24x7 Shreveport Immediate Crypto-Ransomware
Computer Virus Identification and Recovery Services

Crypto-Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware has become an escalating cyber pandemic that presents an enterprise-level threat for businesses unprepared for an attack. Different versions of ransomware such as Dharma, Fusob, Locky, Syskey and MongoLock cryptoworms have been around for years and still inflict harm. The latest strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, as well as frequent unnamed malware, not only encrypt on-line critical data but also infect most available system protection. Data synched to off-site disaster recovery sites can also be ransomed. In a poorly architected data protection solution, it can render any recovery useless and effectively knocks the network back to square one.

Getting back on-line programs and information following a crypto-ransomware attack becomes a race against the clock as the targeted business tries its best to contain, clear the virus, and resume enterprise-critical activity. Due to the fact that crypto-ransomware needs time to replicate, attacks are usually launched on weekends and holidays, when successful penetrations are likely to take more time to discover. This compounds the difficulty of quickly mobilizing and coordinating an experienced mitigation team.

Progent has an assortment of solutions for securing enterprises from crypto-ransomware events. These include staff education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus installation of next-generation security gateways with artificial intelligence technology from SentinelOne to identify and suppress zero-day threats quickly. Progent in addition offers the services of seasoned crypto-ransomware recovery professionals with the talent and commitment to rebuild a compromised network as quickly as possible.

Progent's Ransomware Recovery Support Services
Following a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will return the keys to unencrypt all your information. Kaspersky determined that 17% of crypto-ransomware victims never recovered their data after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to piece back together the essential components of your Information Technology environment. Absent the availability of full data backups, this calls for a broad range of skill sets, well-coordinated team management, and the capability to work continuously until the task is done.

For two decades, Progent has offered certified expert IT services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded high-level industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of expertise affords Progent the skills to quickly ascertain important systems and re-organize the remaining components of your computer network system after a ransomware attack and assemble them into an operational system.

Progent's ransomware group utilizes top notch project management applications to coordinate the complex restoration process. Progent appreciates the importance of working rapidly and in unison with a customer's management and Information Technology staff to prioritize tasks and to put key applications back on-line as soon as possible.

Business Case Study: A Successful Ransomware Virus Restoration
A customer contacted Progent after their network was penetrated by Ryuk ransomware. Ryuk is generally considered to have been deployed by North Korean state criminal gangs, possibly using algorithms leaked from the U.S. NSA organization. Ryuk targets specific companies with little or no ability to sustain disruption and is among the most profitable incarnations of ransomware viruses. High publicized targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in the Chicago metro area and has about 500 workers. The Ryuk intrusion had shut down all business operations and manufacturing processes. The majority of the client's system backups had been on-line at the beginning of the attack and were destroyed. The client was actively seeking loans for paying the ransom (exceeding $200K) and hoping for the best, but ultimately brought in Progent.

Progent worked hand in hand the customer to rapidly understand and assign priority to the essential services that needed to be addressed to make it possible to continue company functions:

• Active Directory
• Email
• MRP System

Within 2 days, Progent was able to rebuild Active Directory to its pre-attack state. Progent then performed reinstallations and hard drive recovery of key systems. All Exchange ties and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to find local OST files (Outlook Email Off-Line Folder Files) on various desktop computers and laptops in order to recover email messages. A recent offline backup of the customer's financials/MRP systems made it possible to recover these essential programs back servicing users. Although a lot of work was left to recover fully from the Ryuk virus, core services were restored quickly:

During the following month important milestones in the recovery process were accomplished in close collaboration between Progent engineers and the client:

• Internal web applications were returned to operation without losing any information.
• The MailStore Server with over four million archived emails was spun up and available for users.
• CRM/Orders/Invoices/AP/AR/Inventory modules were completely restored.
• A new Palo Alto 850 firewall was installed and configured.
• 90% of the desktop computers were functioning as before the incident.

Conclusion
A likely business extinction disaster was dodged through the efforts of top-tier experts, a broad range of knowledge, and tight collaboration. Although in post mortem the ransomware virus penetration described here should have been prevented with advanced security technology and best practices, team training, and properly executed security procedures for information backup and keeping systems up to date with security patches, the reality is that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware virus, feel confident that Progent's team of professionals has substantial experience in crypto-ransomware virus defense, removal, and data recovery.

To read or download a PDF version of this case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Shreveport a variety of remote monitoring and security evaluation services to assist you to minimize the threat from ransomware. These services incorporate modern AI technology to uncover new variants of ransomware that can get past legacy signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it practical for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent handles the necessary monitoring and management for you, so your system expands readily without holding you back. For an affordable and predictable monthly price, Progent's full-service IT group can be your dependable technology safety net. Basic plans include remote monitoring and management (RMM), security, automatic monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-in-class solutions like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) techniques to keep your network running efficiently by checking the health of vital assets that power your business network. When ProSight LAN Watch uncovers a problem, an alert is sent immediately to your specified IT staff and your assigned Progent engineering consultant so all looming issues can be addressed before they have a chance to disrupt productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based solution for managing your network, server, and desktop devices by offering tools for streamlining common tedious jobs. These include health monitoring, patch management, automated remediation, endpoint setup, backup and recovery, A/V response, remote access, standard and custom scripts, resource inventory, endpoint status reporting, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alarm to your designated IT staff and your Progent technical consultant so that potential issues can be taken care of before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for smaller businesses to map out, track, enhance and debug their networking appliances like routers, firewalls, and access points as well as servers, printers, client computers and other devices. Incorporating cutting-edge RMM technology, WAN Watch ensures that network diagrams are always updated, captures and manages the configuration information of almost all devices on your network, tracks performance, and sends notices when potential issues are detected. By automating time-consuming management activities, ProSight WAN Watch can cut hours off common chores such as network mapping, reconfiguring your network, locating devices that require critical updates, or resolving performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time and in-depth management reporting utilities designed to integrate with the industry's top ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as inconsistent support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software providers to produce ProSight Data Protection Services, a portfolio of management offerings that deliver backup-as-a-service. ProSight DPS services manage and monitor your data backup operations and enable transparent backup and rapid recovery of vital files, applications, system images, and virtual machines. ProSight DPS lets your business avoid data loss caused by equipment breakdown, natural disasters, fire, malware like ransomware, human mistakes, malicious employees, or application bugs. Managed backup services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the technology of top information security vendors to deliver centralized management and comprehensive security for all your inbound and outbound email. The hybrid structure of Progent's Email Guard managed service combines cloud-based filtering with a local gateway appliance to provide advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-based threats. The Cloud Protection Layer serves as a first line of defense and blocks the vast majority of threats from making it to your network firewall. This reduces your exposure to inbound attacks and conserves system bandwidth and storage space. Email Guard's on-premises security gateway appliance adds a deeper layer of analysis for inbound email. For outgoing email, the local gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The local security gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends inside your corporate firewall. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo technology to protect against stolen passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation with iOS, Google Android, and other out-of-band devices. Using 2FA, whenever you log into a protected application and give your password you are asked to verify your identity via a unit that only you possess and that uses a different ("out-of-band") network channel. A wide range of out-of-band devices can be utilized as this second means of authentication such as a smartphone or watch, a hardware token, a landline phone, etc. You may designate multiple verification devices. To learn more about ProSight Duo identity validation services, refer to Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Desk: Call Center Managed Services
  Progent's Support Center services permit your IT staff to offload Help Desk services to Progent or split responsibilities for support services seamlessly between your in-house support group and Progent's extensive roster of IT support engineers and subject matter experts. Progent's Co-managed Service Desk offers a transparent supplement to your core network support group. User access to the Service Desk, delivery of technical assistance, problem escalation, ticket creation and tracking, efficiency measurement, and management of the support database are consistent whether incidents are taken care of by your internal support organization, by Progent's team, or a mix of the two. Read more about Progent's outsourced/co-managed Call Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior-based analysis technology to guard endpoint devices and physical and virtual servers against new malware assaults like ransomware and email phishing, which routinely evade legacy signature-matching anti-virus products. Progent ASM services protect on-premises and cloud resources and provides a single platform to automate the complete malware attack progression including protection, infiltration detection, mitigation, cleanup, and forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, update, find and safeguard data related to your IT infrastructure, processes, business apps, and services. You can quickly find passwords or IP addresses and be alerted about upcoming expirations of SSLs or domains. By cleaning up and managing your IT infrastructure documentation, you can eliminate up to 50% of time spent searching for vital information about your network. ProSight IT Asset Management includes a common repository for holding and sharing all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and associating IT data. Whether you're planning improvements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you require when you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for patch management offer businesses of all sizes a versatile and cost-effective alternative for assessing, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving IT network. Besides optimizing the protection and reliability of your IT environment, Progent's software/firmware update management services allow your IT staff to concentrate on line-of-business initiatives and tasks that derive maximum business value from your network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a secure fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's network support professionals. Under Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the OS platforms, and the apps. Since the environment is virtualized, it can be moved immediately to an alternate hosting solution without a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not tied one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's next generation behavior machine learning tools to guard physical and virtual endpoints against new malware attacks like ransomware and file-less exploits, which easily get by traditional signature-matching AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a unified platform to manage the entire threat progression including filtering, identification, containment, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services offer economical multi-layer security for physical and virtual servers, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and responding to security assaults from all attack vectors. ProSight ESP offers two-way firewall protection, intrusion alerts, device management, and web filtering via cutting-edge technologies incorporated within one agent managed from a single console. Progent's security and virtualization experts can assist you to design and implement a ProSight ESP environment that addresses your company's unique needs and that allows you demonstrate compliance with legal and industry data protection regulations. Progent will help you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that require immediate action. Progent's consultants can also assist you to set up and verify a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover rapidly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange email filtering.