24x7 Salem Immediate Ransomware
Virus Detection and Restoration Help

Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become a too-frequent cyberplague that poses an extinction-level danger for businesses of all sizes unprepared for an attack. Different iterations of ransomware like the Dharma, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for years and still inflict damage. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as more as yet unnamed malware, not only encrypt online critical data but also infect any available system protection. Data replicated to off-site disaster recovery sites can also be ransomed. In a poorly architected data protection solution, it can make automated restoration hopeless and effectively sets the network back to square one.

Recovering applications and data after a ransomware intrusion becomes a sprint against time as the targeted business tries its best to contain, remove the virus, and restore business-critical activity. Since crypto-ransomware takes time to replicate, assaults are usually launched during weekends and nights, when attacks tend to take more time to detect. This compounds the difficulty of promptly mobilizing and orchestrating a capable mitigation team.

Progent has an assortment of help services for protecting organizations from crypto-ransomware events. Among these are user education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of the latest generation security gateways with artificial intelligence capabilities from SentinelOne to detect and quarantine zero-day threats automatically. Progent in addition provides the assistance of seasoned crypto-ransomware recovery engineers with the skills and perseverance to re-deploy a breached environment as rapidly as possible.

Progent's Ransomware Recovery Services
After a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that cyber hackers will provide the keys to decipher any of your data. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to piece back together the essential parts of your Information Technology environment. Without the availability of essential data backups, this calls for a broad range of skill sets, well-coordinated project management, and the willingness to work 24x7 until the task is done.

For two decades, Progent has made available certified expert Information Technology services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained advanced industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in accounting and ERP applications. This breadth of experience provides Progent the capability to rapidly ascertain necessary systems and re-organize the remaining parts of your computer network system after a ransomware event and assemble them into a functioning system.

Progent's security team of experts has powerful project management tools to orchestrate the sophisticated restoration process. Progent understands the importance of acting rapidly and together with a customer's management and Information Technology staff to assign priority to tasks and to put essential systems back online as fast as humanly possible.

Customer Story: A Successful Ransomware Penetration Restoration
A customer hired Progent after their organization was penetrated by Ryuk ransomware. Ryuk is generally considered to have been deployed by Northern Korean government sponsored cybercriminals, possibly using techniques exposed from America's NSA organization. Ryuk targets specific organizations with little tolerance for disruption and is among the most lucrative versions of ransomware viruses. Headline targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing business headquartered in the Chicago metro area with about 500 staff members. The Ryuk attack had shut down all company operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the beginning of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (more than two hundred thousand dollars) and praying for the best, but in the end engaged Progent.

Progent worked with the client to quickly identify and prioritize the essential services that needed to be restored in order to restart business functions:

• Active Directory
• E-Mail
• Financials/MRP

Within two days, Progent was able to restore Active Directory to its pre-virus state. Progent then accomplished setup and hard drive recovery on critical applications. All Microsoft Exchange Server ties and configuration information were usable, which facilitated the rebuild of Exchange. Progent was also able to collect local OST data files (Outlook Email Off-Line Folder Files) on various workstations in order to recover email data. A recent offline backup of the businesses accounting/MRP software made them able to recover these essential programs back online. Although significant work needed to be completed to recover totally from the Ryuk attack, the most important services were returned to operations rapidly:

During the following month key milestones in the restoration project were made in tight collaboration between Progent engineers and the client:

• Self-hosted web applications were brought back up without losing any data.
• The MailStore Exchange Server with over four million historical messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory capabilities were completely recovered.
• A new Palo Alto Networks 850 firewall was brought online.
• 90% of the user desktops and notebooks were being used by staff.

Conclusion
A probable business extinction disaster was evaded due to top-tier experts, a wide spectrum of IT skills, and close collaboration. Although in retrospect the ransomware penetration described here could have been identified and blocked with up-to-date security systems and security best practices, user training, and properly executed security procedures for information protection and applying software patches, the fact remains that state-sponsored cybercriminals from China, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware incident, remember that Progent's roster of professionals has proven experience in ransomware virus defense, remediation, and information systems restoration.

To read or download a PDF version of this case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Salem a range of online monitoring and security evaluation services designed to assist you to minimize the threat from ransomware. These services include modern machine learning technology to uncover zero-day strains of ransomware that are able to evade traditional signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create advanced network resilience. Progent handles the necessary monitoring and management for you, so your system expands readily without becoming an obstacle. For a low and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Basic packages include RMM, cybersecurity, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to keep your IT system operating efficiently by checking the health of critical computers that drive your information system. When ProSight LAN Watch detects an issue, an alarm is transmitted immediately to your designated IT management staff and your Progent engineering consultant so any potential issues can be addressed before they have a chance to disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for monitoring and managing your network, server, and desktop devices by providing tools for performing common tedious tasks. These can include health monitoring, update management, automated remediation, endpoint configuration, backup and restore, anti-virus defense, remote access, standard and custom scripts, resource inventory, endpoint status reports, and debugging support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alert to your designated IT management personnel and your assigned Progent consultant so that emerging problems can be fixed before they interfere with your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for smaller organizations to diagram, monitor, reconfigure and debug their networking hardware such as switches, firewalls, and access points as well as servers, printers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that network maps are always current, copies and manages the configuration of virtually all devices on your network, tracks performance, and sends alerts when problems are detected. By automating complex management processes, WAN Watch can cut hours off common chores such as network mapping, expanding your network, finding appliances that require important updates, or resolving performance problems. Learn more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of in-depth management reporting utilities created to work with the top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like inconsistent support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with advanced backup/restore technology providers to produce ProSight Data Protection Services, a portfolio of management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup operations and allow transparent backup and fast recovery of vital files/folders, apps, system images, and virtual machines. ProSight DPS helps your business avoid data loss caused by equipment failures, natural calamities, fire, malware such as ransomware, user error, malicious insiders, or software glitches. Managed backup services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to determine which of these fully managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of top information security companies to provide centralized management and world-class protection for your email traffic. The powerful structure of Email Guard managed service integrates a Cloud Protection Layer with an on-premises security gateway device to provide advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne malware. The cloud filter acts as a preliminary barricade and blocks the vast majority of unwanted email from reaching your security perimeter. This decreases your exposure to inbound threats and conserves network bandwidth and storage. Email Guard's onsite gateway device provides a further level of inspection for inbound email. For outbound email, the on-premises gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also help Exchange Server to monitor and protect internal email traffic that originates and ends inside your corporate firewall. For more details, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication services utilize Cisco's Duo technology to protect against password theft by using two-factor authentication (2FA). Duo enables single-tap identity verification with Apple iOS, Google Android, and other personal devices. Using Duo 2FA, whenever you sign into a protected online account and enter your password you are asked to verify who you are on a device that only you possess and that is accessed using a different network channel. A broad selection of devices can be used for this second means of authentication such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can register several verification devices. For details about Duo two-factor identity authentication services, see Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Service Desk: Call Center Managed Services
  Progent's Call Desk managed services permit your IT group to offload Support Desk services to Progent or divide responsibilities for Help Desk services seamlessly between your in-house network support group and Progent's nationwide roster of certified IT service engineers and subject matter experts. Progent's Shared Help Desk Service offers a transparent extension of your in-house IT support staff. Client interaction with the Service Desk, delivery of support, problem escalation, trouble ticket creation and updates, performance metrics, and maintenance of the support database are consistent whether issues are resolved by your corporate network support staff, by Progent, or by a combination. Read more about Progent's outsourced/co-managed Call Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior-based analysis technology to guard endpoint devices and physical and virtual servers against modern malware assaults such as ransomware and email phishing, which easily escape legacy signature-matching anti-virus products. Progent Active Security Monitoring services safeguard local and cloud-based resources and offers a unified platform to address the entire malware attack lifecycle including protection, infiltration detection, containment, cleanup, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new attacks. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and protect information about your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or serial numbers and be warned about upcoming expirations of SSL certificates ,domains or warranties. By cleaning up and managing your IT documentation, you can save as much as 50% of time spent searching for vital information about your network. ProSight IT Asset Management includes a common repository for holding and sharing all documents related to managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're planning improvements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you require the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide businesses of any size a flexible and affordable alternative for assessing, validating, scheduling, applying, and tracking software and firmware updates to your dynamic information system. In addition to optimizing the protection and functionality of your computer network, Progent's software/firmware update management services free up time for your in-house IT team to focus on more strategic projects and activities that derive the highest business value from your information network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host configured and managed by Progent's IT support experts. Under the ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system software, and the applications. Since the environment is virtualized, it can be ported easily to an alternate hardware solution without a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoint devices against new malware attacks like ransomware and email phishing, which routinely get by traditional signature-matching anti-virus products. ProSight ASM safeguards on-premises and cloud-based resources and provides a single platform to manage the complete malware attack lifecycle including filtering, infiltration detection, containment, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services deliver economical in-depth security for physical and virtual servers, workstations, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to cyber assaults from all vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, device control, and web filtering via leading-edge technologies packaged within one agent managed from a unified console. Progent's security and virtualization consultants can help you to design and implement a ProSight ESP deployment that meets your organization's specific requirements and that allows you prove compliance with government and industry information security standards. Progent will help you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that call for urgent attention. Progent can also help you to set up and verify a backup and restore system such as ProSight Data Protection Services so you can get back in business quickly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange email filtering.