24x7x365 Sandy Springs Critical Ransomware
Virus Identification and Repair Consultants

Ransomware : Your Crippling IT Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that represents an enterprise-level danger for businesses of all sizes poorly prepared for an assault. Versions of ransomware like the Reveton, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been replicating for many years and continue to inflict havoc. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, as well as more as yet unnamed newcomers, not only do encryption of online files but also infect all available system restores and backups. Information synchronized to the cloud can also be held hostage. In a poorly designed environment, it can make any restoration impossible and basically sets the entire system back to square one.

Getting back on-line applications and information after a crypto-ransomware event becomes a sprint against time as the targeted organization fights to contain the damage, clear the virus, and restore business-critical operations. Due to the fact that crypto-ransomware takes time to replicate, attacks are often sprung on weekends, when penetrations are likely to take more time to uncover. This multiplies the difficulty of promptly mobilizing and orchestrating a qualified mitigation team.

Progent has a variety of help services for securing enterprises from ransomware events. These include team member training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of modern security appliances with artificial intelligence technology from SentinelOne to identify and disable zero-day threats quickly. Progent in addition can provide the services of seasoned ransomware recovery consultants with the talent and perseverance to re-deploy a breached network as soon as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that cyber criminals will return the needed keys to decipher any or all of your files. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The fallback is to piece back together the critical parts of your Information Technology environment. Absent the availability of essential data backups, this requires a broad complement of skill sets, well-coordinated project management, and the ability to work 24x7 until the task is over.

For decades, Progent has offered professional Information Technology services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned top certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial systems and ERP application software. This breadth of expertise provides Progent the capability to quickly identify necessary systems and consolidate the surviving pieces of your network system following a ransomware attack and configure them into an operational system.

Progent's security team utilizes state-of-the-art project management applications to coordinate the complex recovery process. Progent understands the importance of working swiftly and together with a client's management and IT team members to assign priority to tasks and to put essential systems back on line as soon as possible.

Client Story: A Successful Crypto-Ransomware Attack Restoration
A business engaged Progent after their network system was crashed by Ryuk crypto-ransomware. Ryuk is thought to have been launched by North Korean state hackers, possibly adopting approaches leaked from America's National Security Agency. Ryuk attacks specific businesses with little or no tolerance for disruption and is among the most lucrative incarnations of ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturer headquartered in the Chicago metro area and has around 500 staff members. The Ryuk penetration had brought down all business operations and manufacturing capabilities. The majority of the client's system backups had been on-line at the beginning of the intrusion and were destroyed. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but in the end reached out to Progent.

Progent worked hand in hand the client to rapidly determine and prioritize the mission critical areas that needed to be restored to make it possible to continue departmental functions:

• Active Directory
• Microsoft Exchange Email
• Accounting/MRP

Within two days, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then helped perform reinstallations and storage recovery on mission critical applications. All Exchange ties and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to collect non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on various PCs to recover mail data. A recent offline backup of the client's financials/ERP software made it possible to restore these required programs back on-line. Although significant work was left to recover completely from the Ryuk event, critical services were restored rapidly:

Throughout the next few weeks key milestones in the restoration process were completed in tight collaboration between Progent consultants and the customer:

• Internal web applications were brought back up with no loss of information.
• The MailStore Exchange Server containing more than four million archived emails was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 firewall was brought online.
• Nearly all of the desktops and laptops were operational.

Conclusion
A likely enterprise-killing catastrophe was evaded through the efforts of dedicated professionals, a wide range of technical expertise, and close collaboration. Although upon completion of forensics the ransomware virus incident detailed here would have been identified and prevented with advanced security systems and best practices, team education, and properly executed security procedures for information protection and keeping systems up to date with security patches, the fact remains that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware penetration, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus defense, mitigation, and information systems disaster recovery.

To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Sandy Springs a range of remote monitoring and security assessment services designed to assist you to reduce your vulnerability to ransomware. These services utilize next-generation machine learning capability to detect zero-day variants of ransomware that can escape detection by legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent handles the daily monitoring and maintenance for you, so your system scales easily without becoming an obstacle. For a low and predictable monthly price, Progent's full-service IT team can be your complete technology safety net. Basic plans include remote monitoring and management (RMM), security, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management technology to help keep your network operating efficiently by checking the state of vital assets that drive your business network. When ProSight LAN Watch uncovers a problem, an alarm is sent automatically to your specified IT management personnel and your Progent engineering consultant so that all looming issues can be resolved before they can impact productivity. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for managing your network, server, and desktop devices by offering an environment for streamlining common time-consuming jobs. These can include health checking, update management, automated remediation, endpoint deployment, backup and recovery, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alert to your designated IT management staff and your Progent technical consultant so potential problems can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for small and mid-sized businesses to map out, monitor, optimize and debug their networking hardware such as routers and switches, firewalls, and load balancers plus servers, client computers and other devices. Using cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that network maps are always current, captures and manages the configuration of almost all devices on your network, tracks performance, and sends alerts when potential issues are detected. By automating complex network management processes, WAN Watch can knock hours off ordinary chores such as network mapping, expanding your network, finding devices that need important software patches, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time management reporting tools designed to integrate with the top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues such as inconsistent support follow-up or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore software companies to produce ProSight Data Protection Services, a portfolio of subscription-based management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS products manage and track your backup operations and allow transparent backup and rapid recovery of vital files/folders, apps, images, plus Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss resulting from equipment breakdown, natural disasters, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned employees, or software glitches. Managed services available in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to identify which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top data security vendors to deliver centralized management and comprehensive protection for your email traffic. The hybrid architecture of Email Guard integrates a Cloud Protection Layer with a local gateway device to provide complete defense against spam, viruses, Dos Attacks, DHAs, and other email-borne threats. Email Guard's Cloud Protection Layer serves as a preliminary barricade and blocks most unwanted email from reaching your network firewall. This reduces your exposure to inbound threats and saves network bandwidth and storage space. Email Guard's on-premises security gateway device provides a further level of inspection for incoming email. For outbound email, the on-premises gateway offers anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also help Exchange Server to monitor and protect internal email traffic that originates and ends within your corporate firewall. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication services utilize Cisco's Duo cloud technology to protect against password theft by using two-factor authentication. Duo supports one-tap identity confirmation on iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a secured application and enter your password you are asked to confirm who you are on a unit that only you have and that is accessed using a different ("out-of-band") network channel. A wide selection of out-of-band devices can be used as this added means of ID validation such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You may designate multiple validation devices. To find out more about Duo two-factor identity authentication services, visit Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Support Desk services enable your IT staff to offload Call Center services to Progent or split responsibilities for Help Desk services transparently between your internal support staff and Progent's nationwide roster of IT service engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a transparent extension of your corporate network support group. End user access to the Service Desk, provision of technical assistance, escalation, ticket generation and updates, performance measurement, and maintenance of the service database are consistent whether incidents are resolved by your in-house support organization, by Progent, or a mix of the two. Learn more about Progent's outsourced/shared Service Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior machine learning technology to defend endpoint devices and physical and virtual servers against modern malware attacks such as ransomware and email phishing, which routinely escape legacy signature-based anti-virus tools. Progent ASM services protect local and cloud resources and provides a single platform to address the complete threat progression including filtering, identification, mitigation, remediation, and post-attack forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, find and safeguard information about your network infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be warned about impending expirations of SSL certificates ,domains or warranties. By updating and managing your IT documentation, you can save up to 50% of time wasted looking for vital information about your IT network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and associating IT data. Whether you're planning improvements, doing maintenance, or responding to an emergency, ProSight IT Asset Management delivers the data you need the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide businesses of all sizes a flexible and affordable solution for evaluating, testing, scheduling, applying, and tracking software and firmware updates to your dynamic information system. Besides optimizing the protection and reliability of your IT environment, Progent's software/firmware update management services allow your in-house IT team to concentrate on more strategic initiatives and activities that derive the highest business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a protected fault tolerant data center on a fast virtual machine host configured and maintained by Progent's network support professionals. With Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the OS software, and the applications. Because the environment is virtualized, it can be moved immediately to an alternate hosting environment without requiring a lengthy and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior-based analysis tools to guard physical and virtual endpoints against new malware attacks like ransomware and file-less exploits, which routinely evade legacy signature-matching AV tools. ProSight ASM protects local and cloud resources and offers a single platform to automate the complete malware attack lifecycle including filtering, infiltration detection, mitigation, cleanup, and post-attack forensics. Key features include one-click rollback using Windows VSS and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services offer affordable multi-layer security for physical servers and VMs, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and reacting to security threats from all vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, endpoint control, and web filtering through cutting-edge technologies incorporated within a single agent accessible from a unified console. Progent's data protection and virtualization consultants can assist you to plan and configure a ProSight ESP environment that meets your organization's unique requirements and that allows you demonstrate compliance with legal and industry information security standards. Progent will assist you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that require immediate attention. Progent can also assist your company to install and verify a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.