Louisville 24/7/365 Emergency Crypto-Ransomware
Virus Detection and Removal Consultants

Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become an escalating cyberplague that poses an extinction-level threat for businesses vulnerable to an assault. Multiple generations of crypto-ransomware such as CryptoLocker, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for many years and still cause harm. The latest strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with additional unnamed malware, not only encrypt on-line critical data but also infiltrate many available system protection mechanisms. Data replicated to cloud environments can also be ransomed. In a vulnerable data protection solution, this can render automatic restore operations impossible and basically sets the network back to square one.

Restoring applications and data after a ransomware event becomes a sprint against time as the victim struggles to stop lateral movement, remove the virus, and resume enterprise-critical activity. Due to the fact that ransomware needs time to spread, assaults are usually launched during nights and weekends, when attacks typically take longer to detect. This multiplies the difficulty of rapidly mobilizing and organizing a capable mitigation team.

Progent has a variety of services for protecting organizations from ransomware events. These include team member education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of the latest generation security solutions with artificial intelligence capabilities from SentinelOne to detect and suppress day-zero cyber threats quickly. Progent in addition provides the assistance of expert crypto-ransomware recovery consultants with the skills and perseverance to reconstruct a breached system as soon as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware invasion, paying the ransom in cryptocurrency does not guarantee that cyber hackers will respond with the needed keys to decipher any of your information. Kaspersky Labs ascertained that seventeen percent of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The other path is to re-install the essential parts of your Information Technology environment. Without access to essential data backups, this requires a wide range of skill sets, well-coordinated project management, and the capability to work continuously until the task is complete.

For twenty years, Progent has provided professional Information Technology services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained high-level industry certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial systems and ERP applications. This breadth of experience affords Progent the ability to rapidly understand necessary systems and re-organize the surviving pieces of your Information Technology system after a ransomware penetration and configure them into a functioning network.

Progent's ransomware group uses state-of-the-art project management tools to coordinate the complicated restoration process. Progent appreciates the urgency of acting swiftly and together with a client's management and Information Technology team members to assign priority to tasks and to put the most important applications back on line as fast as possible.

Customer Case Study: A Successful Ransomware Incident Recovery
A business engaged Progent after their network system was taken over by the Ryuk ransomware virus. Ryuk is thought to have been launched by Northern Korean state sponsored cybercriminals, possibly adopting algorithms exposed from America's NSA organization. Ryuk targets specific organizations with little ability to sustain disruption and is one of the most profitable versions of crypto-ransomware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in Chicago with around 500 employees. The Ryuk event had disabled all essential operations and manufacturing processes. The majority of the client's data backups had been on-line at the beginning of the attack and were eventually encrypted. The client was taking steps for paying the ransom demand (exceeding $200K) and praying for good luck, but ultimately reached out to Progent.

Progent worked with the customer to quickly assess and prioritize the mission critical systems that had to be restored to make it possible to restart departmental operations:

• Active Directory (AD)
• E-Mail
• Financials/MRP

In less than 48 hours, Progent was able to recover Active Directory services to its pre-virus state. Progent then initiated reinstallations and hard drive recovery of essential systems. All Exchange schema and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to find local OST data files (Outlook Offline Data Files) on user PCs and laptops in order to recover email data. A not too old off-line backup of the businesses manufacturing systems made it possible to return these essential services back available to users. Although significant work needed to be completed to recover completely from the Ryuk virus, critical systems were restored quickly:

During the next month critical milestones in the restoration project were made in tight collaboration between Progent engineers and the customer:

• Self-hosted web applications were returned to operation with no loss of information.
• The MailStore Exchange Server with over 4 million historical emails was brought online and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory capabilities were 100 percent restored.
• A new Palo Alto 850 firewall was set up and programmed.
• Ninety percent of the desktops and laptops were back into operation.

Conclusion
A probable business extinction disaster was dodged through the efforts of results-oriented professionals, a wide range of technical expertise, and tight teamwork. Although in hindsight the crypto-ransomware incident described here would have been identified and disabled with advanced cyber security solutions and recognized best practices, staff education, and appropriate incident response procedures for data protection and proper patching controls, the reality remains that government-sponsored cybercriminals from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware attack, feel confident that Progent's roster of experts has a proven track record in ransomware virus blocking, cleanup, and data restoration.

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Louisville a variety of remote monitoring and security assessment services designed to assist you to minimize your vulnerability to ransomware. These services include modern machine learning capability to detect zero-day variants of crypto-ransomware that are able to escape detection by traditional signature-based anti-virus products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to create leading-edge network resilience. Progent handles the daily monitoring and management for you, so your system expands smoothly without holding you back. For a low and predictable monthly price, Progent's full-service IT group can be your complete technology safety net. Basic plans include remote monitoring and management, security, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management techniques to help keep your IT system operating at peak levels by tracking the health of vital assets that power your information system. When ProSight LAN Watch uncovers an issue, an alarm is transmitted immediately to your specified IT management personnel and your Progent consultant so any looming issues can be addressed before they can impact productivity. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your client-server infrastructure by providing tools for streamlining common tedious jobs. These include health monitoring, update management, automated repairs, endpoint configuration, backup and restore, A/V defense, secure remote access, built-in and custom scripts, resource inventory, endpoint status reports, and debugging help. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alarm to your specified IT staff and your Progent consultant so that emerging issues can be fixed before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for smaller businesses to map, track, optimize and troubleshoot their networking appliances like switches, firewalls, and load balancers as well as servers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology maps are kept updated, captures and manages the configuration of almost all devices connected to your network, monitors performance, and sends notices when potential issues are detected. By automating time-consuming management activities, WAN Watch can cut hours off common tasks such as network mapping, expanding your network, finding appliances that require critical updates, or isolating performance bottlenecks. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of real-time and in-depth management reporting utilities created to work with the industry's leading ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues such as inconsistent support follow-through or endpoints with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with leading backup/restore software companies to produce ProSight Data Protection Services, a selection of management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup processes and allow transparent backup and rapid restoration of critical files, apps, system images, plus Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss caused by hardware breakdown, natural disasters, fire, malware such as ransomware, human mistakes, malicious employees, or application bugs. Managed backup services available in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of top information security vendors to deliver centralized control and world-class protection for your email traffic. The hybrid structure of Email Guard managed service integrates a Cloud Protection Layer with an on-premises security gateway device to provide complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-borne threats. Email Guard's cloud filter acts as a first line of defense and blocks the vast majority of unwanted email from reaching your security perimeter. This decreases your vulnerability to inbound threats and saves network bandwidth and storage. Email Guard's on-premises security gateway appliance provides a deeper layer of inspection for inbound email. For outgoing email, the onsite gateway offers anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local security gateway can also assist Microsoft Exchange Server to track and safeguard internal email that originates and ends inside your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to defend against stolen passwords by using two-factor authentication (2FA). Duo supports one-tap identity verification with iOS, Google Android, and other personal devices. Using Duo 2FA, when you log into a protected application and enter your password you are asked to confirm who you are via a device that only you possess and that uses a separate network channel. A wide range of out-of-band devices can be used for this added means of authentication including a smartphone or watch, a hardware token, a landline telephone, etc. You may register multiple validation devices. For more information about ProSight Duo identity authentication services, go to Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Help Desk: Help Desk Managed Services
  Progent's Support Desk services enable your IT group to outsource Support Desk services to Progent or divide activity for Help Desk services seamlessly between your internal network support group and Progent's nationwide roster of IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a transparent supplement to your internal IT support group. Client interaction with the Service Desk, delivery of technical assistance, issue escalation, ticket generation and tracking, efficiency metrics, and management of the service database are consistent whether incidents are resolved by your corporate network support organization, by Progent's team, or both. Read more about Progent's outsourced/shared Call Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior-based machine learning technology to guard endpoints as well as physical and virtual servers against modern malware assaults such as ransomware and email phishing, which easily escape legacy signature-matching anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and provides a single platform to manage the complete threat lifecycle including protection, identification, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered attacks. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, find and protect data related to your network infrastructure, processes, business apps, and services. You can quickly find passwords or IP addresses and be alerted about impending expirations of SSL certificates ,domains or warranties. By cleaning up and managing your IT documentation, you can save up to 50% of time thrown away searching for vital information about your IT network. ProSight IT Asset Management features a common repository for holding and sharing all documents related to managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether you're planning improvements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the information you need as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide organizations of any size a flexible and cost-effective alternative for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your dynamic IT network. In addition to maximizing the protection and functionality of your computer network, Progent's software/firmware update management services allow your in-house IT staff to concentrate on line-of-business projects and activities that deliver the highest business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host set up and managed by Progent's network support professionals. With the ProSight Virtual Hosting service model, the client owns the data, the operating system platforms, and the applications. Since the system is virtualized, it can be ported immediately to a different hardware solution without a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, you are not locked into a single hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's cutting edge behavior analysis tools to defend physical and virtual endpoint devices against new malware attacks such as ransomware and email phishing, which routinely get by legacy signature-matching anti-virus products. ProSight Active Security Monitoring protects local and cloud resources and offers a single platform to manage the complete threat progression including protection, identification, mitigation, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver ultra-affordable multi-layer protection for physical and virtual servers, workstations, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to security threats from all vectors. ProSight ESP offers two-way firewall protection, penetration alerts, device control, and web filtering through leading-edge technologies packaged within a single agent accessible from a single control. Progent's security and virtualization consultants can help you to plan and configure a ProSight ESP environment that addresses your organization's specific requirements and that allows you achieve and demonstrate compliance with legal and industry information security standards. Progent will help you define and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that call for immediate attention. Progent's consultants can also assist you to install and verify a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange filtering.