24-7 Winston-Salem Urgent CryptoLocker
Infection Damage Assessment and Recovery Consultants

Crypto-Ransomware : Your Worst Information Technology Disaster
Ransomware has become an escalating cyberplague that poses an existential threat for businesses of all sizes vulnerable to an assault. Multiple generations of crypto-ransomware like the Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been replicating for a long time and continue to inflict havoc. Recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with daily unnamed viruses, not only do encryption of on-line critical data but also infiltrate any configured system backup. Files synched to the cloud can also be corrupted. In a poorly designed environment, this can make any recovery useless and basically sets the datacenter back to zero.

Getting back applications and data after a ransomware attack becomes a race against time as the targeted business tries its best to contain the damage, remove the ransomware, and resume enterprise-critical operations. Because ransomware takes time to move laterally, penetrations are usually launched during weekends and nights, when penetrations in many cases take more time to notice. This multiplies the difficulty of quickly marshalling and orchestrating an experienced mitigation team.

Progent provides an assortment of solutions for securing organizations from crypto-ransomware events. These include staff training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of modern security appliances with artificial intelligence technology from SentinelOne to discover and suppress zero-day cyber attacks rapidly. Progent in addition offers the services of veteran ransomware recovery consultants with the skills and perseverance to reconstruct a breached system as soon as possible.

Progent's Crypto-Ransomware Restoration Support Services
Following a ransomware penetration, even paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will respond with the codes to decrypt any or all of your information. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their data after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to re-install the key elements of your Information Technology environment. Without the availability of essential information backups, this requires a wide range of skills, top notch team management, and the willingness to work 24x7 until the job is over.

For twenty years, Progent has made available professional IT services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with accounting and ERP applications. This breadth of experience provides Progent the capability to efficiently determine necessary systems and re-organize the remaining components of your Information Technology environment following a ransomware attack and configure them into a functioning system.

Progent's recovery group has powerful project management tools to coordinate the sophisticated restoration process. Progent appreciates the urgency of working swiftly and in concert with a customer's management and IT team members to assign priority to tasks and to get critical services back on-line as fast as humanly possible.

Case Study: A Successful Ransomware Intrusion Restoration
A client hired Progent after their network system was attacked by the Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean government sponsored cybercriminals, suspected of adopting technology leaked from America's NSA organization. Ryuk targets specific businesses with little or no ability to sustain operational disruption and is one of the most profitable iterations of ransomware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company located in the Chicago metro area with about 500 staff members. The Ryuk event had paralyzed all company operations and manufacturing capabilities. Most of the client's data protection had been on-line at the beginning of the intrusion and were destroyed. The client was evaluating paying the ransom (exceeding two hundred thousand dollars) and praying for good luck, but in the end engaged Progent.

Progent worked with the customer to quickly determine and assign priority to the key services that needed to be addressed in order to continue business functions:

• Active Directory
• Microsoft Exchange Email
• Accounting/MRP

Within two days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then charged ahead with rebuilding and hard drive recovery on critical applications. All Microsoft Exchange Server ties and attributes were intact, which accelerated the restore of Exchange. Progent was also able to collect non-encrypted OST data files (Outlook Email Offline Folder Files) on staff workstations to recover mail data. A not too old off-line backup of the businesses accounting/MRP software made them able to restore these required services back online for users. Although major work needed to be completed to recover fully from the Ryuk attack, core systems were restored quickly:

During the following few weeks important milestones in the restoration project were made through close cooperation between Progent consultants and the customer:

• Internal web sites were brought back up without losing any information.
• The MailStore Server containing more than 4 million historical emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control modules were completely recovered.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• 90% of the user PCs were being used by staff.

Conclusion
A probable business-killing catastrophe was evaded due to dedicated experts, a broad spectrum of IT skills, and tight teamwork. Although in analyzing the event afterwards the crypto-ransomware virus penetration detailed here could have been prevented with modern cyber security solutions and NIST Cybersecurity Framework best practices, team education, and well thought out incident response procedures for information protection and keeping systems up to date with security patches, the reality is that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware incursion, remember that Progent's roster of experts has a proven track record in ransomware virus defense, removal, and data recovery.

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide businesses in Winston-Salem a variety of remote monitoring and security assessment services to assist you to minimize the threat from ransomware. These services incorporate modern artificial intelligence technology to uncover new variants of ransomware that can escape detection by traditional signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve leading-edge IT resilience. Progent handles the daily monitoring and management for you, so your system expands smoothly without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT team can be your complete technology safety net. Entry-level plans include remote monitoring and management (RMM), security, automatic monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management techniques to keep your network operating efficiently by tracking the state of vital computers that drive your business network. When ProSight LAN Watch uncovers a problem, an alarm is transmitted automatically to your designated IT management staff and your Progent engineering consultant so any looming issues can be addressed before they can impact your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for monitoring and managing your network, server, and desktop devices by offering tools for performing common tedious jobs. These can include health checking, update management, automated remediation, endpoint setup, backup and recovery, A/V response, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alert to your specified IT management personnel and your Progent technical consultant so potential problems can be taken care of before they impact productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it simple and affordable for smaller organizations to map, track, reconfigure and debug their networking appliances such as switches, firewalls, and access points as well as servers, client computers and other devices. Incorporating cutting-edge RMM technology, WAN Watch ensures that network diagrams are kept updated, copies and manages the configuration information of almost all devices on your network, monitors performance, and generates notices when potential issues are detected. By automating tedious management and troubleshooting activities, WAN Watch can knock hours off ordinary chores such as making network diagrams, reconfiguring your network, locating appliances that require important software patches, or resolving performance problems. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of real-time management reporting plug-ins designed to integrate with the leading ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software providers to produce ProSight Data Protection Services, a portfolio of management outsourcing plans that deliver backup-as-a-service. ProSight DPS products automate and monitor your backup processes and allow non-disruptive backup and fast recovery of important files, apps, system images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss caused by hardware failures, natural calamities, fire, cyber attacks such as ransomware, user mistakes, malicious employees, or application glitches. Managed backup services available in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to determine which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of leading data security vendors to deliver centralized control and comprehensive protection for all your inbound and outbound email. The powerful architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with an on-premises gateway device to offer complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's Cloud Protection Layer acts as a preliminary barricade and blocks most threats from reaching your network firewall. This reduces your exposure to external threats and conserves system bandwidth and storage space. Email Guard's onsite security gateway appliance adds a deeper layer of inspection for inbound email. For outgoing email, the onsite gateway offers anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The local security gateway can also help Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends within your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA services utilize Cisco's Duo cloud technology to protect against stolen passwords through the use of two-factor authentication (2FA). Duo enables one-tap identity verification with iOS, Android, and other personal devices. Using Duo 2FA, when you log into a protected application and give your password you are asked to confirm your identity on a device that only you possess and that is accessed using a different ("out-of-band") network channel. A broad range of devices can be utilized as this added means of ID validation such as a smartphone or wearable, a hardware token, a landline telephone, etc. You can designate several validation devices. For details about ProSight Duo two-factor identity authentication services, go to Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Service Center: Help Desk Managed Services
  Progent's Call Desk services allow your IT staff to offload Help Desk services to Progent or divide activity for Service Desk support seamlessly between your in-house network support resources and Progent's extensive roster of certified IT service engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a transparent extension of your in-house network support group. End user interaction with the Help Desk, provision of technical assistance, issue escalation, trouble ticket creation and tracking, efficiency measurement, and management of the service database are cohesive whether issues are resolved by your corporate network support organization, by Progent, or by a combination. Learn more about Progent's outsourced/co-managed Help Desk services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes cutting edge behavior-based machine learning tools to defend endpoint devices as well as physical and virtual servers against new malware attacks like ransomware and email phishing, which routinely get by traditional signature-based anti-virus products. Progent Active Security Monitoring services safeguard local and cloud resources and offers a single platform to address the entire malware attack progression including blocking, infiltration detection, containment, remediation, and forensics. Key capabilities include one-click rollback using Windows VSS and real-time network-wide immunization against new threats. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and safeguard information about your IT infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates ,domains or warranties. By updating and organizing your network documentation, you can eliminate up to 50% of time wasted trying to find critical information about your IT network. ProSight IT Asset Management includes a centralized repository for storing and sharing all documents required for managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and associating IT information. Whether you're making improvements, doing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the information you need as soon as you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide organizations of any size a flexible and cost-effective solution for evaluating, testing, scheduling, applying, and documenting software and firmware updates to your dynamic IT system. In addition to optimizing the security and functionality of your computer environment, Progent's software/firmware update management services allow your in-house IT staff to concentrate on more strategic initiatives and tasks that deliver the highest business value from your information network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and apps hosted in a protected Tier III data center on a fast virtual machine host set up and maintained by Progent's network support experts. Under the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the applications. Because the system is virtualized, it can be moved easily to a different hosting environment without a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior analysis technology to guard physical and virtual endpoint devices against new malware attacks such as ransomware and file-less exploits, which easily get by legacy signature-matching AV products. ProSight Active Security Monitoring protects local and cloud-based resources and provides a single platform to manage the complete malware attack progression including blocking, infiltration detection, containment, cleanup, and forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer ultra-affordable in-depth protection for physical and virtual servers, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and modern behavior analysis for round-the-clock monitoring and responding to cyber assaults from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, endpoint control, and web filtering through leading-edge technologies packaged within a single agent accessible from a single control. Progent's security and virtualization consultants can assist your business to design and configure a ProSight ESP environment that meets your organization's specific needs and that allows you achieve and demonstrate compliance with government and industry information protection regulations. Progent will help you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that call for urgent action. Progent can also help you to install and verify a backup and restore solution like ProSight Data Protection Services so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange email filtering.