24-7 San Francisco Urgent Crypto
Computer Malware Damage Assessment and Repair Support

Ransomware : Your Feared Information Technology Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that presents an extinction-level danger for businesses of all sizes poorly prepared for an attack. Versions of ransomware such as Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been around for years and still inflict harm. The latest versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, as well as frequent as yet unnamed newcomers, not only encrypt on-line critical data but also infect most accessible system restores and backups. Data synched to the cloud can also be ransomed. In a poorly designed system, it can make automatic recovery impossible and effectively knocks the datacenter back to square one.

Getting back online applications and data after a ransomware event becomes a race against the clock as the victim tries its best to stop the spread, cleanup the virus, and resume enterprise-critical activity. Since ransomware requires time to replicate, penetrations are frequently launched during nights and weekends, when penetrations typically take longer to identify. This compounds the difficulty of quickly assembling and organizing a capable mitigation team.

Progent provides a range of solutions for protecting enterprises from ransomware penetrations. These include team member education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus installation of next-generation security gateways with machine learning technology from SentinelOne to detect and disable new cyber threats quickly. Progent also can provide the assistance of veteran ransomware recovery engineers with the skills and perseverance to rebuild a breached system as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Following a ransomware event, paying the ransom in cryptocurrency does not guarantee that cyber criminals will respond with the needed codes to unencrypt any or all of your information. Kaspersky determined that 17% of ransomware victims never recovered their data even after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The fallback is to piece back together the essential components of your Information Technology environment. Absent access to complete system backups, this requires a wide range of IT skills, top notch team management, and the capability to work 24x7 until the task is completed.

For two decades, Progent has made available certified expert Information Technology services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial management and ERP applications. This breadth of expertise affords Progent the capability to quickly ascertain critical systems and consolidate the surviving pieces of your network system after a ransomware event and configure them into a functioning system.

Progent's recovery team utilizes top notch project management tools to coordinate the sophisticated recovery process. Progent understands the importance of working swiftly and together with a customer's management and Information Technology staff to prioritize tasks and to get essential systems back on-line as fast as humanly possible.

Client Story: A Successful Ransomware Attack Restoration
A business engaged Progent after their company was attacked by Ryuk crypto-ransomware. Ryuk is believed to have been developed by Northern Korean state criminal gangs, possibly adopting algorithms exposed from the United States National Security Agency. Ryuk goes after specific organizations with limited room for operational disruption and is one of the most lucrative iterations of ransomware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in Chicago and has about 500 employees. The Ryuk penetration had disabled all business operations and manufacturing processes. Most of the client's information backups had been directly accessible at the start of the attack and were destroyed. The client was evaluating paying the ransom (more than two hundred thousand dollars) and hoping for the best, but in the end brought in Progent.

Progent worked with the client to quickly determine and assign priority to the essential services that needed to be restored to make it possible to continue departmental operations:

• Microsoft Active Directory
• E-Mail
• Financials/MRP

Within 48 hours, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then performed setup and hard drive recovery of the most important servers. All Exchange Server data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble intact OST data files (Outlook Email Offline Data Files) on team PCs in order to recover email data. A not too old off-line backup of the businesses manufacturing systems made them able to recover these required applications back available to users. Although a lot of work still had to be done to recover completely from the Ryuk event, core systems were recovered rapidly:

During the following few weeks critical milestones in the recovery process were completed in tight cooperation between Progent consultants and the customer:

• Internal web sites were brought back up with no loss of information.
• The MailStore Server containing more than 4 million archived emails was restored to operations and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable/Accounts Receivables/Inventory functions were completely functional.
• A new Palo Alto 850 security appliance was deployed.
• 90% of the desktops and laptops were functioning as before the incident.

Conclusion
A likely business extinction disaster was averted due to dedicated professionals, a broad range of technical expertise, and close collaboration. Although in retrospect the ransomware incident described here should have been stopped with up-to-date cyber security technology solutions and best practices, staff training, and appropriate security procedures for data protection and applying software patches, the fact remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware virus, feel confident that Progent's team of professionals has proven experience in crypto-ransomware virus blocking, remediation, and data restoration.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in San Francisco a portfolio of remote monitoring and security evaluation services to help you to minimize your vulnerability to crypto-ransomware. These services incorporate next-generation AI technology to detect new variants of ransomware that can escape detection by traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent takes care of the necessary monitoring and management for you, so your network scales smoothly without holding you back. For a low and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management, cybersecurity, automatic monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management technology to help keep your network running at peak levels by checking the health of vital assets that power your business network. When ProSight LAN Watch detects a problem, an alarm is sent automatically to your designated IT personnel and your assigned Progent consultant so that any potential problems can be resolved before they have a chance to impact productivity. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based solution for monitoring and managing your client-server infrastructure by providing tools for performing common tedious jobs. These can include health checking, patch management, automated remediation, endpoint setup, backup and restore, A/V protection, remote access, built-in and custom scripts, asset inventory, endpoint status reports, and debugging support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alert to your designated IT management personnel and your Progent consultant so that potential issues can be fixed before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized businesses to map out, track, optimize and troubleshoot their connectivity appliances like switches, firewalls, and access points plus servers, endpoints and other devices. Using cutting-edge RMM technology, ProSight WAN Watch ensures that network maps are always current, captures and manages the configuration of almost all devices connected to your network, tracks performance, and generates notices when potential issues are detected. By automating tedious management activities, ProSight WAN Watch can cut hours off common chores like making network diagrams, expanding your network, finding appliances that need important updates, or resolving performance issues. Find out more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time management reporting plug-ins created to integrate with the leading ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues such as inconsistent support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with advanced backup/restore technology providers to produce ProSight Data Protection Services, a family of management outsourcing plans that deliver backup-as-a-service. ProSight DPS products manage and track your backup processes and allow non-disruptive backup and fast restoration of important files, apps, images, plus virtual machines. ProSight DPS helps you avoid data loss resulting from hardware breakdown, natural disasters, fire, cyber attacks like ransomware, user mistakes, malicious insiders, or software glitches. Managed backup services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading information security companies to provide web-based control and world-class security for your inbound and outbound email. The powerful structure of Progent's Email Guard combines a Cloud Protection Layer with an on-premises gateway appliance to provide complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The Cloud Protection Layer serves as a first line of defense and blocks most unwanted email from reaching your security perimeter. This reduces your exposure to external threats and saves system bandwidth and storage space. Email Guard's on-premises security gateway device provides a deeper layer of analysis for incoming email. For outgoing email, the on-premises gateway offers AV and anti-spam protection, DLP, and email encryption. The local security gateway can also assist Exchange Server to monitor and safeguard internal email that stays inside your security perimeter. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication. Duo enables one-tap identity confirmation with iOS, Android, and other out-of-band devices. Using 2FA, whenever you sign into a protected online account and enter your password you are requested to confirm your identity on a device that only you have and that uses a separate network channel. A broad range of devices can be used as this second means of authentication including an iPhone or Android or watch, a hardware token, a landline phone, etc. You may register multiple verification devices. To learn more about Duo identity authentication services, refer to Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Desk: Support Desk Managed Services
  Progent's Support Center services enable your IT team to outsource Call Center services to Progent or split responsibilities for Service Desk support seamlessly between your in-house support group and Progent's nationwide roster of certified IT support engineers and subject matter experts. Progent's Shared Help Desk Service offers a transparent supplement to your corporate support organization. User interaction with the Help Desk, delivery of support, problem escalation, trouble ticket generation and updates, efficiency measurement, and maintenance of the support database are consistent whether incidents are taken care of by your in-house support group, by Progent's team, or both. Find out more about Progent's outsourced/shared Service Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior analysis tools to guard endpoint devices as well as servers and VMs against modern malware assaults like ransomware and email phishing, which easily evade traditional signature-based anti-virus tools. Progent Active Security Monitoring services protect on-premises and cloud-based resources and offers a unified platform to automate the complete threat lifecycle including protection, detection, containment, remediation, and forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against new attacks. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, retrieve and protect information related to your IT infrastructure, procedures, applications, and services. You can quickly locate passwords or serial numbers and be warned about upcoming expirations of SSL certificates or domains. By cleaning up and managing your IT documentation, you can eliminate as much as half of time thrown away trying to find critical information about your network. ProSight IT Asset Management includes a common repository for holding and sharing all documents related to managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT data. Whether you're planning improvements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management provide businesses of any size a flexible and cost-effective solution for assessing, validating, scheduling, applying, and documenting software and firmware updates to your dynamic IT network. In addition to optimizing the security and reliability of your IT network, Progent's software/firmware update management services allow your IT staff to concentrate on line-of-business initiatives and tasks that deliver the highest business value from your information network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual machine host configured and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the client owns the data, the operating system software, and the apps. Because the system is virtualized, it can be ported immediately to a different hardware solution without a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's next generation behavior-based analysis tools to guard physical and virtual endpoint devices against modern malware attacks like ransomware and file-less exploits, which easily escape legacy signature-matching AV tools. ProSight ASM protects local and cloud-based resources and provides a single platform to address the complete malware attack lifecycle including filtering, infiltration detection, containment, cleanup, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver affordable multi-layer protection for physical servers and VMs, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and advanced heuristics for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP delivers firewall protection, intrusion alerts, endpoint management, and web filtering through cutting-edge tools packaged within one agent accessible from a unified control. Progent's data protection and virtualization experts can help your business to design and implement a ProSight ESP environment that addresses your company's unique requirements and that allows you demonstrate compliance with government and industry data protection regulations. Progent will help you define and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that require urgent action. Progent's consultants can also assist your company to install and test a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.