Rio de Janeiro 24x7 Urgent Crypto
Malware Identification and Repair Support

Crypto-Ransomware : Your Crippling IT Disaster
Crypto-Ransomware has become a modern cyberplague that presents an enterprise-level threat for organizations unprepared for an assault. Different versions of crypto-ransomware such as Reveton, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for many years and continue to inflict destruction. Recent versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, as well as daily as yet unnamed viruses, not only do encryption of on-line data but also infect most configured system restores and backups. Data synched to cloud environments can also be ransomed. In a poorly architected data protection solution, it can render automated restore operations hopeless and effectively sets the network back to square one.

Recovering programs and data after a ransomware outage becomes a race against time as the targeted organization tries its best to contain the damage, remove the ransomware, and resume mission-critical activity. Due to the fact that ransomware needs time to replicate, assaults are usually launched at night, when successful penetrations in many cases take longer to discover. This multiplies the difficulty of promptly marshalling and orchestrating a qualified response team.

Progent makes available a range of solutions for protecting organizations from crypto-ransomware attacks. These include team education to help identify and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus setup and configuration of modern security solutions with machine learning technology from SentinelOne to discover and extinguish zero-day threats intelligently. Progent also can provide the services of experienced ransomware recovery professionals with the track record and perseverance to re-deploy a breached system as urgently as possible.

Progent's Ransomware Recovery Help
Soon after a ransomware event, even paying the ransom in cryptocurrency does not guarantee that cyber criminals will respond with the keys to unencrypt any or all of your data. Kaspersky estimated that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to piece back together the vital elements of your Information Technology environment. Without access to essential data backups, this calls for a wide range of skill sets, top notch project management, and the capability to work continuously until the job is complete.

For decades, Progent has made available professional IT services for businesses throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained high-level certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial systems and ERP applications. This breadth of experience affords Progent the skills to efficiently determine important systems and organize the surviving pieces of your computer network environment following a crypto-ransomware event and configure them into an operational network.

Progent's recovery group utilizes state-of-the-art project management tools to coordinate the sophisticated restoration process. Progent appreciates the urgency of working swiftly and in concert with a customer's management and IT staff to assign priority to tasks and to put the most important applications back on-line as fast as humanly possible.

Business Case Study: A Successful Ransomware Attack Response
A business escalated to Progent after their company was crashed by the Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean state criminal gangs, possibly using technology leaked from America's National Security Agency. Ryuk seeks specific businesses with little ability to sustain disruption and is one of the most profitable versions of ransomware. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in the Chicago metro area with around 500 employees. The Ryuk event had disabled all business operations and manufacturing processes. The majority of the client's backups had been on-line at the start of the intrusion and were encrypted. The client was taking steps for paying the ransom demand (in excess of $200,000) and praying for good luck, but ultimately made the decision to use Progent.

Progent worked with the client to quickly assess and assign priority to the essential areas that needed to be recovered to make it possible to resume departmental functions:

• Microsoft Active Directory
• Email
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to re-build Windows Active Directory to its pre-intrusion state. Progent then initiated setup and hard drive recovery on needed systems. All Exchange ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to collect intact OST data files (Microsoft Outlook Off-Line Data Files) on team PCs in order to recover mail information. A recent offline backup of the client's accounting/ERP software made them able to restore these essential applications back available to users. Although significant work needed to be completed to recover completely from the Ryuk virus, essential systems were restored rapidly:

During the following few weeks key milestones in the recovery process were completed in tight collaboration between Progent team members and the customer:

• Internal web applications were returned to operation without losing any information.
• The MailStore Server containing more than 4 million historical messages was spun up and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory Control modules were fully restored.
• A new Palo Alto 850 security appliance was installed and configured.
• 90% of the user workstations were fully operational.

Conclusion
A probable company-ending disaster was evaded due to top-tier experts, a wide range of knowledge, and tight collaboration. Although in hindsight the ransomware incident described here would have been disabled with up-to-date cyber security solutions and security best practices, user and IT administrator training, and properly executed security procedures for backup and keeping systems up to date with security patches, the fact is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware incident, remember that Progent's roster of professionals has extensive experience in ransomware virus defense, mitigation, and information systems disaster recovery.

To read or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide companies in Rio de Janeiro a range of online monitoring and security evaluation services designed to help you to reduce your vulnerability to ransomware. These services incorporate modern machine learning technology to detect new variants of crypto-ransomware that can get past legacy signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to achieve leading-edge network resilience. Progent handles the daily monitoring and management for you, so your network expands readily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's experienced IT group can be your complete technology safety net. Basic packages include remote monitoring and management (RMM), cybersecurity, automatic monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management techniques to help keep your IT system operating efficiently by tracking the state of critical assets that power your information system. When ProSight LAN Watch detects an issue, an alarm is sent immediately to your specified IT management personnel and your assigned Progent engineering consultant so all looming issues can be resolved before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your client-server infrastructure by offering an environment for performing common tedious tasks. These can include health checking, update management, automated repairs, endpoint deployment, backup and restore, anti-virus response, remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alert to your designated IT personnel and your assigned Progent technical consultant so emerging problems can be fixed before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized businesses to diagram, monitor, reconfigure and debug their connectivity appliances such as routers and switches, firewalls, and access points as well as servers, endpoints and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that infrastructure topology maps are always updated, captures and manages the configuration of almost all devices connected to your network, monitors performance, and sends alerts when problems are detected. By automating tedious management and troubleshooting processes, WAN Watch can cut hours off common tasks like making network diagrams, reconfiguring your network, finding devices that require critical updates, or isolating performance bottlenecks. Learn more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time and in-depth reporting plug-ins created to work with the top ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as spotty support follow-up or machines with out-of-date AVs. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore software providers to create ProSight Data Protection Services, a selection of offerings that deliver backup-as-a-service. ProSight DPS services manage and track your backup operations and allow transparent backup and fast restoration of critical files, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS helps your business avoid data loss caused by equipment failures, natural disasters, fire, malware like ransomware, user mistakes, malicious insiders, or application glitches. Managed backup services available in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of leading data security companies to deliver centralized control and comprehensive protection for your email traffic. The hybrid structure of Email Guard integrates a Cloud Protection Layer with an on-premises security gateway appliance to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. The Cloud Protection Layer serves as a first line of defense and keeps the vast majority of unwanted email from making it to your network firewall. This reduces your vulnerability to external threats and saves system bandwidth and storage. Email Guard's on-premises gateway appliance adds a deeper layer of analysis for incoming email. For outgoing email, the on-premises gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The on-premises security gateway can also help Exchange Server to track and protect internal email traffic that originates and ends within your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo MFA services utilize Cisco's Duo technology to defend against password theft through the use of two-factor authentication. Duo supports single-tap identity confirmation on iOS, Android, and other out-of-band devices. With 2FA, whenever you sign into a secured application and enter your password you are requested to verify your identity on a device that only you have and that uses a different ("out-of-band") network channel. A broad range of devices can be utilized for this added form of ID validation such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You may register multiple verification devices. For details about Duo identity authentication services, see Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Center: Help Desk Managed Services
  Progent's Call Center managed services enable your information technology staff to offload Help Desk services to Progent or split responsibilities for Service Desk support transparently between your internal network support group and Progent's nationwide roster of certified IT service engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a transparent extension of your in-house network support resources. User access to the Help Desk, provision of technical assistance, escalation, ticket generation and updates, performance measurement, and maintenance of the service database are cohesive whether issues are taken care of by your core support group, by Progent's team, or a mix of the two. Read more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior machine learning technology to defend endpoint devices as well as servers and VMs against new malware attacks such as ransomware and email phishing, which routinely evade legacy signature-based anti-virus products. Progent Active Security Monitoring services safeguard on-premises and cloud resources and provides a single platform to automate the complete threat progression including filtering, infiltration detection, mitigation, remediation, and forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered attacks. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, retrieve and safeguard data about your IT infrastructure, processes, applications, and services. You can quickly find passwords or serial numbers and be alerted automatically about impending expirations of SSL certificates or warranties. By updating and organizing your network documentation, you can save as much as half of time thrown away looking for vital information about your network. ProSight IT Asset Management features a common repository for storing and collaborating on all documents required for managing your network infrastructure like recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT data. Whether you're planning enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the information you require the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and cost-effective solution for evaluating, validating, scheduling, applying, and tracking updates to your dynamic information system. In addition to maximizing the protection and functionality of your computer environment, Progent's patch management services permit your IT team to concentrate on more strategic initiatives and activities that deliver the highest business value from your network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a protected fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting service model, the customer owns the data, the OS software, and the apps. Because the environment is virtualized, it can be ported immediately to a different hosting environment without a time-consuming and difficult configuration process. With ProSight Virtual Hosting, you are not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior analysis technology to defend physical and virtual endpoint devices against modern malware attacks such as ransomware and file-less exploits, which routinely evade traditional signature-based anti-virus products. ProSight Active Security Monitoring safeguards local and cloud resources and provides a unified platform to address the entire threat lifecycle including filtering, detection, mitigation, remediation, and post-attack forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services offer affordable multi-layer protection for physical servers and VMs, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and reacting to cyber threats from all vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, endpoint management, and web filtering through leading-edge technologies packaged within one agent managed from a single console. Progent's data protection and virtualization experts can help your business to design and configure a ProSight ESP deployment that addresses your company's specific needs and that allows you prove compliance with legal and industry information protection standards. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for urgent attention. Progent can also help you to install and verify a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can recover quickly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange filtering.