24x7x365 Stockton Emergency Crypto-Ransomware
Computer Virus Assessment and Remediation Consultants

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyberplague that represents an extinction-level threat for businesses poorly prepared for an assault. Versions of ransomware like the CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for a long time and still inflict harm. Recent versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, along with daily unnamed viruses, not only encrypt online information but also infect all configured system backup. Files synchronized to the cloud can also be corrupted. In a vulnerable data protection solution, this can make automated restore operations hopeless and effectively sets the network back to zero.

Retrieving programs and data after a ransomware outage becomes a race against the clock as the victim fights to stop lateral movement, cleanup the crypto-ransomware, and resume enterprise-critical operations. Because ransomware needs time to spread, assaults are frequently sprung on weekends, when successful penetrations in many cases take more time to discover. This compounds the difficulty of quickly marshalling and coordinating a capable mitigation team.

Progent provides an assortment of support services for securing businesses from ransomware events. These include user education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of modern security appliances with AI technology from SentinelOne to identify and disable day-zero cyber threats automatically. Progent also can provide the services of experienced ransomware recovery professionals with the talent and commitment to re-deploy a compromised network as rapidly as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware invasion, paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the needed keys to unencrypt all your information. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never restored their data after having paid the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to re-install the key elements of your IT environment. Absent access to essential information backups, this calls for a broad range of IT skills, top notch project management, and the capability to work 24x7 until the recovery project is done.

For decades, Progent has made available certified expert IT services for businesses across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have earned high-level industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial systems and ERP applications. This breadth of experience provides Progent the capability to efficiently determine important systems and organize the remaining parts of your Information Technology system after a ransomware event and configure them into a functioning system.

Progent's ransomware team has best of breed project management systems to coordinate the complex recovery process. Progent appreciates the urgency of acting swiftly and in concert with a client's management and Information Technology team members to assign priority to tasks and to get key systems back on line as soon as humanly possible.

Client Case Study: A Successful Ransomware Intrusion Response
A client contacted Progent after their network was taken over by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state cybercriminals, possibly adopting algorithms exposed from the U.S. National Security Agency. Ryuk targets specific businesses with little or no ability to sustain operational disruption and is among the most lucrative instances of ransomware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in the Chicago metro area and has around 500 employees. The Ryuk attack had disabled all business operations and manufacturing capabilities. Most of the client's backups had been on-line at the start of the attack and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (more than $200,000) and praying for the best, but in the end engaged Progent.

Progent worked with the customer to quickly identify and assign priority to the key areas that needed to be restored in order to restart departmental functions:

• Microsoft Active Directory
• Electronic Messaging
• MRP System

Within 2 days, Progent was able to restore Active Directory services to its pre-penetration state. Progent then accomplished rebuilding and hard drive recovery of critical systems. All Exchange Server data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to collect local OST files (Outlook Offline Data Files) on staff desktop computers to recover mail data. A not too old offline backup of the client's accounting/ERP software made it possible to restore these vital services back on-line. Although significant work needed to be completed to recover totally from the Ryuk attack, essential services were recovered rapidly:

Over the following month critical milestones in the restoration process were accomplished in tight cooperation between Progent team members and the customer:

• Internal web sites were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server exceeding 4 million historical emails was restored to operations and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control capabilities were 100 percent recovered.
• A new Palo Alto 850 security appliance was set up.
• Most of the user PCs were back into operation.

Conclusion
A possible company-ending catastrophe was avoided by results-oriented professionals, a wide array of technical expertise, and close teamwork. Although upon completion of forensics the ransomware incident detailed here would have been shut down with modern security systems and security best practices, staff training, and well thought out incident response procedures for information backup and proper patching controls, the fact remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, feel confident that Progent's roster of professionals has substantial experience in crypto-ransomware virus blocking, cleanup, and information systems disaster recovery.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Stockton a variety of online monitoring and security assessment services to help you to minimize the threat from crypto-ransomware. These services include next-generation artificial intelligence technology to detect zero-day strains of crypto-ransomware that can evade legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to achieve advanced network resilience. Progent handles the necessary monitoring and management for you, so your system scales smoothly without holding you back. For an affordable and predictable monthly price, Progent's experienced IT team can be your dependable technology safety net. Basic plans include remote monitoring and management, security, automatic monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management (RMM) technology to keep your network operating efficiently by tracking the state of vital computers that power your information system. When ProSight LAN Watch uncovers a problem, an alert is sent automatically to your designated IT personnel and your Progent consultant so that any looming problems can be resolved before they have a chance to impact productivity. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for monitoring and managing your network, server, and desktop devices by providing tools for performing common tedious jobs. These include health monitoring, patch management, automated remediation, endpoint setup, backup and restore, anti-virus protection, remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your specified IT management personnel and your assigned Progent consultant so that potential issues can be fixed before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for smaller organizations to diagram, monitor, optimize and troubleshoot their networking appliances such as routers, firewalls, and load balancers plus servers, printers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network maps are kept updated, captures and manages the configuration information of almost all devices connected to your network, monitors performance, and sends alerts when problems are discovered. By automating tedious management activities, ProSight WAN Watch can cut hours off ordinary tasks such as network mapping, expanding your network, finding appliances that need important software patches, or resolving performance issues. Learn more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of real-time and in-depth reporting utilities designed to work with the industry's top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues like inconsistent support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore technology providers to produce ProSight Data Protection Services (DPS), a selection of subscription-based offerings that provide backup-as-a-service (BaaS). ProSight DPS products automate and track your backup processes and allow non-disruptive backup and rapid recovery of critical files, applications, images, plus virtual machines. ProSight DPS lets your business avoid data loss caused by hardware breakdown, natural calamities, fire, cyber attacks like ransomware, human error, ill-intentioned insiders, or application bugs. Managed services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to determine which of these managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of leading information security vendors to provide web-based management and comprehensive security for your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service integrates cloud-based filtering with a local security gateway appliance to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based threats. The Cloud Protection Layer acts as a preliminary barricade and keeps most threats from reaching your network firewall. This reduces your vulnerability to inbound threats and saves network bandwidth and storage space. Email Guard's on-premises gateway appliance provides a further level of inspection for incoming email. For outbound email, the on-premises security gateway offers anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local security gateway can also help Exchange Server to track and protect internal email that originates and ends inside your security perimeter. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services incorporate Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication (2FA). Duo supports one-tap identity confirmation on iOS, Google Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a protected application and give your password you are requested to verify your identity via a device that only you possess and that is accessed using a different network channel. A wide range of devices can be used for this second form of authentication including an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You may designate multiple validation devices. For more information about Duo two-factor identity validation services, refer to Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Service Desk: Support Desk Managed Services
  Progent's Support Center managed services enable your IT group to outsource Call Center services to Progent or split responsibilities for support services transparently between your in-house network support resources and Progent's nationwide pool of certified IT service engineers and subject matter experts. Progent's Shared Help Desk Service provides a seamless supplement to your in-house network support organization. Client interaction with the Service Desk, delivery of technical assistance, problem escalation, ticket generation and tracking, efficiency measurement, and management of the support database are consistent whether issues are resolved by your in-house network support resources, by Progent's team, or by a combination. Find out more about Progent's outsourced/co-managed Call Desk services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates next generation behavior-based analysis technology to defend endpoints as well as physical and virtual servers against new malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-matching anti-virus tools. Progent ASM services safeguard on-premises and cloud-based resources and offers a single platform to address the complete threat progression including filtering, detection, containment, remediation, and post-attack forensics. Key features include one-click rollback with Windows VSS and automatic network-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, find and safeguard data about your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or IP addresses and be alerted automatically about upcoming expirations of SSLs or domains. By cleaning up and managing your IT infrastructure documentation, you can eliminate up to half of time spent searching for critical information about your IT network. ProSight IT Asset Management features a centralized location for holding and sharing all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT data. Whether you're planning enhancements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you require the instant you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management provide organizations of any size a versatile and affordable solution for evaluating, testing, scheduling, implementing, and tracking software and firmware updates to your dynamic IT system. Besides maximizing the security and reliability of your IT network, Progent's software/firmware update management services allow your IT staff to focus on line-of-business projects and activities that deliver maximum business value from your network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected Tier III data center on a high-performance virtual host set up and maintained by Progent's network support experts. With Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the applications. Because the system is virtualized, it can be moved immediately to an alternate hosting environment without a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior-based machine learning technology to guard physical and virtual endpoints against new malware attacks such as ransomware and email phishing, which routinely evade legacy signature-matching anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud resources and offers a unified platform to manage the entire malware attack progression including protection, infiltration detection, mitigation, remediation, and post-attack forensics. Key capabilities include one-click rollback with Windows VSS and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer economical in-depth protection for physical servers and virtual machines, workstations, smartphones, and Microsoft Exchange. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to security assaults from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, endpoint management, and web filtering through cutting-edge tools packaged within a single agent managed from a single console. Progent's security and virtualization experts can assist your business to plan and configure a ProSight ESP deployment that meets your organization's specific needs and that allows you demonstrate compliance with legal and industry information security regulations. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for urgent action. Progent can also assist you to install and test a backup and restore solution such as ProSight Data Protection Services so you can recover rapidly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Microsoft Exchange email filtering.