24/7 Centennial Urgent Ransomware
Computer Malware Identification and Remediation Help

Ransomware : Your Feared Information Technology Disaster
Ransomware has become an escalating cyberplague that presents an existential danger for organizations unprepared for an assault. Versions of ransomware such as Reveton, Fusob, Locky, SamSam and MongoLock cryptoworms have been around for many years and continue to cause destruction. Recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, as well as daily as yet unnamed newcomers, not only do encryption of on-line critical data but also infiltrate any available system protection mechanisms. Data synched to off-site disaster recovery sites can also be held hostage. In a poorly architected environment, it can render automatic recovery useless and effectively knocks the entire system back to zero.

Getting back online services and information after a ransomware intrusion becomes a race against time as the victim tries its best to contain, remove the virus, and resume enterprise-critical activity. Because ransomware takes time to move laterally, assaults are frequently sprung at night, when successful penetrations are likely to take more time to uncover. This compounds the difficulty of quickly marshalling and organizing a qualified response team.

Progent offers an assortment of services for securing organizations from crypto-ransomware attacks. Among these are team education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of the latest generation security gateways with AI technology from SentinelOne to detect and disable new cyber attacks intelligently. Progent in addition provides the assistance of experienced crypto-ransomware recovery professionals with the talent and commitment to restore a breached environment as rapidly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a ransomware penetration, even paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will return the needed codes to unencrypt any of your files. Kaspersky determined that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to re-install the mission-critical parts of your Information Technology environment. Without access to complete system backups, this calls for a broad complement of skill sets, professional project management, and the willingness to work 24x7 until the recovery project is done.

For decades, Progent has provided certified expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned high-level certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with accounting and ERP software solutions. This breadth of experience gives Progent the skills to knowledgably determine critical systems and integrate the surviving components of your network system after a ransomware penetration and assemble them into a functioning network.

Progent's recovery team of experts deploys powerful project management tools to coordinate the complex restoration process. Progent knows the urgency of acting rapidly and together with a customer's management and Information Technology resources to assign priority to tasks and to put key systems back online as soon as humanly possible.

Client Case Study: A Successful Crypto-Ransomware Penetration Recovery
A customer contacted Progent after their company was attacked by Ryuk ransomware. Ryuk is generally considered to have been developed by Northern Korean government sponsored cybercriminals, possibly adopting algorithms leaked from the U.S. NSA organization. Ryuk seeks specific organizations with limited tolerance for operational disruption and is one of the most profitable versions of crypto-ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturer based in the Chicago metro area and has about 500 workers. The Ryuk penetration had brought down all business operations and manufacturing capabilities. Most of the client's data backups had been online at the time of the intrusion and were damaged. The client considered paying the ransom (more than two hundred thousand dollars) and hoping for good luck, but in the end made the decision to use Progent.

Progent worked hand in hand the client to rapidly determine and prioritize the most important systems that had to be recovered to make it possible to continue departmental operations:

• Active Directory (AD)
• Electronic Mail
• Accounting and Manufacturing Software

Within two days, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then initiated setup and hard drive recovery on the most important systems. All Exchange schema and attributes were usable, which facilitated the restore of Exchange. Progent was able to locate non-encrypted OST files (Outlook Email Off-Line Data Files) on various workstations and laptops in order to recover mail data. A recent offline backup of the client's manufacturing software made them able to return these vital applications back online. Although significant work remained to recover fully from the Ryuk virus, critical services were recovered quickly:

During the next couple of weeks critical milestones in the recovery project were completed through tight cooperation between Progent team members and the client:

• Internal web sites were restored with no loss of information.
• The MailStore Server exceeding 4 million archived emails was restored to operations and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory modules were completely restored.
• A new Palo Alto Networks 850 security appliance was installed.
• Ninety percent of the user desktops were fully operational.

Conclusion
A likely business-killing catastrophe was avoided by results-oriented experts, a broad range of technical expertise, and tight teamwork. Although in hindsight the ransomware incident described here would have been disabled with up-to-date cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and well designed security procedures for backup and applying software patches, the reality is that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and are not going away. If you do get hit by a ransomware attack, remember that Progent's roster of experts has proven experience in ransomware virus blocking, remediation, and information systems restoration.

To review or download a PDF version of this customer case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Centennial a variety of online monitoring and security assessment services to assist you to reduce your vulnerability to crypto-ransomware. These services utilize next-generation artificial intelligence technology to detect new strains of ransomware that can evade traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the daily monitoring and management for you, so your network scales easily without holding you back. For an affordable and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management, cybersecurity, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management techniques to keep your network operating efficiently by tracking the health of critical assets that drive your business network. When ProSight LAN Watch detects an issue, an alert is sent immediately to your specified IT personnel and your Progent engineering consultant so all looming issues can be resolved before they can impact your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for managing your network, server, and desktop devices by providing an environment for performing common time-consuming tasks. These include health monitoring, update management, automated repairs, endpoint setup, backup and recovery, anti-virus response, remote access, standard and custom scripts, asset inventory, endpoint status reports, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alert to your designated IT management staff and your assigned Progent consultant so potential issues can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and affordable for smaller organizations to map, monitor, reconfigure and troubleshoot their networking hardware like switches, firewalls, and load balancers plus servers, endpoints and other devices. Using state-of-the-art RMM technology, ProSight WAN Watch ensures that network diagrams are always current, copies and manages the configuration information of almost all devices connected to your network, monitors performance, and sends alerts when problems are discovered. By automating tedious management and troubleshooting processes, ProSight WAN Watch can cut hours off ordinary tasks like network mapping, reconfiguring your network, finding devices that require important updates, or resolving performance issues. Learn more about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time reporting tools designed to work with the leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup technology companies to produce ProSight Data Protection Services (DPS), a portfolio of subscription-based management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services automate and monitor your backup operations and allow non-disruptive backup and fast recovery of vital files/folders, apps, images, plus virtual machines. ProSight DPS lets you protect against data loss caused by hardware failures, natural disasters, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned insiders, or software bugs. Managed services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Hybrid Backup. Your Progent expert can help you to determine which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of leading data security companies to provide centralized control and comprehensive protection for all your email traffic. The hybrid architecture of Progent's Email Guard managed service integrates cloud-based filtering with an on-premises gateway device to offer advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-based threats. Email Guard's cloud filter acts as a preliminary barricade and blocks the vast majority of threats from making it to your security perimeter. This decreases your exposure to external attacks and conserves network bandwidth and storage space. Email Guard's on-premises gateway appliance provides a further level of analysis for incoming email. For outgoing email, the on-premises gateway offers anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to monitor and safeguard internal email that originates and ends inside your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans utilize Cisco's Duo technology to protect against stolen passwords by using two-factor authentication (2FA). Duo supports single-tap identity confirmation on Apple iOS, Android, and other personal devices. With Duo 2FA, when you sign into a protected application and give your password you are asked to confirm your identity on a unit that only you possess and that uses a separate network channel. A wide selection of out-of-band devices can be used as this second form of authentication such as a smartphone or wearable, a hardware token, a landline phone, etc. You can register several validation devices. For details about ProSight Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Service Desk: Help Desk Managed Services
  Progent's Call Desk managed services allow your IT group to outsource Support Desk services to Progent or split responsibilities for Service Desk support seamlessly between your internal support group and Progent's extensive roster of IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a seamless extension of your internal IT support resources. User interaction with the Service Desk, provision of support, issue escalation, trouble ticket generation and tracking, efficiency measurement, and management of the support database are cohesive regardless of whether issues are resolved by your core network support organization, by Progent's team, or a mix of the two. Read more about Progent's outsourced/co-managed Call Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates next generation behavior machine learning tools to defend endpoints as well as physical and virtual servers against modern malware attacks like ransomware and email phishing, which easily evade traditional signature-matching AV products. Progent ASM services safeguard on-premises and cloud resources and provides a single platform to address the entire threat progression including protection, infiltration detection, mitigation, remediation, and post-attack forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new attacks. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, retrieve and protect information about your network infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be warned automatically about upcoming expirations of SSLs or domains. By updating and organizing your IT documentation, you can save up to 50% of time wasted searching for vital information about your IT network. ProSight IT Asset Management includes a centralized location for holding and sharing all documents related to managing your business network such as standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT information. Whether you're making enhancements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you need the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide organizations of all sizes a flexible and affordable alternative for assessing, validating, scheduling, applying, and tracking updates to your dynamic information system. In addition to maximizing the security and reliability of your IT environment, Progent's software/firmware update management services permit your IT staff to concentrate on more strategic initiatives and tasks that deliver the highest business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a protected Tier III data center on a fast virtual host configured and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system software, and the applications. Because the system is virtualized, it can be ported easily to an alternate hosting solution without a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoint devices against modern malware attacks like ransomware and email phishing, which routinely escape traditional signature-based AV products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and provides a unified platform to address the entire malware attack lifecycle including filtering, detection, containment, cleanup, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection services deliver affordable multi-layer protection for physical and virtual servers, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to security assaults from all attack vectors. ProSight ESP offers two-way firewall protection, penetration alerts, endpoint management, and web filtering via leading-edge technologies incorporated within a single agent managed from a single console. Progent's security and virtualization consultants can assist you to plan and configure a ProSight ESP deployment that addresses your company's unique needs and that allows you demonstrate compliance with government and industry information security regulations. Progent will help you define and configure policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that require urgent action. Progent's consultants can also help your company to install and verify a backup and restore solution such as ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange filtering.