Wilmington 24-7 Critical Ransomware
Computer Malware Damage Assessment and Recovery Consulting

Crypto-Ransomware : Your Feared IT Nightmare
Ransomware has become a too-frequent cyber pandemic that presents an existential threat for organizations vulnerable to an attack. Versions of crypto-ransomware like the CrySIS, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for many years and continue to inflict destruction. The latest versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, along with daily as yet unnamed newcomers, not only encrypt on-line data but also infiltrate many configured system protection. Data synched to cloud environments can also be encrypted. In a poorly designed environment, it can make any restoration impossible and basically knocks the datacenter back to zero.

Retrieving programs and data after a crypto-ransomware attack becomes a sprint against time as the targeted business fights to stop lateral movement, cleanup the ransomware, and resume mission-critical operations. Because ransomware needs time to replicate, penetrations are usually sprung on weekends, when successful attacks tend to take more time to discover. This compounds the difficulty of quickly mobilizing and orchestrating a qualified response team.

Progent has a variety of help services for securing businesses from ransomware events. Among these are team training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with installation of the latest generation security appliances with machine learning technology from SentinelOne to identify and suppress day-zero cyber threats automatically. Progent also offers the services of expert ransomware recovery engineers with the skills and commitment to reconstruct a breached system as quickly as possible.

Progent's Ransomware Recovery Services
Soon after a ransomware penetration, paying the ransom in cryptocurrency does not ensure that criminal gangs will return the keys to decipher any of your files. Kaspersky ascertained that seventeen percent of ransomware victims never restored their files after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The fallback is to setup from scratch the essential components of your IT environment. Without the availability of essential information backups, this requires a broad range of skill sets, professional project management, and the capability to work non-stop until the job is complete.

For twenty years, Progent has offered expert Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have been awarded top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in accounting and ERP application software. This breadth of experience gives Progent the capability to efficiently understand necessary systems and integrate the surviving pieces of your IT environment following a crypto-ransomware penetration and rebuild them into a functioning network.

Progent's security team of experts uses best of breed project management applications to coordinate the complex recovery process. Progent knows the importance of acting swiftly and in concert with a client's management and Information Technology team members to assign priority to tasks and to put key services back on-line as fast as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Virus Response
A small business sought out Progent after their organization was attacked by the Ryuk ransomware. Ryuk is believed to have been created by North Korean state criminal gangs, possibly adopting strategies exposed from America's National Security Agency. Ryuk seeks specific businesses with little room for disruption and is among the most profitable incarnations of crypto-ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in the Chicago metro area and has about 500 employees. The Ryuk attack had disabled all business operations and manufacturing processes. Most of the client's data protection had been directly accessible at the time of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom (in excess of two hundred thousand dollars) and wishfully thinking for the best, but in the end made the decision to use Progent.

Progent worked hand in hand the customer to rapidly determine and prioritize the key elements that needed to be recovered to make it possible to continue departmental functions:

• Microsoft Active Directory
• Microsoft Exchange
• Financials/MRP

Within 2 days, Progent was able to rebuild Active Directory to its pre-penetration state. Progent then performed rebuilding and hard drive recovery of key applications. All Exchange data and attributes were usable, which greatly helped the restore of Exchange. Progent was able to find intact OST files (Microsoft Outlook Off-Line Data Files) on various workstations and laptops in order to recover mail data. A not too old offline backup of the customer's accounting systems made it possible to return these essential programs back available to users. Although significant work needed to be completed to recover fully from the Ryuk virus, core systems were recovered quickly:

During the next few weeks key milestones in the restoration process were accomplished in tight collaboration between Progent consultants and the customer:

• Self-hosted web applications were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million historical emails was restored to operations and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control functions were 100 percent restored.
• A new Palo Alto 850 firewall was installed.
• Most of the user desktops were fully operational.

Conclusion
A probable business-ending disaster was avoided with results-oriented experts, a broad array of subject matter expertise, and close collaboration. Although in hindsight the ransomware virus penetration described here should have been identified and prevented with current cyber security solutions and NIST Cybersecurity Framework best practices, user training, and well designed incident response procedures for information backup and applying software patches, the reality remains that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware attack, remember that Progent's roster of experts has extensive experience in ransomware virus blocking, mitigation, and file recovery.

To review or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Wilmington a variety of remote monitoring and security evaluation services to assist you to reduce your vulnerability to crypto-ransomware. These services utilize modern AI capability to detect zero-day strains of crypto-ransomware that are able to escape detection by legacy signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent takes care of the necessary monitoring and maintenance for you, so your network expands readily without holding you back. For an affordable and predictable monthly price, Progent's full-service IT group can be your complete technology safety net. Entry-level plans include RMM, security, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to advanced options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management technology to keep your network operating at peak levels by checking the state of critical computers that drive your business network. When ProSight LAN Watch detects a problem, an alert is sent immediately to your specified IT staff and your Progent engineering consultant so any potential problems can be resolved before they can impact productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for managing your network, server, and desktop devices by providing an environment for performing common tedious jobs. These can include health checking, patch management, automated remediation, endpoint configuration, backup and restore, anti-virus defense, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and debugging help. If ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alert to your specified IT management staff and your assigned Progent consultant so that emerging issues can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and affordable for smaller businesses to map, track, reconfigure and debug their connectivity appliances such as routers and switches, firewalls, and load balancers plus servers, printers, client computers and other devices. Incorporating state-of-the-art RMM technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are kept updated, copies and manages the configuration of virtually all devices connected to your network, monitors performance, and generates notices when problems are discovered. By automating complex management and troubleshooting processes, ProSight WAN Watch can cut hours off ordinary chores such as network mapping, expanding your network, locating appliances that require critical software patches, or isolating performance issues. Find out more details about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time and in-depth management reporting plug-ins created to work with the leading ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize key issues like inconsistent support follow-through or machines with out-of-date AVs. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with advanced backup technology providers to produce ProSight Data Protection Services, a portfolio of management offerings that deliver backup-as-a-service. ProSight DPS products automate and track your backup operations and enable non-disruptive backup and rapid restoration of critical files/folders, applications, system images, plus virtual machines. ProSight DPS helps your business avoid data loss caused by equipment failures, natural calamities, fire, malware like ransomware, human error, malicious employees, or software bugs. Managed backup services in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of leading information security vendors to deliver centralized control and comprehensive protection for all your email traffic. The powerful structure of Progent's Email Guard managed service integrates cloud-based filtering with a local gateway device to offer advanced protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The cloud filter serves as a preliminary barricade and blocks most threats from reaching your security perimeter. This decreases your exposure to external threats and saves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a further level of analysis for inbound email. For outgoing email, the onsite security gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The onsite security gateway can also help Microsoft Exchange Server to monitor and protect internal email traffic that originates and ends inside your corporate firewall. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication services incorporate Cisco's Duo technology to protect against stolen passwords through the use of two-factor authentication (2FA). Duo supports single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. With Duo 2FA, whenever you log into a secured online account and enter your password you are requested to confirm who you are via a unit that only you possess and that is accessed using a different network channel. A broad selection of devices can be utilized for this second means of authentication including an iPhone or Android or watch, a hardware token, a landline telephone, etc. You may register several validation devices. To find out more about ProSight Duo two-factor identity validation services, refer to Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Desk: Support Desk Managed Services
  Progent's Call Desk services permit your information technology team to offload Call Center services to Progent or split responsibilities for Service Desk support seamlessly between your internal support group and Progent's extensive roster of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a transparent extension of your internal IT support group. User access to the Service Desk, delivery of technical assistance, problem escalation, ticket generation and updates, efficiency measurement, and maintenance of the support database are consistent regardless of whether incidents are resolved by your internal network support organization, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates cutting edge behavior analysis tools to defend endpoint devices as well as servers and VMs against modern malware attacks such as ransomware and email phishing, which routinely evade legacy signature-matching AV tools. Progent ASM services protect on-premises and cloud-based resources and provides a single platform to manage the entire threat progression including blocking, identification, containment, remediation, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, retrieve and safeguard information related to your network infrastructure, processes, business apps, and services. You can quickly find passwords or serial numbers and be warned about impending expirations of SSL certificates or domains. By cleaning up and organizing your IT infrastructure documentation, you can eliminate as much as half of time wasted looking for critical information about your IT network. ProSight IT Asset Management includes a common repository for storing and sharing all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT information. Whether you're planning improvements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the information you require the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide organizations of any size a flexible and affordable solution for assessing, validating, scheduling, implementing, and tracking updates to your ever-evolving information system. In addition to maximizing the protection and functionality of your computer network, Progent's software/firmware update management services free up time for your IT staff to focus on line-of-business initiatives and activities that derive maximum business value from your network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a protected fault tolerant data center on a fast virtual machine host set up and managed by Progent's IT support experts. With the ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system software, and the apps. Since the system is virtualized, it can be ported immediately to a different hardware solution without a lengthy and difficult configuration process. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior-based machine learning technology to defend physical and virtual endpoint devices against modern malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-matching anti-virus tools. ProSight Active Security Monitoring protects on-premises and cloud resources and provides a single platform to manage the entire malware attack lifecycle including filtering, identification, containment, remediation, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services offer ultra-affordable multi-layer protection for physical and virtual servers, desktops, smartphones, and Exchange email. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and reacting to security assaults from all vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, endpoint management, and web filtering via leading-edge technologies packaged within a single agent accessible from a unified control. Progent's security and virtualization experts can help you to design and configure a ProSight ESP deployment that addresses your organization's unique needs and that helps you demonstrate compliance with legal and industry data protection standards. Progent will help you define and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for urgent attention. Progent can also assist you to install and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can recover quickly from a destructive security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.