Liverpool 24x7 Critical Crypto
Computer Malware Identification and Removal Consulting

Crypto-Ransomware : Your Feared IT Disaster
Ransomware has become a modern cyberplague that poses an existential danger for businesses unprepared for an assault. Different versions of ransomware like the Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been running rampant for years and still inflict destruction. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, along with more as yet unnamed malware, not only encrypt online data but also infect any available system protection mechanisms. Data synched to cloud environments can also be held hostage. In a vulnerable system, it can render automatic restore operations impossible and effectively knocks the datacenter back to square one.

Getting back on-line services and data following a ransomware outage becomes a sprint against time as the targeted business struggles to stop the spread, remove the virus, and restore mission-critical activity. Due to the fact that ransomware takes time to spread, attacks are usually sprung on weekends, when successful attacks in many cases take longer to discover. This multiplies the difficulty of quickly assembling and orchestrating a qualified mitigation team.

Progent makes available an assortment of support services for securing businesses from ransomware events. Among these are team training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of modern security gateways with artificial intelligence technology from SentinelOne to discover and suppress new cyber threats rapidly. Progent also provides the services of seasoned ransomware recovery engineers with the skills and perseverance to rebuild a breached system as rapidly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Soon after a crypto-ransomware penetration, paying the ransom in cryptocurrency does not guarantee that distant criminals will return the keys to decrypt any or all of your information. Kaspersky estimated that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The fallback is to piece back together the essential components of your IT environment. Without access to full information backups, this requires a broad range of IT skills, well-coordinated project management, and the willingness to work 24x7 until the recovery project is over.

For two decades, Progent has offered professional IT services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have earned high-level certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with financial systems and ERP applications. This breadth of experience affords Progent the capability to rapidly identify important systems and organize the surviving parts of your network system following a crypto-ransomware attack and configure them into an operational system.

Progent's security team uses state-of-the-art project management systems to coordinate the sophisticated restoration process. Progent appreciates the importance of acting quickly and in concert with a customer's management and IT resources to prioritize tasks and to put key systems back on line as fast as possible.

Business Case Study: A Successful Crypto-Ransomware Intrusion Recovery
A customer hired Progent after their organization was taken over by the Ryuk ransomware. Ryuk is generally considered to have been deployed by Northern Korean state cybercriminals, suspected of using approaches leaked from the U.S. National Security Agency. Ryuk goes after specific organizations with little or no tolerance for disruption and is among the most profitable iterations of ransomware malware. Major targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company based in the Chicago metro area with about 500 staff members. The Ryuk penetration had shut down all essential operations and manufacturing processes. The majority of the client's data protection had been online at the start of the attack and were encrypted. The client was actively seeking loans for paying the ransom demand (more than two hundred thousand dollars) and praying for the best, but ultimately reached out to Progent.

Progent worked together with the customer to quickly determine and prioritize the critical services that needed to be restored to make it possible to continue company operations:

• Active Directory (AD)
• Electronic Messaging
• Accounting and Manufacturing Software

In less than two days, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then accomplished setup and hard drive recovery on the most important applications. All Exchange Server schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Offline Data Files) on user PCs and laptops to recover email messages. A recent offline backup of the businesses manufacturing software made them able to restore these essential programs back servicing users. Although significant work still had to be done to recover completely from the Ryuk virus, the most important systems were restored quickly:

Over the following couple of weeks critical milestones in the recovery process were accomplished in close collaboration between Progent consultants and the customer:

• Internal web applications were brought back up with no loss of information.
• The MailStore Server containing more than four million archived messages was spun up and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control functions were 100 percent operational.
• A new Palo Alto Networks 850 security appliance was set up.
• Ninety percent of the desktop computers were back into operation.

Conclusion
A probable business-ending catastrophe was dodged due to hard-working professionals, a wide array of IT skills, and close collaboration. Although upon completion of forensics the ransomware virus penetration detailed here should have been blocked with advanced security technology and NIST Cybersecurity Framework best practices, team education, and well designed incident response procedures for data protection and applying software patches, the reality remains that state-sponsored hackers from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware incident, remember that Progent's team of professionals has a proven track record in ransomware virus defense, remediation, and information systems restoration.

To read or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Liverpool a variety of remote monitoring and security assessment services to assist you to reduce your vulnerability to ransomware. These services incorporate next-generation AI technology to detect zero-day variants of crypto-ransomware that are able to evade legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the necessary monitoring and maintenance for you, so your network scales readily without holding you back. For a low and predictable monthly subscription, Progent's experienced IT team can be your complete technology safety net. Basic plans include remote monitoring and management, security, automatic monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) technology to keep your IT system running at peak levels by tracking the state of vital computers that drive your information system. When ProSight LAN Watch detects an issue, an alert is transmitted immediately to your specified IT management personnel and your assigned Progent consultant so that any looming problems can be addressed before they have a chance to disrupt productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for managing your client-server infrastructure by offering tools for streamlining common time-consuming jobs. These include health checking, patch management, automated repairs, endpoint setup, backup and restore, anti-virus protection, secure remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alert to your designated IT management staff and your assigned Progent technical consultant so that emerging issues can be taken care of before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for smaller businesses to map out, monitor, optimize and debug their connectivity appliances like switches, firewalls, and access points as well as servers, printers, endpoints and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that infrastructure topology maps are always current, copies and displays the configuration information of virtually all devices on your network, tracks performance, and generates notices when issues are discovered. By automating complex network management processes, ProSight WAN Watch can knock hours off ordinary tasks such as making network diagrams, expanding your network, finding devices that need important updates, or isolating performance issues. Learn more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of in-depth reporting utilities created to work with the industry's leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize critical issues such as spotty support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with leading backup software providers to produce ProSight Data Protection Services, a family of offerings that deliver backup-as-a-service. ProSight DPS products manage and monitor your data backup operations and allow transparent backup and fast restoration of important files/folders, apps, system images, plus Hyper-V and VMware virtual machines. ProSight DPS helps your business protect against data loss caused by hardware breakdown, natural disasters, fire, cyber attacks like ransomware, human error, malicious employees, or software bugs. Managed services in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top data security vendors to deliver centralized control and world-class protection for your inbound and outbound email. The powerful structure of Email Guard managed service combines a Cloud Protection Layer with a local gateway device to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's cloud filter serves as a preliminary barricade and blocks most threats from making it to your network firewall. This reduces your exposure to external threats and conserves system bandwidth and storage. Email Guard's on-premises gateway appliance provides a deeper level of analysis for inbound email. For outbound email, the on-premises gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The onsite security gateway can also help Exchange Server to monitor and safeguard internal email traffic that stays inside your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to protect against password theft by using two-factor authentication. Duo enables single-tap identity confirmation with iOS, Android, and other out-of-band devices. With 2FA, whenever you log into a secured application and enter your password you are asked to verify your identity via a unit that only you possess and that uses a separate network channel. A wide selection of devices can be used for this second form of ID validation such as an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You can register several verification devices. To learn more about Duo two-factor identity authentication services, visit Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Center: Call Center Managed Services
  Progent's Help Center services allow your information technology staff to offload Call Center services to Progent or divide activity for Service Desk support seamlessly between your internal support team and Progent's nationwide roster of IT service technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a seamless extension of your core network support resources. User access to the Service Desk, delivery of technical assistance, problem escalation, ticket generation and tracking, efficiency measurement, and maintenance of the support database are cohesive regardless of whether issues are taken care of by your in-house support group, by Progent's team, or by a combination. Read more about Progent's outsourced/shared Call Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior machine learning technology to defend endpoints as well as servers and VMs against new malware assaults like ransomware and email phishing, which routinely evade traditional signature-matching AV tools. Progent Active Security Monitoring services safeguard local and cloud resources and provides a unified platform to automate the entire malware attack progression including protection, detection, containment, cleanup, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, retrieve and protect information related to your network infrastructure, procedures, business apps, and services. You can instantly find passwords or IP addresses and be warned about upcoming expirations of SSLs or domains. By updating and managing your IT infrastructure documentation, you can eliminate as much as half of time wasted trying to find vital information about your network. ProSight IT Asset Management includes a centralized location for storing and collaborating on all documents required for managing your business network such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and associating IT data. Whether you're making improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you require when you need it. Read more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of any size a versatile and cost-effective alternative for assessing, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving information network. In addition to optimizing the security and reliability of your IT environment, Progent's patch management services permit your in-house IT staff to focus on more strategic initiatives and tasks that deliver the highest business value from your information network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a protected fault tolerant data center on a high-performance virtual host set up and managed by Progent's IT support professionals. With the ProSight Virtual Hosting model, the customer owns the data, the operating system software, and the apps. Because the environment is virtualized, it can be moved easily to an alternate hosting solution without requiring a time-consuming and difficult configuration process. With ProSight Virtual Hosting, you are not tied one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's next generation behavior-based machine learning technology to defend physical and virtual endpoint devices against modern malware attacks like ransomware and email phishing, which routinely get by legacy signature-matching AV tools. ProSight ASM safeguards local and cloud resources and provides a single platform to address the complete threat progression including protection, identification, mitigation, remediation, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection managed services deliver affordable multi-layer security for physical servers and virtual machines, workstations, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and advanced heuristics for continuously monitoring and reacting to security assaults from all attack vectors. ProSight ESP provides two-way firewall protection, penetration alarms, device control, and web filtering via leading-edge technologies incorporated within one agent managed from a single console. Progent's security and virtualization experts can assist you to design and implement a ProSight ESP environment that meets your organization's unique needs and that allows you achieve and demonstrate compliance with legal and industry information security standards. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that call for urgent attention. Progent can also assist your company to install and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can recover quickly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.