Savannah 24-Hour Emergency Ransomware
Computer Malware Identification and Removal Services

Ransomware : Your Feared IT Nightmare
Crypto-Ransomware has become a modern cyberplague that poses an enterprise-level danger for businesses of all sizes poorly prepared for an assault. Different iterations of crypto-ransomware such as CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for many years and continue to inflict damage. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, along with daily unnamed viruses, not only do encryption of online files but also infect most available system restores and backups. Data synched to cloud environments can also be ransomed. In a poorly architected data protection solution, this can make any restoration hopeless and effectively sets the datacenter back to zero.

Getting back programs and information following a ransomware attack becomes a sprint against the clock as the targeted business fights to stop lateral movement, eradicate the ransomware, and restore mission-critical activity. Since ransomware requires time to move laterally, penetrations are usually launched during weekends and nights, when attacks in many cases take more time to identify. This compounds the difficulty of quickly mobilizing and coordinating a qualified mitigation team.

Progent has a range of solutions for securing businesses from ransomware events. These include team education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of next-generation security appliances with machine learning capabilities from SentinelOne to discover and quarantine day-zero cyber threats quickly. Progent in addition offers the services of veteran crypto-ransomware recovery engineers with the skills and perseverance to restore a compromised environment as quickly as possible.

Progent's Ransomware Recovery Services
After a ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that distant criminals will provide the needed codes to unencrypt any or all of your data. Kaspersky ascertained that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to setup from scratch the essential parts of your Information Technology environment. Absent the availability of complete system backups, this requires a wide complement of skill sets, well-coordinated team management, and the capability to work non-stop until the recovery project is over.

For two decades, Progent has made available professional Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained high-level industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in accounting and ERP software solutions. This breadth of experience gives Progent the ability to rapidly understand critical systems and re-organize the remaining parts of your Information Technology environment following a ransomware event and rebuild them into a functioning system.

Progent's recovery team of experts uses state-of-the-art project management applications to orchestrate the complex recovery process. Progent understands the importance of acting rapidly and in concert with a client's management and IT staff to prioritize tasks and to get the most important applications back on-line as soon as humanly possible.

Customer Story: A Successful Ransomware Penetration Response
A customer escalated to Progent after their organization was brought down by the Ryuk crypto-ransomware. Ryuk is thought to have been created by Northern Korean state criminal gangs, suspected of using techniques exposed from America's NSA organization. Ryuk attacks specific businesses with limited tolerance for disruption and is one of the most profitable iterations of ransomware. Major organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in Chicago with about 500 staff members. The Ryuk penetration had frozen all business operations and manufacturing processes. The majority of the client's backups had been directly accessible at the beginning of the intrusion and were encrypted. The client was pursuing financing for paying the ransom (in excess of $200,000) and hoping for the best, but ultimately engaged Progent.

Progent worked with the customer to rapidly understand and prioritize the critical systems that needed to be addressed in order to resume departmental operations:

• Windows Active Directory
• E-Mail
• Accounting/MRP

Within two days, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then initiated setup and hard drive recovery of needed systems. All Exchange data and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to collect intact OST files (Outlook Offline Data Files) on team PCs to recover email information. A not too old offline backup of the businesses accounting/ERP software made them able to recover these essential applications back on-line. Although significant work needed to be completed to recover completely from the Ryuk event, core systems were restored quickly:

Throughout the following few weeks important milestones in the recovery process were completed in close cooperation between Progent team members and the client:

• Self-hosted web applications were restored without losing any data.
• The MailStore Microsoft Exchange Server containing more than four million archived messages was restored to operations and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory capabilities were 100 percent recovered.
• A new Palo Alto 850 firewall was brought online.
• Ninety percent of the user desktops and notebooks were back into operation.

Conclusion
A likely business extinction disaster was averted through the efforts of dedicated experts, a broad array of technical expertise, and tight teamwork. Although in analyzing the event afterwards the crypto-ransomware attack detailed here would have been identified and stopped with up-to-date cyber security technology and best practices, team training, and well thought out incident response procedures for backup and proper patching controls, the fact is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware virus, feel confident that Progent's team of professionals has substantial experience in ransomware virus blocking, remediation, and file restoration.

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide businesses in Savannah a portfolio of online monitoring and security assessment services designed to assist you to minimize your vulnerability to ransomware. These services include next-generation machine learning technology to detect zero-day variants of crypto-ransomware that can escape detection by traditional signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create advanced network resilience. Progent takes care of the daily monitoring and management for you, so your network scales readily without holding you back. For an affordable and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Entry-level packages include remote monitoring and management (RMM), cybersecurity, monthly patching, and documentation. As your requirements expand, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) techniques to help keep your IT system operating efficiently by checking the health of vital computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your designated IT staff and your assigned Progent engineering consultant so all looming issues can be addressed before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for monitoring and managing your network, server, and desktop devices by providing tools for streamlining common tedious tasks. These can include health monitoring, patch management, automated repairs, endpoint setup, backup and recovery, A/V response, secure remote access, standard and custom scripts, resource inventory, endpoint status reports, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alert to your specified IT staff and your assigned Progent technical consultant so that emerging problems can be taken care of before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller businesses to map, track, optimize and debug their networking appliances like switches, firewalls, and load balancers as well as servers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, WAN Watch ensures that network maps are kept current, captures and manages the configuration information of virtually all devices on your network, monitors performance, and sends notices when issues are detected. By automating time-consuming management processes, WAN Watch can cut hours off ordinary chores like network mapping, expanding your network, finding devices that require important software patches, or isolating performance issues. Find out more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time and in-depth management reporting utilities designed to integrate with the top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like inconsistent support follow-through or machines with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup/restore software providers to create ProSight Data Protection Services, a family of subscription-based management offerings that provide backup-as-a-service. ProSight DPS products manage and monitor your data backup operations and enable non-disruptive backup and rapid recovery of critical files, applications, system images, and virtual machines. ProSight DPS helps your business recover from data loss caused by hardware breakdown, natural calamities, fire, cyber attacks such as ransomware, user error, ill-intentioned insiders, or application glitches. Managed services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading information security companies to deliver web-based control and world-class protection for all your inbound and outbound email. The powerful structure of Email Guard integrates a Cloud Protection Layer with an on-premises gateway device to offer advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-borne threats. Email Guard's cloud filter serves as a first line of defense and blocks most threats from reaching your security perimeter. This decreases your vulnerability to external threats and conserves system bandwidth and storage. Email Guard's on-premises gateway device adds a deeper level of analysis for inbound email. For outgoing email, the local gateway provides AV and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also help Microsoft Exchange Server to monitor and safeguard internal email traffic that stays within your corporate firewall. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication service plans utilize Cisco's Duo technology to protect against password theft through the use of two-factor authentication (2FA). Duo enables one-tap identity verification with iOS, Android, and other personal devices. With 2FA, when you log into a protected online account and give your password you are asked to confirm your identity on a unit that only you have and that is accessed using a different ("out-of-band") network channel. A wide selection of out-of-band devices can be utilized for this second form of ID validation such as a smartphone or watch, a hardware token, a landline telephone, etc. You may register multiple verification devices. To learn more about ProSight Duo two-factor identity validation services, go to Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Service Center: Help Desk Managed Services
  Progent's Help Desk managed services permit your IT staff to offload Support Desk services to Progent or split responsibilities for support services transparently between your internal support resources and Progent's extensive roster of certified IT support technicians, engineers and subject matter experts. Progent's Co-managed Service Desk provides a smooth supplement to your internal network support team. Client interaction with the Service Desk, delivery of technical assistance, problem escalation, trouble ticket creation and updates, performance metrics, and management of the support database are consistent whether issues are taken care of by your core network support resources, by Progent, or by a combination. Read more about Progent's outsourced/shared Service Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes cutting edge behavior analysis tools to defend endpoint devices and servers and VMs against modern malware assaults such as ransomware and file-less exploits, which easily evade legacy signature-based anti-virus tools. Progent ASM services protect local and cloud resources and offers a single platform to manage the entire malware attack progression including blocking, identification, containment, remediation, and post-attack forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, retrieve and safeguard data related to your IT infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be warned about impending expirations of SSLs ,domains or warranties. By updating and organizing your IT documentation, you can eliminate as much as 50% of time spent searching for critical information about your IT network. ProSight IT Asset Management features a common repository for holding and collaborating on all documents required for managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT data. Whether you're planning enhancements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the information you require when you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of all sizes a versatile and affordable alternative for assessing, testing, scheduling, applying, and tracking updates to your dynamic information system. Besides maximizing the security and reliability of your IT network, Progent's patch management services free up time for your in-house IT staff to concentrate on line-of-business projects and tasks that deliver maximum business value from your information network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a secure Tier III data center on a fast virtual machine host set up and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the OS platforms, and the apps. Because the environment is virtualized, it can be moved immediately to an alternate hosting environment without requiring a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, you are not tied a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection service that utilizes SentinelOne's cutting edge behavior-based machine learning technology to defend physical and virtual endpoints against modern malware attacks such as ransomware and email phishing, which routinely escape traditional signature-matching anti-virus tools. ProSight ASM safeguards on-premises and cloud resources and offers a unified platform to address the complete malware attack lifecycle including filtering, detection, containment, cleanup, and forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services deliver economical in-depth security for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and modern behavior analysis for round-the-clock monitoring and responding to cyber threats from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alerts, endpoint control, and web filtering through leading-edge technologies packaged within one agent managed from a unified console. Progent's security and virtualization consultants can help you to design and implement a ProSight ESP environment that meets your organization's unique needs and that helps you achieve and demonstrate compliance with legal and industry data security regulations. Progent will assist you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that call for urgent attention. Progent can also assist you to set up and verify a backup and disaster recovery solution such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange email filtering.