San Juan 24/7/365 Critical CryptoLocker
Virus Detection and Repair Consulting

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyber pandemic that presents an extinction-level danger for businesses of all sizes vulnerable to an assault. Versions of ransomware such as CrySIS, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been circulating for a long time and continue to inflict havoc. The latest versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, along with more unnamed malware, not only encrypt on-line information but also infiltrate any accessible system protection mechanisms. Data replicated to off-site disaster recovery sites can also be ransomed. In a vulnerable data protection solution, it can make automated restoration hopeless and basically sets the datacenter back to square one.

Retrieving programs and information following a crypto-ransomware outage becomes a race against the clock as the targeted business tries its best to contain, eradicate the crypto-ransomware, and resume mission-critical activity. Due to the fact that ransomware requires time to replicate, penetrations are often launched on weekends, when attacks may take longer to detect. This compounds the difficulty of rapidly marshalling and organizing an experienced response team.

Progent provides a variety of solutions for protecting enterprises from ransomware penetrations. Among these are team education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with deployment of next-generation security solutions with AI technology from SentinelOne to detect and suppress day-zero cyber threats rapidly. Progent also can provide the assistance of veteran crypto-ransomware recovery engineers with the talent and commitment to rebuild a compromised system as quickly as possible.

Progent's Ransomware Restoration Support Services
After a ransomware attack, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will respond with the codes to decrypt all your files. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their data even after having paid the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to setup from scratch the mission-critical components of your Information Technology environment. Absent the availability of essential information backups, this calls for a broad range of IT skills, top notch team management, and the capability to work 24x7 until the job is finished.

For twenty years, Progent has provided expert Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have been awarded top certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of experience gives Progent the skills to rapidly ascertain important systems and integrate the surviving parts of your IT system after a ransomware penetration and rebuild them into an operational network.

Progent's ransomware group utilizes best of breed project management systems to orchestrate the complex recovery process. Progent understands the urgency of working swiftly and in unison with a customer's management and Information Technology staff to assign priority to tasks and to put critical services back on-line as fast as possible.

Case Study: A Successful Ransomware Intrusion Recovery
A small business contacted Progent after their company was attacked by the Ryuk ransomware. Ryuk is believed to have been developed by Northern Korean government sponsored hackers, suspected of adopting techniques exposed from the U.S. NSA organization. Ryuk seeks specific organizations with little room for disruption and is among the most profitable versions of ransomware malware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturing company based in Chicago and has about 500 workers. The Ryuk event had frozen all essential operations and manufacturing capabilities. Most of the client's backups had been online at the beginning of the attack and were encrypted. The client was evaluating paying the ransom (in excess of two hundred thousand dollars) and hoping for good luck, but ultimately utilized Progent.

Progent worked together with the client to rapidly understand and prioritize the essential applications that needed to be recovered to make it possible to resume departmental operations:

• Microsoft Active Directory
• Electronic Messaging
• MRP System

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then accomplished rebuilding and storage recovery of essential servers. All Exchange Server schema and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to find local OST files (Outlook Email Offline Folder Files) on user PCs and laptops in order to recover mail messages. A not too old off-line backup of the customer's accounting systems made it possible to recover these essential services back on-line. Although major work still had to be done to recover fully from the Ryuk virus, core services were recovered quickly:

Over the following couple of weeks important milestones in the recovery project were achieved in tight cooperation between Progent team members and the client:

• Self-hosted web sites were brought back up without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million archived emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were 100% operational.
• A new Palo Alto Networks 850 firewall was set up.
• Nearly all of the user desktops were being used by staff.

Conclusion
A possible company-ending catastrophe was avoided due to results-oriented professionals, a wide spectrum of knowledge, and close teamwork. Although in retrospect the ransomware virus incident detailed here would have been identified and prevented with advanced security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator education, and appropriate security procedures for data backup and keeping systems up to date with security patches, the reality remains that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware incident, feel confident that Progent's roster of professionals has substantial experience in ransomware virus defense, mitigation, and file restoration.

To review or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in San Juan a variety of online monitoring and security evaluation services designed to assist you to minimize the threat from ransomware. These services incorporate modern machine learning capability to uncover zero-day strains of ransomware that are able to escape detection by legacy signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve leading-edge network resilience. Progent takes care of the daily monitoring and maintenance for you, so your system expands easily without becoming an obstacle. For an affordable and predictable monthly price, Progent's experienced IT group can be your dependable technology safety net. Entry-level packages include RMM, cybersecurity, automatic monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management technology to help keep your IT system running at peak levels by checking the state of vital computers that drive your information system. When ProSight LAN Watch detects a problem, an alert is transmitted automatically to your designated IT management staff and your Progent engineering consultant so all looming issues can be resolved before they have a chance to impact productivity. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for managing your client-server infrastructure by providing an environment for streamlining common tedious tasks. These can include health checking, patch management, automated repairs, endpoint setup, backup and recovery, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alert to your designated IT management personnel and your assigned Progent consultant so emerging issues can be taken care of before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for small and mid-sized organizations to map, track, optimize and troubleshoot their networking appliances like routers, firewalls, and access points as well as servers, printers, endpoints and other networked devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network maps are always current, copies and manages the configuration information of virtually all devices on your network, monitors performance, and sends notices when potential issues are discovered. By automating complex management and troubleshooting processes, WAN Watch can knock hours off common tasks such as network mapping, expanding your network, finding devices that need important software patches, or isolating performance issues. Find out more details about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time and in-depth reporting utilities created to integrate with the leading ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as inconsistent support follow-up or endpoints with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has partnered with leading backup/restore technology providers to create ProSight Data Protection Services (DPS), a selection of subscription-based offerings that provide backup-as-a-service. ProSight DPS products automate and monitor your data backup processes and allow non-disruptive backup and fast recovery of important files, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business avoid data loss resulting from equipment breakdown, natural disasters, fire, malware such as ransomware, human mistakes, malicious employees, or application glitches. Managed services in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the infrastructure of top data security vendors to provide centralized management and world-class security for all your email traffic. The hybrid architecture of Progent's Email Guard managed service integrates cloud-based filtering with a local security gateway appliance to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The cloud filter serves as a first line of defense and keeps most threats from making it to your security perimeter. This decreases your exposure to external threats and saves network bandwidth and storage space. Email Guard's on-premises gateway appliance adds a further layer of analysis for inbound email. For outbound email, the on-premises security gateway offers AV and anti-spam protection, DLP, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends within your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication services incorporate Cisco's Duo technology to protect against stolen passwords through the use of two-factor authentication (2FA). Duo enables one-tap identity verification with Apple iOS, Android, and other out-of-band devices. With 2FA, whenever you log into a secured application and give your password you are requested to confirm your identity on a unit that only you possess and that is accessed using a separate network channel. A broad selection of out-of-band devices can be utilized for this added means of authentication such as an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You may register multiple validation devices. To find out more about Duo two-factor identity validation services, see Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Service Desk: Support Desk Managed Services
  Progent's Help Desk services enable your IT team to outsource Support Desk services to Progent or split activity for Help Desk services transparently between your in-house network support team and Progent's nationwide roster of IT service technicians, engineers and subject matter experts. Progent's Shared Help Desk Service offers a smooth extension of your core IT support group. End user interaction with the Help Desk, delivery of support, escalation, trouble ticket creation and updates, efficiency metrics, and management of the support database are consistent regardless of whether issues are taken care of by your core network support organization, by Progent, or by a combination. Find out more about Progent's outsourced/co-managed Call Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection solution that utilizes cutting edge behavior-based machine learning technology to guard endpoints as well as servers and VMs against modern malware attacks like ransomware and file-less exploits, which easily evade traditional signature-based anti-virus tools. Progent ASM services safeguard on-premises and cloud-based resources and provides a unified platform to address the complete threat progression including protection, infiltration detection, mitigation, cleanup, and forensics. Key capabilities include one-click rollback using Windows VSS and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, find and protect data related to your network infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be alerted about upcoming expirations of SSLs ,domains or warranties. By cleaning up and managing your network documentation, you can save up to 50% of time wasted searching for critical information about your network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents required for managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT data. Whether you're making enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you require when you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide organizations of all sizes a versatile and cost-effective alternative for assessing, validating, scheduling, applying, and documenting updates to your dynamic information network. In addition to optimizing the security and functionality of your IT environment, Progent's software/firmware update management services free up time for your IT team to focus on more strategic initiatives and tasks that derive maximum business value from your network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host configured and managed by Progent's network support professionals. With Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the OS platforms, and the applications. Since the system is virtualized, it can be moved immediately to a different hardware environment without a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoint devices against new malware attacks such as ransomware and email phishing, which routinely get by traditional signature-based AV products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and provides a unified platform to address the entire threat progression including filtering, infiltration detection, mitigation, cleanup, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services offer economical multi-layer protection for physical and virtual servers, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and responding to cyber threats from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, endpoint management, and web filtering through leading-edge technologies packaged within one agent accessible from a single control. Progent's data protection and virtualization experts can help you to plan and configure a ProSight ESP environment that addresses your organization's unique requirements and that helps you achieve and demonstrate compliance with legal and industry information security standards. Progent will assist you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that require urgent attention. Progent's consultants can also assist you to install and test a backup and restore system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange email filtering.