24/7 Santos Urgent Ransomware
Computer Virus Detection and Remediation Experts

Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that represents an extinction-level threat for organizations vulnerable to an assault. Multiple generations of crypto-ransomware such as CrySIS, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been replicating for many years and still cause damage. Recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, as well as additional unnamed newcomers, not only encrypt on-line data files but also infiltrate many accessible system protection mechanisms. Data synchronized to cloud environments can also be held hostage. In a vulnerable system, this can make any restoration impossible and effectively knocks the entire system back to zero.

Recovering programs and information after a ransomware event becomes a race against the clock as the targeted organization fights to stop lateral movement, cleanup the crypto-ransomware, and restore mission-critical activity. Due to the fact that ransomware requires time to move laterally, penetrations are usually launched on weekends, when successful attacks typically take longer to notice. This compounds the difficulty of quickly marshalling and orchestrating a qualified mitigation team.

Progent provides a range of solutions for protecting enterprises from ransomware events. Among these are user training to help recognize and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of modern security solutions with machine learning capabilities from SentinelOne to discover and suppress new threats automatically. Progent also can provide the services of expert crypto-ransomware recovery professionals with the talent and perseverance to restore a breached network as soon as possible.

Progent's Ransomware Recovery Services
After a ransomware penetration, even paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will respond with the needed codes to unencrypt any or all of your data. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never restored their data even after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to re-install the mission-critical components of your IT environment. Absent the availability of complete data backups, this requires a wide range of skills, well-coordinated project management, and the ability to work non-stop until the recovery project is over.

For decades, Progent has made available expert Information Technology services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have earned internationally-renowned industry certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of experience affords Progent the capability to quickly identify important systems and re-organize the surviving parts of your IT environment following a crypto-ransomware penetration and assemble them into an operational network.

Progent's security team of experts has top notch project management applications to orchestrate the sophisticated recovery process. Progent understands the urgency of acting quickly and in unison with a customer's management and IT team members to assign priority to tasks and to get essential applications back online as fast as humanly possible.

Customer Case Study: A Successful Crypto-Ransomware Intrusion Restoration
A small business escalated to Progent after their network system was taken over by Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored criminal gangs, possibly adopting algorithms leaked from the U.S. National Security Agency. Ryuk seeks specific companies with little or no ability to sustain operational disruption and is among the most lucrative versions of crypto-ransomware. Headline victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing company located in Chicago with around 500 staff members. The Ryuk event had disabled all essential operations and manufacturing capabilities. Most of the client's data protection had been on-line at the time of the attack and were eventually encrypted. The client was taking steps for paying the ransom (more than $200K) and praying for the best, but in the end brought in Progent.

Progent worked with the client to quickly get our arms around and prioritize the critical areas that needed to be restored in order to resume departmental operations:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-intrusion state. Progent then accomplished rebuilding and storage recovery on needed systems. All Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was able to assemble local OST data files (Outlook Off-Line Folder Files) on various desktop computers in order to recover mail information. A not too old off-line backup of the client's financials/MRP software made them able to restore these required services back online. Although a large amount of work needed to be completed to recover fully from the Ryuk virus, critical services were restored quickly:

During the next few weeks critical milestones in the restoration process were accomplished through close cooperation between Progent engineers and the customer:

• Internal web sites were restored with no loss of information.
• The MailStore Microsoft Exchange Server exceeding 4 million archived messages was brought online and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory functions were fully functional.
• A new Palo Alto Networks 850 firewall was brought on-line.
• 90% of the user workstations were back into operation.

Conclusion
A likely company-ending disaster was evaded due to top-tier experts, a wide range of technical expertise, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware penetration detailed here should have been identified and prevented with up-to-date security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and well designed incident response procedures for information protection and keeping systems up to date with security patches, the fact remains that government-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware attack, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, remediation, and data disaster recovery.

To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Santos a range of remote monitoring and security evaluation services designed to assist you to reduce your vulnerability to ransomware. These services utilize next-generation artificial intelligence technology to uncover new variants of crypto-ransomware that can escape detection by traditional signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to achieve leading-edge IT resilience. Progent handles the necessary monitoring and maintenance for you, so your network scales smoothly without holding you back. For an affordable and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Basic plans include remote monitoring and management, cybersecurity, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to best-in-class solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management techniques to keep your IT system running efficiently by tracking the state of critical assets that power your information system. When ProSight LAN Watch uncovers an issue, an alert is sent automatically to your specified IT staff and your assigned Progent consultant so any looming problems can be addressed before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for monitoring and managing your network, server, and desktop devices by providing tools for streamlining common tedious tasks. These can include health monitoring, patch management, automated remediation, endpoint deployment, backup and recovery, anti-virus defense, remote access, standard and custom scripts, resource inventory, endpoint profile reports, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM spots a serious incident, it transmits an alarm to your designated IT management personnel and your assigned Progent technical consultant so potential issues can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for smaller businesses to map, monitor, reconfigure and debug their networking hardware like routers, firewalls, and access points plus servers, printers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology maps are always updated, captures and displays the configuration information of virtually all devices on your network, monitors performance, and sends notices when potential issues are discovered. By automating time-consuming management and troubleshooting activities, WAN Watch can cut hours off ordinary chores such as network mapping, reconfiguring your network, finding devices that require important updates, or resolving performance bottlenecks. Find out more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of in-depth reporting tools designed to integrate with the top ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues like inconsistent support follow-up or endpoints with missing patches. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with leading backup software companies to create ProSight Data Protection Services (DPS), a portfolio of management offerings that provide backup-as-a-service. ProSight DPS services automate and monitor your backup processes and allow non-disruptive backup and rapid recovery of vital files, apps, images, plus virtual machines. ProSight DPS helps you avoid data loss resulting from hardware failures, natural calamities, fire, cyber attacks like ransomware, user error, malicious insiders, or application bugs. Managed backup services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of leading information security vendors to provide web-based control and comprehensive security for your inbound and outbound email. The hybrid architecture of Progent's Email Guard combines cloud-based filtering with a local gateway device to provide advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-based threats. The Cloud Protection Layer serves as a preliminary barricade and keeps the vast majority of unwanted email from making it to your network firewall. This reduces your exposure to inbound threats and saves network bandwidth and storage. Email Guard's on-premises gateway appliance adds a deeper level of inspection for inbound email. For outgoing email, the local security gateway offers AV and anti-spam filtering, DLP, and email encryption. The onsite security gateway can also help Exchange Server to track and protect internal email traffic that originates and ends within your corporate firewall. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA services utilize Cisco's Duo cloud technology to protect against stolen passwords through the use of two-factor authentication. Duo supports one-tap identity confirmation with iOS, Google Android, and other out-of-band devices. Using 2FA, whenever you sign into a protected online account and give your password you are requested to confirm your identity via a unit that only you possess and that is accessed using a separate network channel. A wide selection of devices can be utilized for this second means of authentication including an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can register multiple verification devices. To find out more about Duo identity authentication services, visit Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Service Desk: Help Desk Managed Services
  Progent's Help Desk services enable your information technology group to outsource Support Desk services to Progent or split activity for support services seamlessly between your in-house network support resources and Progent's nationwide roster of IT support technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service offers a smooth supplement to your in-house support resources. User interaction with the Help Desk, provision of technical assistance, problem escalation, ticket generation and updates, efficiency measurement, and maintenance of the service database are cohesive regardless of whether issues are taken care of by your in-house support group, by Progent, or both. Read more about Progent's outsourced/co-managed Service Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior-based analysis tools to guard endpoints as well as servers and VMs against new malware attacks such as ransomware and email phishing, which routinely evade legacy signature-matching anti-virus products. Progent ASM services protect local and cloud-based resources and provides a single platform to manage the complete threat progression including filtering, identification, containment, remediation, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, retrieve and safeguard information about your IT infrastructure, procedures, business apps, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSL certificates or warranties. By updating and managing your network documentation, you can eliminate as much as half of time wasted searching for critical information about your IT network. ProSight IT Asset Management includes a centralized location for holding and sharing all documents related to managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and relating IT information. Whether you're making improvements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you need the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer businesses of all sizes a flexible and cost-effective alternative for assessing, validating, scheduling, implementing, and documenting updates to your dynamic information system. Besides maximizing the protection and functionality of your IT environment, Progent's software/firmware update management services free up time for your IT staff to concentrate on line-of-business projects and activities that deliver the highest business value from your network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual host configured and managed by Progent's network support experts. Under Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the applications. Since the system is virtualized, it can be ported easily to a different hosting environment without requiring a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior analysis technology to guard physical and virtual endpoint devices against modern malware assaults such as ransomware and email phishing, which easily get by legacy signature-based anti-virus tools. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a unified platform to automate the entire threat progression including blocking, identification, containment, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer economical multi-layer protection for physical and virtual servers, workstations, smartphones, and Exchange Server. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and responding to security assaults from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, endpoint management, and web filtering via cutting-edge technologies incorporated within one agent accessible from a unified control. Progent's data protection and virtualization consultants can help your business to plan and implement a ProSight ESP environment that addresses your organization's specific needs and that helps you demonstrate compliance with legal and industry data security regulations. Progent will assist you define and implement security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alarms that require immediate attention. Progent can also assist you to set up and verify a backup and disaster recovery system such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.