Sorocaba 24x7 Urgent Crypto-Ransomware
Malware Detection and Recovery Services

Ransomware : Your Feared IT Disaster
Ransomware has become a modern cyberplague that poses an extinction-level threat for businesses of all sizes vulnerable to an attack. Multiple generations of ransomware such as CrySIS, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and continue to cause havoc. Newer versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with frequent unnamed malware, not only do encryption of online critical data but also infect most configured system protection. Files replicated to cloud environments can also be held hostage. In a poorly architected data protection solution, this can render automatic recovery useless and effectively sets the network back to square one.

Getting back online services and data following a ransomware attack becomes a sprint against the clock as the targeted organization struggles to stop the spread, remove the ransomware, and restore business-critical activity. Since ransomware requires time to replicate, attacks are frequently sprung on weekends and holidays, when attacks are likely to take longer to identify. This compounds the difficulty of rapidly mobilizing and organizing a knowledgeable mitigation team.

Progent has an assortment of solutions for securing enterprises from crypto-ransomware penetrations. These include user education to help identify and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of the latest generation security appliances with AI capabilities from SentinelOne to identify and disable zero-day threats intelligently. Progent also can provide the services of expert crypto-ransomware recovery engineers with the track record and commitment to reconstruct a compromised network as quickly as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware event, even paying the ransom in cryptocurrency does not guarantee that cyber criminals will provide the codes to unencrypt any or all of your data. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to re-install the key components of your IT environment. Without the availability of complete system backups, this calls for a wide complement of skills, professional team management, and the ability to work non-stop until the job is over.

For decades, Progent has provided expert Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned high-level industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-renowned certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with accounting and ERP application software. This breadth of expertise gives Progent the ability to quickly determine critical systems and re-organize the remaining pieces of your IT environment after a ransomware attack and configure them into an operational system.

Progent's security group has top notch project management systems to coordinate the complicated recovery process. Progent knows the urgency of acting quickly and in unison with a client's management and IT resources to prioritize tasks and to put the most important applications back on line as soon as humanly possible.

Customer Story: A Successful Ransomware Virus Response
A business hired Progent after their network was penetrated by Ryuk crypto-ransomware. Ryuk is believed to have been launched by North Korean state sponsored criminal gangs, suspected of using techniques exposed from the United States National Security Agency. Ryuk attacks specific organizations with little room for disruption and is one of the most profitable examples of crypto-ransomware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in the Chicago metro area and has around 500 workers. The Ryuk event had frozen all essential operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the beginning of the attack and were encrypted. The client considered paying the ransom demand (more than two hundred thousand dollars) and hoping for the best, but in the end utilized Progent.

Progent worked together with the client to rapidly assess and assign priority to the mission critical areas that had to be addressed in order to restart business operations:

• Microsoft Active Directory
• Electronic Messaging
• Accounting and Manufacturing Software

In less than two days, Progent was able to rebuild Active Directory to its pre-penetration state. Progent then accomplished rebuilding and storage recovery of mission critical applications. All Exchange data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to locate intact OST files (Outlook Email Off-Line Data Files) on various workstations and laptops to recover mail messages. A recent off-line backup of the businesses accounting systems made them able to recover these required applications back online. Although major work still had to be done to recover fully from the Ryuk damage, core services were recovered rapidly:

Throughout the next month critical milestones in the recovery project were achieved in close collaboration between Progent consultants and the customer:

• Self-hosted web sites were brought back up without losing any information.
• The MailStore Microsoft Exchange Server exceeding 4 million historical emails was brought online and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory modules were 100 percent operational.
• A new Palo Alto Networks 850 firewall was installed.
• Most of the user PCs were being used by staff.

Conclusion
A likely business extinction disaster was dodged due to top-tier professionals, a wide spectrum of knowledge, and close teamwork. Although in analyzing the event afterwards the ransomware incident detailed here would have been identified and disabled with advanced cyber security technology and NIST Cybersecurity Framework best practices, user and IT administrator education, and appropriate incident response procedures for data protection and keeping systems up to date with security patches, the fact remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware incursion, feel confident that Progent's team of professionals has substantial experience in crypto-ransomware virus blocking, cleanup, and data recovery.

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers companies in Sorocaba a variety of remote monitoring and security evaluation services to assist you to minimize the threat from ransomware. These services utilize modern AI capability to uncover new variants of ransomware that are able to get past traditional signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your system expands readily without holding you back. For a low and predictable monthly price, Progent's full-service IT group can be your dependable technology safety net. Entry-level plans include remote monitoring and management, security, automatic monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management techniques to keep your network running efficiently by tracking the health of vital assets that drive your business network. When ProSight LAN Watch uncovers a problem, an alert is sent automatically to your specified IT management staff and your assigned Progent consultant so all potential problems can be resolved before they have a chance to impact your network. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for monitoring and managing your network, server, and desktop devices by offering an environment for performing common time-consuming jobs. These can include health checking, update management, automated remediation, endpoint setup, backup and recovery, anti-virus response, secure remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alert to your designated IT personnel and your Progent consultant so that emerging issues can be fixed before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for small and mid-sized businesses to diagram, monitor, optimize and troubleshoot their connectivity hardware like routers and switches, firewalls, and wireless controllers plus servers, printers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network maps are kept current, captures and manages the configuration information of almost all devices connected to your network, monitors performance, and generates alerts when potential issues are detected. By automating tedious network management processes, ProSight WAN Watch can knock hours off ordinary chores such as network mapping, expanding your network, locating appliances that require critical updates, or isolating performance bottlenecks. Find out more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time and in-depth management reporting plug-ins designed to integrate with the industry's top ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues like inconsistent support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software providers to produce ProSight Data Protection Services (DPS), a family of subscription-based management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services manage and track your backup operations and enable non-disruptive backup and fast restoration of important files, apps, images, and VMs. ProSight DPS helps you recover from data loss caused by equipment failures, natural disasters, fire, malware such as ransomware, human mistakes, malicious insiders, or application bugs. Managed services in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of top data security vendors to deliver centralized control and comprehensive security for all your inbound and outbound email. The powerful structure of Progent's Email Guard managed service integrates a Cloud Protection Layer with a local gateway device to offer complete defense against spam, viruses, Dos Attacks, DHAs, and other email-based malware. The Cloud Protection Layer acts as a preliminary barricade and blocks most unwanted email from reaching your network firewall. This decreases your vulnerability to external threats and conserves system bandwidth and storage space. Email Guard's onsite security gateway device provides a deeper layer of analysis for inbound email. For outbound email, the on-premises security gateway provides anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The onsite security gateway can also help Microsoft Exchange Server to track and protect internal email traffic that stays within your corporate firewall. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo technology to defend against compromised passwords by using two-factor authentication (2FA). Duo supports single-tap identity confirmation on iOS, Google Android, and other personal devices. Using 2FA, when you log into a secured application and give your password you are requested to confirm your identity via a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A broad selection of out-of-band devices can be used as this added means of authentication such as an iPhone or Android or watch, a hardware/software token, a landline telephone, etc. You can register multiple validation devices. For more information about ProSight Duo identity authentication services, go to Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Call Desk services permit your information technology group to outsource Support Desk services to Progent or split activity for Service Desk support seamlessly between your in-house support resources and Progent's nationwide pool of certified IT support engineers and subject matter experts. Progent's Co-managed Service Desk provides a transparent extension of your in-house IT support staff. Client access to the Help Desk, provision of support services, problem escalation, ticket generation and tracking, performance metrics, and management of the support database are cohesive whether issues are resolved by your core support resources, by Progent's team, or by a combination. Find out more about Progent's outsourced/co-managed Call Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior-based machine learning technology to guard endpoint devices as well as physical and virtual servers against modern malware assaults such as ransomware and file-less exploits, which routinely escape legacy signature-matching anti-virus tools. Progent Active Security Monitoring services protect local and cloud-based resources and offers a single platform to manage the entire threat lifecycle including filtering, detection, mitigation, remediation, and forensics. Top capabilities include single-click rollback with Windows VSS and real-time network-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, retrieve and safeguard information about your IT infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be alerted about impending expirations of SSLs or warranties. By updating and managing your network documentation, you can eliminate as much as half of time thrown away searching for critical information about your network. ProSight IT Asset Management features a centralized location for storing and sharing all documents related to managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and relating IT data. Whether you're planning improvements, doing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the data you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management provide businesses of any size a versatile and affordable solution for assessing, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving IT network. Besides optimizing the protection and reliability of your IT network, Progent's software/firmware update management services free up time for your in-house IT team to focus on more strategic projects and tasks that deliver the highest business value from your network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a protected fault tolerant data center on a high-performance virtual host set up and maintained by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the apps. Since the environment is virtualized, it can be ported immediately to a different hardware environment without a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior analysis tools to guard physical and virtual endpoints against modern malware attacks such as ransomware and email phishing, which easily evade legacy signature-based AV products. ProSight ASM protects local and cloud resources and provides a unified platform to manage the entire malware attack progression including filtering, infiltration detection, mitigation, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer economical multi-layer protection for physical and virtual servers, desktops, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for round-the-clock monitoring and responding to security assaults from all vectors. ProSight ESP offers firewall protection, intrusion alerts, endpoint control, and web filtering via leading-edge tools incorporated within one agent accessible from a unified control. Progent's data protection and virtualization consultants can assist your business to plan and implement a ProSight ESP environment that meets your organization's unique requirements and that helps you demonstrate compliance with government and industry information protection regulations. Progent will help you define and configure policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that require immediate attention. Progent can also help you to install and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange filtering.