24x7 Springfield Critical Ransomware
Malware Assessment and Restoration Consulting

Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a modern cyberplague that presents an existential danger for organizations poorly prepared for an attack. Different iterations of ransomware such as CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for years and continue to cause havoc. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, as well as frequent unnamed newcomers, not only encrypt online data but also infect many accessible system backups. Data synchronized to the cloud can also be corrupted. In a poorly architected system, it can render automatic restoration hopeless and effectively sets the datacenter back to zero.

Getting back services and data after a ransomware outage becomes a sprint against time as the victim fights to stop lateral movement, eradicate the virus, and resume business-critical activity. Because ransomware takes time to replicate, assaults are often launched at night, when attacks tend to take longer to identify. This compounds the difficulty of quickly assembling and coordinating a capable response team.

Progent has a variety of help services for protecting businesses from ransomware attacks. Among these are user training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of the latest generation security appliances with machine learning capabilities from SentinelOne to discover and disable day-zero cyber threats quickly. Progent also provides the services of veteran ransomware recovery professionals with the talent and perseverance to rebuild a breached environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
After a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the codes to decipher any of your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to re-install the key elements of your IT environment. Without the availability of full information backups, this requires a broad complement of IT skills, professional team management, and the willingness to work 24x7 until the recovery project is complete.

For twenty years, Progent has made available expert Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have attained high-level industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in accounting and ERP software solutions. This breadth of expertise gives Progent the capability to rapidly identify necessary systems and consolidate the remaining parts of your network system after a crypto-ransomware penetration and assemble them into an operational network.

Progent's ransomware team uses top notch project management tools to coordinate the complex restoration process. Progent knows the urgency of working quickly and in concert with a client's management and IT resources to assign priority to tasks and to put essential applications back on line as fast as possible.

Client Story: A Successful Ransomware Virus Restoration
A small business sought out Progent after their network system was taken over by Ryuk ransomware virus. Ryuk is believed to have been developed by Northern Korean state sponsored hackers, possibly adopting approaches exposed from the U.S. National Security Agency. Ryuk targets specific companies with limited room for disruption and is one of the most profitable incarnations of crypto-ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in Chicago and has around 500 staff members. The Ryuk intrusion had frozen all company operations and manufacturing capabilities. Most of the client's data protection had been online at the time of the attack and were encrypted. The client was evaluating paying the ransom (exceeding $200K) and hoping for good luck, but ultimately called Progent.

Progent worked hand in hand the client to quickly identify and prioritize the essential elements that had to be addressed in order to restart departmental operations:

• Active Directory (AD)
• Microsoft Exchange Email
• MRP System

In less than 2 days, Progent was able to recover Active Directory services to its pre-intrusion state. Progent then initiated reinstallations and hard drive recovery of key systems. All Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to locate intact OST data files (Microsoft Outlook Offline Data Files) on team workstations to recover email information. A not too old off-line backup of the client's accounting/MRP systems made it possible to return these essential programs back online. Although significant work was left to recover completely from the Ryuk virus, the most important systems were restored quickly:

During the next month key milestones in the restoration project were achieved through close collaboration between Progent team members and the customer:

• Self-hosted web sites were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server containing more than four million archived messages was brought on-line and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory functions were 100% recovered.
• A new Palo Alto 850 firewall was brought online.
• Ninety percent of the user workstations were back into operation.

Conclusion
A potential business extinction catastrophe was avoided due to hard-working professionals, a broad spectrum of subject matter expertise, and tight collaboration. Although in retrospect the crypto-ransomware incident detailed here should have been identified and prevented with current cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and well thought out incident response procedures for information protection and applying software patches, the fact is that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and are not going away. If you do fall victim to a ransomware incursion, remember that Progent's roster of professionals has a proven track record in crypto-ransomware virus defense, removal, and information systems disaster recovery.

To review or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers companies in Springfield a range of online monitoring and security evaluation services to help you to reduce your vulnerability to crypto-ransomware. These services include modern machine learning capability to detect new strains of ransomware that can evade legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent handles the necessary monitoring and maintenance for you, so your network scales smoothly without holding you back. For a low and predictable monthly subscription, Progent's experienced IT group can be your dependable technology safety net. Entry-level packages include RMM, cybersecurity, automatic monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management technology to help keep your network running efficiently by tracking the health of vital assets that power your information system. When ProSight LAN Watch detects a problem, an alert is sent immediately to your designated IT management staff and your Progent consultant so all potential issues can be resolved before they have a chance to impact your network. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for managing your network, server, and desktop devices by providing an environment for streamlining common time-consuming tasks. These can include health monitoring, patch management, automated remediation, endpoint deployment, backup and recovery, anti-virus response, remote access, standard and custom scripts, asset inventory, endpoint status reporting, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it transmits an alert to your designated IT management personnel and your Progent technical consultant so potential issues can be taken care of before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for smaller organizations to diagram, track, optimize and troubleshoot their networking appliances like switches, firewalls, and wireless controllers plus servers, printers, endpoints and other networked devices. Using state-of-the-art RMM technology, ProSight WAN Watch ensures that infrastructure topology maps are kept updated, captures and manages the configuration of virtually all devices connected to your network, monitors performance, and sends notices when potential issues are detected. By automating tedious management processes, WAN Watch can knock hours off common chores such as network mapping, expanding your network, finding appliances that need critical updates, or isolating performance bottlenecks. Find out more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of real-time and in-depth management reporting plug-ins designed to integrate with the top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues such as spotty support follow-through or machines with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with advanced backup technology companies to create ProSight Data Protection Services (DPS), a portfolio of subscription-based management offerings that provide backup-as-a-service (BaaS). ProSight DPS products manage and monitor your data backup processes and allow non-disruptive backup and rapid restoration of critical files, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business avoid data loss resulting from equipment failures, natural calamities, fire, cyber attacks like ransomware, human error, ill-intentioned employees, or software glitches. Managed services available in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to identify which of these fully managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the infrastructure of leading data security companies to provide web-based management and comprehensive security for all your email traffic. The hybrid structure of Progent's Email Guard combines a Cloud Protection Layer with a local security gateway device to provide advanced defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne malware. Email Guard's cloud filter acts as a preliminary barricade and blocks the vast majority of threats from making it to your security perimeter. This reduces your vulnerability to external attacks and conserves network bandwidth and storage. Email Guard's on-premises gateway appliance adds a further layer of inspection for inbound email. For outbound email, the local gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also assist Exchange Server to monitor and safeguard internal email traffic that stays inside your corporate firewall. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo MFA managed services incorporate Cisco's Duo technology to defend against stolen passwords by using two-factor authentication. Duo supports single-tap identity confirmation with iOS, Google Android, and other personal devices. With Duo 2FA, whenever you sign into a secured online account and give your password you are asked to confirm who you are via a device that only you have and that is accessed using a different ("out-of-band") network channel. A broad selection of out-of-band devices can be utilized as this added form of ID validation such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can designate several verification devices. For more information about ProSight Duo two-factor identity authentication services, refer to Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Service Desk: Call Center Managed Services
  Progent's Support Desk managed services allow your IT team to offload Support Desk services to Progent or split activity for Help Desk services seamlessly between your internal network support staff and Progent's extensive pool of certified IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a transparent supplement to your internal IT support staff. End user access to the Help Desk, delivery of technical assistance, issue escalation, trouble ticket creation and tracking, performance measurement, and management of the service database are cohesive regardless of whether incidents are resolved by your core network support staff, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/co-managed Help Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that incorporates next generation behavior-based machine learning tools to defend endpoints and physical and virtual servers against new malware assaults such as ransomware and email phishing, which easily escape legacy signature-based AV products. Progent Active Security Monitoring services safeguard on-premises and cloud resources and offers a single platform to manage the complete threat progression including blocking, infiltration detection, containment, cleanup, and post-attack forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered attacks. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, find and protect information about your IT infrastructure, processes, business apps, and services. You can quickly find passwords or serial numbers and be warned automatically about impending expirations of SSL certificates or warranties. By updating and managing your network documentation, you can save as much as half of time thrown away trying to find vital information about your network. ProSight IT Asset Management features a common location for storing and sharing all documents related to managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and relating IT information. Whether you're making enhancements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you require the instant you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide organizations of any size a flexible and affordable alternative for assessing, testing, scheduling, implementing, and tracking software and firmware updates to your ever-evolving IT network. Besides optimizing the security and reliability of your IT network, Progent's software/firmware update management services permit your in-house IT team to concentrate on more strategic initiatives and tasks that derive maximum business value from your network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host set up and maintained by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the OS platforms, and the apps. Because the environment is virtualized, it can be moved immediately to an alternate hosting solution without a time-consuming and difficult configuration process. With ProSight Virtual Hosting, you are not tied one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior-based analysis technology to defend physical and virtual endpoints against modern malware attacks such as ransomware and file-less exploits, which routinely escape legacy signature-based AV products. ProSight Active Security Monitoring protects on-premises and cloud-based resources and offers a single platform to manage the entire threat lifecycle including filtering, detection, mitigation, cleanup, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services offer ultra-affordable in-depth security for physical and virtual servers, workstations, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced heuristics for round-the-clock monitoring and responding to cyber threats from all attack vectors. ProSight ESP provides firewall protection, penetration alerts, endpoint control, and web filtering through leading-edge technologies packaged within a single agent accessible from a unified control. Progent's security and virtualization consultants can assist you to design and implement a ProSight ESP environment that meets your organization's unique needs and that allows you demonstrate compliance with legal and industry data security standards. Progent will assist you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that require immediate action. Progent can also help your company to set up and verify a backup and disaster recovery solution like ProSight Data Protection Services so you can recover rapidly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange filtering.