Uberlândia 24/7 Emergency CryptoLocker
Computer Virus Assessment and Remediation Services

Crypto-Ransomware : Your Feared Information Technology Disaster
Ransomware has become an escalating cyberplague that poses an enterprise-level danger for organizations poorly prepared for an assault. Versions of ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and continue to cause havoc. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, as well as more unnamed malware, not only encrypt online information but also infect all available system protection. Data replicated to cloud environments can also be held hostage. In a poorly architected system, it can make automated recovery impossible and effectively sets the entire system back to zero.

Retrieving applications and information after a crypto-ransomware attack becomes a sprint against time as the targeted organization fights to contain, remove the ransomware, and resume business-critical activity. Since ransomware takes time to spread, penetrations are often sprung during nights and weekends, when penetrations in many cases take more time to identify. This multiplies the difficulty of rapidly mobilizing and coordinating a qualified mitigation team.

Progent has an assortment of help services for protecting businesses from crypto-ransomware attacks. Among these are team member education to help identify and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of modern security solutions with AI technology from SentinelOne to discover and quarantine day-zero cyber attacks automatically. Progent also provides the assistance of seasoned ransomware recovery consultants with the track record and commitment to rebuild a compromised environment as quickly as possible.

Progent's Ransomware Recovery Services
Subsequent to a ransomware attack, paying the ransom in cryptocurrency does not ensure that distant criminals will respond with the keys to unencrypt all your data. Kaspersky Labs ascertained that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to re-install the mission-critical elements of your Information Technology environment. Without the availability of essential information backups, this calls for a broad range of skill sets, top notch project management, and the capability to work continuously until the task is finished.

For twenty years, Progent has offered professional IT services for companies across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded top industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial management and ERP applications. This breadth of expertise gives Progent the capability to efficiently understand critical systems and re-organize the surviving components of your IT environment after a ransomware event and assemble them into a functioning network.

Progent's ransomware group uses state-of-the-art project management systems to orchestrate the complicated recovery process. Progent understands the urgency of working quickly and in unison with a customer's management and IT staff to assign priority to tasks and to put the most important applications back on-line as soon as humanly possible.

Case Study: A Successful Ransomware Intrusion Restoration
A customer hired Progent after their company was attacked by the Ryuk ransomware virus. Ryuk is thought to have been launched by Northern Korean state hackers, suspected of using algorithms leaked from the U.S. NSA organization. Ryuk targets specific businesses with little room for disruption and is one of the most lucrative incarnations of ransomware viruses. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company located in Chicago and has around 500 staff members. The Ryuk intrusion had frozen all business operations and manufacturing processes. The majority of the client's information backups had been on-line at the beginning of the intrusion and were encrypted. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and praying for good luck, but ultimately reached out to Progent.

Progent worked together with the customer to rapidly understand and prioritize the key elements that needed to be restored to make it possible to resume company functions:

• Active Directory
• Microsoft Exchange Email
• MRP System

Within 48 hours, Progent was able to re-build Windows Active Directory to its pre-penetration state. Progent then performed rebuilding and storage recovery on needed servers. All Microsoft Exchange Server schema and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Off-Line Data Files) on team desktop computers in order to recover mail messages. A not too old off-line backup of the client's financials/ERP software made them able to restore these essential applications back servicing users. Although a lot of work remained to recover fully from the Ryuk attack, core systems were recovered rapidly:

Over the next few weeks important milestones in the restoration process were achieved through close cooperation between Progent consultants and the client:

• In-house web sites were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was brought online and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory modules were fully recovered.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Nearly all of the user workstations were operational.

Conclusion
A probable business-killing disaster was evaded through the efforts of dedicated experts, a broad spectrum of knowledge, and tight teamwork. Although in retrospect the ransomware penetration detailed here could have been disabled with current security technology and security best practices, team education, and well thought out security procedures for backup and proper patching controls, the reality remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware incursion, feel confident that Progent's roster of professionals has extensive experience in ransomware virus defense, remediation, and file recovery.

To review or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Uberlândia a portfolio of online monitoring and security evaluation services designed to help you to minimize your vulnerability to ransomware. These services include next-generation AI technology to detect zero-day strains of crypto-ransomware that are able to escape detection by traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent takes care of the necessary monitoring and maintenance for you, so your system expands easily without becoming an obstacle. For a low and predictable monthly subscription, Progent's full-service IT team can be your dependable technology safety net. Basic packages include remote monitoring and management, cybersecurity, automatic monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management technology to help keep your IT system running at peak levels by tracking the health of critical assets that power your information system. When ProSight LAN Watch detects an issue, an alarm is transmitted immediately to your specified IT personnel and your Progent consultant so that any potential issues can be resolved before they can disrupt productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for monitoring and managing your client-server infrastructure by offering an environment for performing common time-consuming jobs. These can include health checking, update management, automated remediation, endpoint setup, backup and restore, A/V protection, secure remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and debugging help. If ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alarm to your designated IT personnel and your assigned Progent consultant so potential issues can be fixed before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for small and mid-sized businesses to map out, track, optimize and debug their connectivity appliances such as routers and switches, firewalls, and access points plus servers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology maps are kept current, copies and displays the configuration information of almost all devices connected to your network, tracks performance, and generates notices when potential issues are detected. By automating tedious network management processes, WAN Watch can cut hours off ordinary tasks such as making network diagrams, expanding your network, finding appliances that need important software patches, or identifying the cause of performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of real-time management reporting tools designed to work with the industry's leading ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues like inconsistent support follow-up or machines with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with leading backup software providers to create ProSight Data Protection Services, a selection of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS products manage and monitor your data backup processes and enable transparent backup and rapid restoration of critical files, applications, system images, plus virtual machines. ProSight DPS lets your business recover from data loss resulting from equipment breakdown, natural calamities, fire, cyber attacks like ransomware, human mistakes, malicious insiders, or application bugs. Managed backup services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to identify which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of top information security vendors to deliver web-based management and world-class security for all your email traffic. The hybrid structure of Email Guard managed service combines cloud-based filtering with a local gateway device to provide complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The cloud filter serves as a preliminary barricade and blocks most threats from reaching your network firewall. This reduces your exposure to inbound threats and conserves network bandwidth and storage space. Email Guard's onsite gateway device adds a further layer of inspection for inbound email. For outgoing email, the on-premises gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local security gateway can also help Exchange Server to track and protect internal email traffic that stays inside your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to defend against stolen passwords by using two-factor authentication. Duo supports single-tap identity verification with iOS, Google Android, and other personal devices. Using Duo 2FA, when you log into a protected online account and enter your password you are requested to confirm who you are on a device that only you possess and that uses a separate network channel. A broad range of out-of-band devices can be used for this second means of ID validation such as a smartphone or wearable, a hardware token, a landline phone, etc. You may designate multiple validation devices. To learn more about Duo two-factor identity authentication services, see Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Call Center services enable your information technology staff to outsource Support Desk services to Progent or divide responsibilities for Help Desk services seamlessly between your in-house support group and Progent's extensive pool of certified IT service engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a seamless extension of your core support staff. User access to the Service Desk, delivery of support services, problem escalation, trouble ticket generation and tracking, efficiency metrics, and maintenance of the service database are cohesive regardless of whether issues are resolved by your in-house support resources, by Progent's team, or a mix of the two. Read more about Progent's outsourced/shared Call Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior machine learning technology to defend endpoints as well as physical and virtual servers against modern malware assaults such as ransomware and email phishing, which routinely get by legacy signature-matching anti-virus tools. Progent ASM services protect on-premises and cloud resources and provides a unified platform to address the complete threat lifecycle including protection, identification, mitigation, cleanup, and forensics. Key features include single-click rollback using Windows VSS and real-time network-wide immunization against new threats. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, find and protect information related to your IT infrastructure, procedures, applications, and services. You can quickly locate passwords or IP addresses and be warned about impending expirations of SSLs or warranties. By cleaning up and managing your IT documentation, you can eliminate as much as half of time spent searching for critical information about your IT network. ProSight IT Asset Management includes a centralized location for holding and sharing all documents related to managing your network infrastructure such as recommended procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're making improvements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the knowledge you need as soon as you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide organizations of any size a versatile and cost-effective solution for assessing, validating, scheduling, implementing, and tracking updates to your dynamic information network. Besides optimizing the security and reliability of your computer network, Progent's patch management services free up time for your IT team to focus on more strategic initiatives and tasks that derive the highest business value from your information network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a secure Tier III data center on a high-performance virtual host set up and maintained by Progent's IT support professionals. Under the ProSight Virtual Hosting service model, the client owns the data, the OS platforms, and the applications. Since the environment is virtualized, it can be ported easily to an alternate hosting solution without requiring a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not tied a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's next generation behavior machine learning tools to guard physical and virtual endpoints against new malware attacks like ransomware and file-less exploits, which easily get by legacy signature-based anti-virus tools. ProSight Active Security Monitoring protects on-premises and cloud resources and provides a single platform to manage the complete threat progression including blocking, detection, mitigation, remediation, and forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver economical in-depth security for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to security threats from all attack vectors. ProSight ESP provides firewall protection, intrusion alerts, device management, and web filtering via leading-edge tools incorporated within a single agent accessible from a single control. Progent's data protection and virtualization experts can help you to plan and implement a ProSight ESP environment that meets your organization's unique needs and that helps you prove compliance with government and industry data protection standards. Progent will help you define and configure policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that require urgent action. Progent's consultants can also help your company to install and test a backup and restore solution like ProSight Data Protection Services so you can recover quickly from a destructive cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange filtering.