24x7 Brooklyn Critical Crypto-Ransomware
Malware Assessment and Restoration Help

Crypto-Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become an escalating cyberplague that poses an extinction-level threat for businesses unprepared for an assault. Different iterations of crypto-ransomware like the CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for a long time and still cause destruction. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, as well as more unnamed viruses, not only encrypt online information but also infect all configured system restores and backups. Data replicated to cloud environments can also be held hostage. In a poorly designed data protection solution, this can render any restore operations useless and basically knocks the network back to square one.

Getting back on-line applications and information after a ransomware outage becomes a sprint against time as the targeted business struggles to contain the damage, eradicate the virus, and resume business-critical operations. Due to the fact that ransomware needs time to move laterally, attacks are frequently launched on weekends and holidays, when penetrations in many cases take more time to uncover. This multiplies the difficulty of rapidly mobilizing and organizing a qualified mitigation team.

Progent has a variety of support services for securing organizations from ransomware penetrations. These include team education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of modern security appliances with machine learning capabilities from SentinelOne to identify and quarantine new cyber threats intelligently. Progent in addition can provide the services of veteran ransomware recovery professionals with the skills and perseverance to reconstruct a compromised environment as urgently as possible.

Progent's Ransomware Restoration Help
Soon after a crypto-ransomware penetration, paying the ransom in cryptocurrency does not ensure that merciless criminals will return the keys to decrypt any or all of your data. Kaspersky Labs determined that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to re-install the key parts of your Information Technology environment. Without the availability of complete information backups, this requires a wide range of IT skills, top notch project management, and the willingness to work 24x7 until the task is over.

For two decades, Progent has provided certified expert IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned top certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in accounting and ERP application software. This breadth of expertise affords Progent the capability to efficiently ascertain important systems and integrate the surviving parts of your network environment after a ransomware penetration and configure them into a functioning system.

Progent's recovery team of experts deploys top notch project management applications to coordinate the sophisticated restoration process. Progent knows the urgency of acting swiftly and in unison with a client's management and IT staff to prioritize tasks and to get key applications back on line as fast as possible.

Customer Case Study: A Successful Crypto-Ransomware Attack Restoration
A business hired Progent after their organization was brought down by the Ryuk ransomware. Ryuk is believed to have been launched by Northern Korean state criminal gangs, suspected of adopting techniques exposed from the United States NSA organization. Ryuk goes after specific organizations with limited tolerance for operational disruption and is one of the most profitable versions of ransomware. High publicized victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in the Chicago metro area with around 500 workers. The Ryuk intrusion had paralyzed all essential operations and manufacturing processes. The majority of the client's data protection had been directly accessible at the beginning of the attack and were damaged. The client was taking steps for paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but in the end reached out to Progent.

Progent worked with the customer to rapidly get our arms around and assign priority to the essential areas that needed to be addressed in order to resume business functions:

• Active Directory (AD)
• Microsoft Exchange Email
• Accounting/MRP

Within 48 hours, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then completed reinstallations and hard drive recovery of mission critical applications. All Exchange schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to assemble intact OST data files (Outlook Offline Data Files) on staff PCs to recover email information. A recent offline backup of the customer's financials/ERP systems made it possible to return these essential services back available to users. Although major work was left to recover fully from the Ryuk damage, critical systems were restored rapidly:

Over the following few weeks key milestones in the recovery process were achieved through close cooperation between Progent engineers and the customer:

• In-house web sites were restored without losing any information.
• The MailStore Exchange Server exceeding four million archived messages was brought online and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables/Inventory Control modules were 100% operational.
• A new Palo Alto Networks 850 security appliance was installed.
• Most of the user PCs were back into operation.

Conclusion
A likely enterprise-killing disaster was evaded by top-tier experts, a wide spectrum of knowledge, and tight collaboration. Although upon completion of forensics the ransomware attack detailed here would have been prevented with modern security technology and best practices, user and IT administrator education, and appropriate incident response procedures for data protection and applying software patches, the fact is that state-sponsored cyber criminals from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's team of professionals has proven experience in crypto-ransomware virus blocking, removal, and data recovery.

To read or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Brooklyn a portfolio of online monitoring and security evaluation services designed to help you to reduce your vulnerability to crypto-ransomware. These services include next-generation AI technology to uncover new strains of ransomware that are able to evade legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it practical for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve advanced IT resilience. Progent takes care of the daily monitoring and management for you, so your network expands readily without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT group can be your dependable technology safety net. Basic plans include remote monitoring and management, cybersecurity, monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management (RMM) technology to help keep your network running at peak levels by checking the health of vital assets that power your business network. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your designated IT management personnel and your Progent engineering consultant so any looming problems can be addressed before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven solution for monitoring and managing your client-server infrastructure by offering tools for performing common tedious tasks. These can include health checking, patch management, automated repairs, endpoint configuration, backup and recovery, anti-virus protection, secure remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alarm to your specified IT management staff and your Progent consultant so that emerging problems can be fixed before they interfere with your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to map out, monitor, enhance and troubleshoot their networking appliances like routers, firewalls, and wireless controllers as well as servers, printers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology maps are always updated, captures and manages the configuration information of almost all devices on your network, tracks performance, and generates alerts when potential issues are detected. By automating time-consuming network management processes, WAN Watch can cut hours off ordinary tasks like network mapping, expanding your network, finding appliances that need important software patches, or resolving performance issues. Learn more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time reporting utilities created to work with the leading ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with leading backup software providers to produce ProSight Data Protection Services, a portfolio of subscription-based management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS products manage and monitor your data backup processes and allow non-disruptive backup and rapid restoration of vital files/folders, apps, images, and virtual machines. ProSight DPS helps your business recover from data loss resulting from hardware breakdown, natural disasters, fire, cyber attacks like ransomware, user error, ill-intentioned insiders, or application bugs. Managed backup services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to identify which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of top information security companies to deliver centralized control and comprehensive protection for all your email traffic. The hybrid structure of Progent's Email Guard managed service integrates cloud-based filtering with a local gateway device to provide complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's cloud filter acts as a first line of defense and keeps the vast majority of threats from reaching your network firewall. This reduces your vulnerability to inbound threats and saves network bandwidth and storage space. Email Guard's on-premises security gateway device adds a further layer of analysis for incoming email. For outgoing email, the onsite security gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The onsite security gateway can also help Microsoft Exchange Server to track and protect internal email traffic that originates and ends within your corporate firewall. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication (2FA). Duo enables single-tap identity verification with Apple iOS, Google Android, and other out-of-band devices. Using 2FA, when you log into a protected online account and give your password you are requested to verify who you are via a unit that only you have and that uses a different network channel. A wide selection of devices can be utilized as this added means of authentication such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can register several verification devices. For more information about ProSight Duo two-factor identity validation services, see Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Desk: Call Center Managed Services
  Progent's Help Center services permit your IT staff to offload Help Desk services to Progent or split activity for Help Desk services seamlessly between your in-house network support staff and Progent's nationwide pool of certified IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a transparent supplement to your core IT support team. Client interaction with the Service Desk, provision of support services, issue escalation, ticket creation and updates, efficiency metrics, and maintenance of the support database are consistent whether incidents are taken care of by your core IT support group, by Progent, or both. Learn more about Progent's outsourced/shared Call Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that incorporates cutting edge behavior analysis tools to defend endpoints as well as physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which easily evade legacy signature-based anti-virus products. Progent ASM services protect local and cloud-based resources and offers a single platform to automate the complete malware attack progression including blocking, infiltration detection, mitigation, cleanup, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, find and safeguard data about your network infrastructure, processes, applications, and services. You can quickly locate passwords or serial numbers and be alerted automatically about impending expirations of SSLs or domains. By cleaning up and organizing your IT documentation, you can eliminate up to 50% of time thrown away searching for critical information about your IT network. ProSight IT Asset Management features a common repository for storing and collaborating on all documents required for managing your business network like standard operating procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're making improvements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the knowledge you require the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management provide organizations of any size a flexible and cost-effective alternative for assessing, validating, scheduling, applying, and documenting updates to your ever-evolving IT system. Besides optimizing the protection and functionality of your computer environment, Progent's software/firmware update management services permit your in-house IT team to concentrate on more strategic initiatives and activities that derive the highest business value from your network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual host set up and maintained by Progent's network support professionals. With Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the operating system software, and the applications. Since the environment is virtualized, it can be moved immediately to an alternate hosting solution without a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior machine learning tools to guard physical and virtual endpoint devices against modern malware assaults such as ransomware and file-less exploits, which routinely get by legacy signature-based anti-virus products. ProSight ASM protects on-premises and cloud resources and provides a single platform to automate the complete threat progression including protection, infiltration detection, containment, remediation, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection services offer affordable multi-layer security for physical servers and virtual machines, workstations, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alerts, device management, and web filtering through cutting-edge tools packaged within one agent managed from a single console. Progent's security and virtualization consultants can help your business to design and implement a ProSight ESP environment that addresses your organization's specific needs and that allows you achieve and demonstrate compliance with legal and industry data protection standards. Progent will assist you define and configure security policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that require urgent attention. Progent can also assist your company to install and test a backup and restore solution such as ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Microsoft Exchange email filtering.