24x7x365 Chandler Immediate Crypto
Computer Malware Detection and Repair Services

Crypto-Ransomware : Your Worst IT Catastrophe
Ransomware has become an escalating cyberplague that represents an enterprise-level danger for businesses poorly prepared for an attack. Versions of ransomware like the Dharma, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for years and still cause destruction. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with more unnamed malware, not only do encryption of online information but also infect many available system backup. Files replicated to off-site disaster recovery sites can also be encrypted. In a vulnerable data protection solution, this can render automated restore operations impossible and effectively sets the entire system back to zero.

Recovering applications and information after a ransomware attack becomes a sprint against time as the targeted business struggles to contain, eradicate the crypto-ransomware, and restore enterprise-critical activity. Since ransomware requires time to replicate, penetrations are often launched during nights and weekends, when successful attacks are likely to take more time to detect. This compounds the difficulty of promptly assembling and orchestrating a capable mitigation team.

Progent has an assortment of help services for protecting businesses from crypto-ransomware events. Among these are user training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of the latest generation security solutions with artificial intelligence technology from SentinelOne to identify and quarantine day-zero cyber attacks intelligently. Progent also offers the assistance of seasoned crypto-ransomware recovery consultants with the talent and commitment to re-deploy a breached environment as quickly as possible.

Progent's Crypto-Ransomware Recovery Support Services
After a ransomware penetration, sending the ransom in cryptocurrency does not provide any assurance that cyber hackers will respond with the needed keys to decipher any of your information. Kaspersky Labs determined that 17% of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to setup from scratch the vital parts of your Information Technology environment. Without access to complete system backups, this requires a broad complement of IT skills, top notch project management, and the ability to work 24x7 until the job is done.

For twenty years, Progent has provided expert Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have been awarded high-level certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP applications. This breadth of expertise gives Progent the skills to efficiently determine important systems and consolidate the surviving parts of your IT system after a ransomware penetration and assemble them into an operational network.

Progent's ransomware team deploys top notch project management systems to orchestrate the sophisticated recovery process. Progent appreciates the importance of working rapidly and in concert with a client's management and IT staff to assign priority to tasks and to get essential services back on-line as soon as humanly possible.

Client Case Study: A Successful Ransomware Intrusion Response
A client hired Progent after their network system was penetrated by Ryuk ransomware. Ryuk is generally considered to have been launched by Northern Korean government sponsored criminal gangs, possibly using techniques leaked from the United States National Security Agency. Ryuk targets specific organizations with limited tolerance for operational disruption and is one of the most lucrative versions of ransomware viruses. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in the Chicago metro area with about 500 workers. The Ryuk attack had brought down all business operations and manufacturing capabilities. The majority of the client's backups had been on-line at the start of the intrusion and were damaged. The client was pursuing financing for paying the ransom demand (more than $200,000) and hoping for the best, but ultimately made the decision to use Progent.

Progent worked with the customer to rapidly get our arms around and prioritize the critical elements that needed to be addressed in order to continue departmental functions:

• Active Directory
• Microsoft Exchange Server
• Financials/MRP

Within 2 days, Progent was able to re-build Active Directory to its pre-virus state. Progent then assisted with rebuilding and storage recovery on the most important servers. All Microsoft Exchange Server data and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to collect intact OST files (Outlook Email Offline Folder Files) on team desktop computers in order to recover email messages. A not too old offline backup of the businesses manufacturing software made them able to restore these vital programs back available to users. Although major work remained to recover completely from the Ryuk event, essential services were recovered quickly:

During the next couple of weeks important milestones in the recovery project were achieved through close collaboration between Progent consultants and the client:

• In-house web applications were restored with no loss of data.
• The MailStore Exchange Server exceeding four million historical messages was brought on-line and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control functions were 100% recovered.
• A new Palo Alto Networks 850 firewall was deployed.
• Ninety percent of the desktop computers were fully operational.

Conclusion
A probable business disaster was dodged by top-tier professionals, a broad spectrum of IT skills, and tight collaboration. Although upon completion of forensics the ransomware penetration detailed here would have been disabled with advanced cyber security systems and ISO/IEC 27001 best practices, staff education, and appropriate security procedures for data backup and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware attack, remember that Progent's team of professionals has substantial experience in crypto-ransomware virus blocking, removal, and data restoration.

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Chandler a variety of online monitoring and security evaluation services designed to help you to minimize the threat from ransomware. These services utilize next-generation machine learning technology to detect new variants of ransomware that are able to get past traditional signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create advanced network resilience. Progent handles the daily monitoring and management for you, so your network expands easily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management, security, automatic monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to advanced solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to help keep your network running at peak levels by checking the health of critical computers that power your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent automatically to your designated IT staff and your assigned Progent engineering consultant so that any potential problems can be resolved before they can impact productivity. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for managing your client-server infrastructure by providing tools for performing common time-consuming jobs. These can include health monitoring, patch management, automated remediation, endpoint deployment, backup and recovery, anti-virus response, remote access, standard and custom scripts, resource inventory, endpoint status reports, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alarm to your specified IT management staff and your assigned Progent consultant so that potential problems can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to diagram, monitor, enhance and debug their networking hardware such as switches, firewalls, and access points as well as servers, client computers and other networked devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch makes sure that network maps are always current, captures and manages the configuration information of almost all devices connected to your network, tracks performance, and sends notices when potential issues are discovered. By automating complex management and troubleshooting processes, WAN Watch can cut hours off ordinary chores like network mapping, expanding your network, finding devices that require critical software patches, or isolating performance issues. Find out more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time and in-depth reporting utilities created to integrate with the industry's top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues such as spotty support follow-up or machines with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup technology providers to create ProSight Data Protection Services (DPS), a family of subscription-based offerings that provide backup-as-a-service (BaaS). ProSight DPS services automate and track your backup operations and allow non-disruptive backup and rapid restoration of important files/folders, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business avoid data loss caused by hardware failures, natural disasters, fire, malware such as ransomware, human mistakes, malicious employees, or software bugs. Managed services available in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to determine which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading information security vendors to provide centralized control and comprehensive security for your email traffic. The hybrid architecture of Email Guard managed service integrates a Cloud Protection Layer with an on-premises gateway appliance to offer complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. Email Guard's Cloud Protection Layer serves as a first line of defense and blocks the vast majority of threats from making it to your network firewall. This reduces your exposure to external threats and conserves system bandwidth and storage space. Email Guard's on-premises security gateway device adds a deeper level of analysis for incoming email. For outbound email, the on-premises security gateway offers AV and anti-spam protection, DLP, and email encryption. The on-premises gateway can also help Exchange Server to monitor and protect internal email traffic that originates and ends inside your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to defend against stolen passwords by using two-factor authentication. Duo supports single-tap identity verification on Apple iOS, Google Android, and other personal devices. Using Duo 2FA, when you sign into a protected application and give your password you are asked to confirm who you are on a device that only you possess and that uses a different ("out-of-band") network channel. A broad range of devices can be utilized as this added means of authentication such as a smartphone or wearable, a hardware token, a landline telephone, etc. You may register multiple validation devices. To learn more about ProSight Duo identity authentication services, go to Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Support Center services enable your information technology team to offload Support Desk services to Progent or divide responsibilities for support services transparently between your internal support group and Progent's extensive roster of certified IT support technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a seamless supplement to your corporate support organization. End user access to the Service Desk, delivery of support, escalation, ticket generation and updates, performance metrics, and management of the service database are cohesive regardless of whether incidents are taken care of by your in-house network support group, by Progent's team, or a mix of the two. Read more about Progent's outsourced/shared Help Center services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes cutting edge behavior-based machine learning technology to guard endpoint devices as well as physical and virtual servers against modern malware attacks such as ransomware and email phishing, which easily evade legacy signature-matching AV tools. Progent Active Security Monitoring services protect local and cloud-based resources and offers a unified platform to address the complete malware attack lifecycle including protection, infiltration detection, mitigation, cleanup, and forensics. Key features include single-click rollback with Windows VSS and real-time system-wide immunization against newly discovered attacks. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, find and protect data related to your network infrastructure, processes, business apps, and services. You can quickly find passwords or IP addresses and be alerted about impending expirations of SSL certificates ,domains or warranties. By cleaning up and managing your network documentation, you can save as much as 50% of time wasted looking for critical information about your network. ProSight IT Asset Management includes a common location for storing and collaborating on all documents related to managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and associating IT data. Whether you're planning improvements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you require the instant you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer organizations of any size a versatile and affordable alternative for assessing, validating, scheduling, implementing, and tracking software and firmware updates to your dynamic IT network. In addition to maximizing the protection and reliability of your IT environment, Progent's patch management services allow your in-house IT team to concentrate on line-of-business projects and activities that derive the highest business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a secure Tier III data center on a fast virtual host configured and managed by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS platforms, and the apps. Since the system is virtualized, it can be moved immediately to an alternate hardware solution without a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that utilizes SentinelOne's next generation behavior machine learning tools to guard physical and virtual endpoint devices against new malware assaults like ransomware and file-less exploits, which easily get by traditional signature-based anti-virus tools. ProSight ASM protects local and cloud resources and provides a unified platform to address the entire threat progression including protection, infiltration detection, mitigation, remediation, and forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable in-depth security for physical and virtual servers, workstations, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and responding to cyber assaults from all vectors. ProSight ESP provides two-way firewall protection, penetration alerts, endpoint management, and web filtering via leading-edge technologies packaged within one agent managed from a single console. Progent's security and virtualization consultants can assist you to plan and configure a ProSight ESP environment that addresses your organization's specific requirements and that helps you achieve and demonstrate compliance with government and industry information security regulations. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that require urgent action. Progent's consultants can also help you to set up and test a backup and restore system such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange filtering.