers to recover email messages. A recent offline backup of the customer's accounting/MRP software made them able to recover these vital programs back on-line. Although a lot of work needed to be completed to recover fully from the Ryuk virus, the most important services were recovered quickly:

Throughout the following couple of weeks important milestones in the restoration process were accomplished through tight cooperation between Progent team members and the client:

• Internal web applications were brought back up without losing any information.
• The MailStore Microsoft Exchange Server with over four million archived messages was brought online and available for users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory functions were 100% operational.
• A new Palo Alto 850 firewall was brought on-line.
• Most of the user desktops and notebooks were operational.

Conclusion
A probable enterprise-killing catastrophe was dodged through the efforts of dedicated experts, a broad range of IT skills, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware virus attack detailed here should have been identified and stopped with modern cyber security technology solutions and security best practices, user and IT administrator education, and well designed security procedures for information backup and proper patching controls, the fact remains that state-sponsored hackers from Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware virus, feel confident that Progent's roster of professionals has substantial experience in crypto-ransomware virus defense, removal, and data recovery.

To read or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Edison a range of online monitoring and security assessment services designed to assist you to minimize the threat from ransomware. These services include next-generation artificial intelligence capability to detect zero-day variants of ransomware that can get past legacy signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the necessary monitoring and management for you, so your network scales smoothly without holding you back. For an affordable and predictable monthly price, Progent's full-service IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management, security, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to advanced solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management (RMM) techniques to help keep your network operating at peak levels by checking the health of critical computers that drive your information system. When ProSight LAN Watch detects a problem, an alert is transmitted automatically to your specified IT personnel and your assigned Progent consultant so any potential issues can be resolved before they have a chance to impact your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based solution for monitoring and managing your network, server, and desktop devices by offering an environment for streamlining common time-consuming jobs. These can include health checking, patch management, automated remediation, endpoint configuration, backup and restore, anti-virus defense, secure remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alarm to your designated IT staff and your Progent consultant so emerging problems can be fixed before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to map out, track, optimize and troubleshoot their connectivity hardware like switches, firewalls, and wireless controllers as well as servers, printers, endpoints and other networked devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch ensures that network maps are kept current, copies and manages the configuration of almost all devices on your network, tracks performance, and sends alerts when problems are detected. By automating time-consuming management and troubleshooting activities, WAN Watch can knock hours off ordinary tasks like network mapping, reconfiguring your network, finding devices that require important updates, or identifying the cause of performance issues. Find out more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of in-depth reporting plug-ins designed to integrate with the industry's top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues like spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup software providers to create ProSight Data Protection Services (DPS), a portfolio of subscription-based offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup operations and enable transparent backup and rapid recovery of vital files/folders, apps, images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you recover from data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks such as ransomware, user error, ill-intentioned insiders, or application bugs. Managed backup services available in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of top information security companies to deliver web-based management and world-class protection for your inbound and outbound email. The powerful architecture of Progent's Email Guard combines a Cloud Protection Layer with an on-premises gateway appliance to provide complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The cloud filter serves as a preliminary barricade and blocks the vast majority of threats from reaching your security perimeter. This decreases your exposure to inbound threats and saves network bandwidth and storage space. Email Guard's onsite gateway appliance provides a deeper level of analysis for inbound email. For outgoing email, the local security gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also assist Microsoft Exchange Server to track and safeguard internal email traffic that originates and ends within your security perimeter. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA services utilize Cisco's Duo cloud technology to protect against password theft through the use of two-factor authentication (2FA). Duo supports single-tap identity verification with Apple iOS, Google Android, and other personal devices. With Duo 2FA, when you sign into a secured online account and enter your password you are asked to verify your identity via a unit that only you have and that is accessed using a separate network channel. A broad selection of devices can be utilized for this second means of authentication including an iPhone or Android or watch, a hardware token, a landline phone, etc. You can register multiple verification devices. To find out more about ProSight Duo two-factor identity validation services, visit Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Service Center: Support Desk Managed Services
  Progent's Support Desk services permit your information technology group to offload Support Desk services to Progent or divide activity for Help Desk services seamlessly between your in-house support group and Progent's extensive roster of certified IT service engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service offers a transparent supplement to your internal support group. Client access to the Service Desk, delivery of technical assistance, escalation, ticket generation and updates, efficiency metrics, and maintenance of the support database are consistent whether incidents are taken care of by your core IT support resources, by Progent's team, or by a combination. Find out more about Progent's outsourced/shared Help Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection solution that utilizes next generation behavior-based machine learning tools to guard endpoint devices and physical and virtual servers against new malware attacks such as ransomware and file-less exploits, which routinely get by legacy signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and offers a unified platform to automate the entire malware attack progression including blocking, identification, containment, cleanup, and forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, find and protect information related to your IT infrastructure, procedures, business apps, and services. You can quickly locate passwords or IP addresses and be warned about upcoming expirations of SSLs ,domains or warranties. By updating and organizing your network documentation, you can eliminate as much as half of time spent looking for vital information about your IT network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents related to managing your network infrastructure such as standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT data. Whether you're making improvements, performing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need when you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a versatile and cost-effective alternative for evaluating, testing, scheduling, applying, and documenting updates to your dynamic information network. Besides optimizing the security and functionality of your IT environment, Progent's software/firmware update management services free up time for your IT staff to concentrate on line-of-business projects and activities that derive maximum business value from your information network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual host configured and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the operating system software, and the apps. Because the environment is virtualized, it can be ported easily to a different hosting solution without requiring a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior analysis technology to defend physical and virtual endpoints against modern malware attacks like ransomware and email phishing, which routinely get by legacy signature-based AV tools. ProSight Active Security Monitoring protects local and cloud-based resources and offers a unified platform to manage the complete threat lifecycle including filtering, infiltration detection, containment, remediation, and forensics. Key features include single-click rollback using Windows VSS and automatic system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services deliver economical in-depth security for physical servers and virtual machines, workstations, smartphones, and Exchange email. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and reacting to security threats from all vectors. ProSight ESP offers two-way firewall protection, penetration alerts, endpoint management, and web filtering via cutting-edge technologies packaged within a single agent managed from a unified console. Progent's security and virtualization consultants can help you to plan and implement a ProSight ESP environment that addresses your company's unique needs and that allows you achieve and demonstrate compliance with legal and industry data security regulations. Progent will assist you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that call for urgent action. Progent's consultants can also assist you to install and verify a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange email filtering.