24x7 Yonkers Urgent Ransomware
Computer Malware Identification and Repair Consultants

Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become an escalating cyberplague that presents an existential danger for organizations poorly prepared for an assault. Versions of ransomware like the Dharma, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been around for years and still inflict damage. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, along with frequent as yet unnamed malware, not only do encryption of on-line data files but also infect any accessible system protection mechanisms. Data synchronized to cloud environments can also be ransomed. In a vulnerable system, this can make any recovery hopeless and effectively knocks the network back to square one.

Getting back online programs and information following a crypto-ransomware event becomes a race against time as the victim fights to stop the spread, remove the crypto-ransomware, and restore business-critical activity. Since ransomware takes time to spread, assaults are often launched on weekends, when successful attacks may take more time to uncover. This compounds the difficulty of quickly marshalling and coordinating an experienced response team.

Progent makes available a range of help services for protecting businesses from ransomware attacks. Among these are user education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of modern security gateways with machine learning capabilities from SentinelOne to discover and disable day-zero threats rapidly. Progent in addition provides the assistance of expert ransomware recovery professionals with the track record and perseverance to re-deploy a compromised system as quickly as possible.

Progent's Ransomware Restoration Services
Subsequent to a crypto-ransomware invasion, paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will return the codes to decrypt all your information. Kaspersky Labs determined that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to re-install the mission-critical parts of your Information Technology environment. Absent access to essential system backups, this requires a wide complement of skill sets, top notch team management, and the capability to work 24x7 until the task is finished.

For decades, Progent has made available certified expert IT services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained top certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of expertise gives Progent the skills to knowledgably ascertain necessary systems and re-organize the surviving parts of your computer network system following a crypto-ransomware attack and assemble them into an operational system.

Progent's recovery team of experts uses top notch project management systems to coordinate the complex restoration process. Progent understands the importance of acting rapidly and together with a customer's management and Information Technology staff to prioritize tasks and to put key systems back online as fast as humanly possible.

Client Story: A Successful Ransomware Attack Recovery
A business engaged Progent after their network system was crashed by Ryuk crypto-ransomware. Ryuk is thought to have been created by Northern Korean state hackers, suspected of using technology leaked from the U.S. NSA organization. Ryuk targets specific organizations with little ability to sustain disruption and is one of the most profitable versions of ransomware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturer located in the Chicago metro area and has around 500 staff members. The Ryuk penetration had shut down all company operations and manufacturing capabilities. Most of the client's information backups had been on-line at the beginning of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately engaged Progent.

Progent worked with the customer to quickly determine and prioritize the most important applications that needed to be restored to make it possible to continue departmental operations:

• Active Directory
• Email
• MRP System

Within 48 hours, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then assisted with reinstallations and storage recovery of critical applications. All Exchange ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was able to locate intact OST data files (Outlook Off-Line Data Files) on user workstations and laptops to recover mail messages. A not too old off-line backup of the businesses accounting/ERP software made it possible to recover these required programs back on-line. Although a large amount of work was left to recover completely from the Ryuk attack, critical services were recovered rapidly:

During the following month key milestones in the recovery project were made through close cooperation between Progent engineers and the customer:

• Internal web sites were restored without losing any data.
• The MailStore Exchange Server exceeding 4 million historical emails was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were fully operational.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Ninety percent of the user PCs were back into operation.

Conclusion
A possible business disaster was dodged by results-oriented experts, a wide spectrum of subject matter expertise, and close collaboration. Although upon completion of forensics the crypto-ransomware virus incident detailed here would have been identified and prevented with modern security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and well thought out incident response procedures for information protection and keeping systems up to date with security patches, the reality is that government-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's roster of experts has substantial experience in crypto-ransomware virus defense, remediation, and data disaster recovery.

To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide businesses in Yonkers a variety of online monitoring and security assessment services to help you to reduce your vulnerability to crypto-ransomware. These services utilize next-generation AI capability to detect new variants of ransomware that are able to escape detection by traditional signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent takes care of the daily monitoring and management for you, so your system expands smoothly without becoming an obstacle. For a low and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Entry-level plans include RMM, security, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to help keep your network running efficiently by checking the health of critical computers that power your information system. When ProSight LAN Watch uncovers an issue, an alert is sent immediately to your specified IT personnel and your Progent engineering consultant so that all potential problems can be addressed before they have a chance to disrupt productivity. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven solution for managing your network, server, and desktop devices by offering tools for performing common time-consuming jobs. These can include health monitoring, patch management, automated repairs, endpoint configuration, backup and restore, A/V defense, secure remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it transmits an alarm to your designated IT personnel and your assigned Progent consultant so that emerging problems can be taken care of before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for smaller organizations to map, monitor, reconfigure and troubleshoot their connectivity appliances like routers, firewalls, and access points plus servers, printers, endpoints and other devices. Using state-of-the-art RMM technology, WAN Watch makes sure that network maps are kept current, copies and manages the configuration information of virtually all devices connected to your network, monitors performance, and generates notices when problems are detected. By automating tedious management activities, WAN Watch can knock hours off common tasks like network mapping, reconfiguring your network, locating appliances that require critical software patches, or isolating performance issues. Learn more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of in-depth management reporting plug-ins created to work with the industry's leading ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues like inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore technology providers to create ProSight Data Protection Services, a family of subscription-based management outsourcing plans that provide backup-as-a-service. ProSight DPS products automate and track your data backup operations and allow non-disruptive backup and rapid restoration of critical files, applications, images, plus VMs. ProSight DPS helps you protect against data loss resulting from hardware breakdown, natural calamities, fire, malware such as ransomware, user mistakes, malicious employees, or application glitches. Managed backup services in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can help you to determine which of these fully managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of leading information security vendors to deliver web-based management and world-class protection for all your email traffic. The powerful architecture of Email Guard combines cloud-based filtering with an on-premises security gateway device to offer complete protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne malware. Email Guard's Cloud Protection Layer acts as a preliminary barricade and keeps most unwanted email from reaching your network firewall. This decreases your exposure to inbound threats and conserves network bandwidth and storage space. Email Guard's on-premises security gateway appliance adds a deeper layer of inspection for inbound email. For outbound email, the local gateway provides AV and anti-spam filtering, protection against data leaks, and email encryption. The on-premises security gateway can also assist Exchange Server to track and safeguard internal email traffic that stays inside your security perimeter. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to defend against compromised passwords by using two-factor authentication (2FA). Duo supports one-tap identity verification on iOS, Google Android, and other personal devices. With Duo 2FA, when you log into a protected application and give your password you are asked to verify your identity via a device that only you have and that uses a separate network channel. A wide range of devices can be used as this second means of authentication including an iPhone or Android or watch, a hardware token, a landline phone, etc. You may designate several verification devices. For more information about Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Service Desk: Call Center Managed Services
  Progent's Help Desk services allow your information technology team to offload Support Desk services to Progent or divide responsibilities for support services transparently between your internal network support team and Progent's extensive pool of certified IT service engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a transparent extension of your core support group. End user interaction with the Service Desk, provision of support services, issue escalation, ticket generation and updates, efficiency metrics, and management of the service database are cohesive whether incidents are resolved by your internal IT support group, by Progent, or by a combination. Find out more about Progent's outsourced/co-managed Call Desk services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that incorporates next generation behavior analysis technology to defend endpoints and physical and virtual servers against new malware assaults like ransomware and email phishing, which easily get by legacy signature-matching AV products. Progent Active Security Monitoring services safeguard on-premises and cloud resources and provides a single platform to manage the complete threat lifecycle including filtering, detection, mitigation, remediation, and forensics. Top features include single-click rollback with Windows VSS and automatic system-wide immunization against new threats. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, find and safeguard data about your IT infrastructure, procedures, business apps, and services. You can quickly find passwords or IP addresses and be warned about impending expirations of SSL certificates ,domains or warranties. By cleaning up and organizing your network documentation, you can save as much as 50% of time spent looking for vital information about your IT network. ProSight IT Asset Management includes a common repository for holding and sharing all documents related to managing your network infrastructure such as standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT data. Whether you're making enhancements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you require the instant you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of all sizes a versatile and affordable alternative for assessing, validating, scheduling, applying, and documenting software and firmware updates to your dynamic IT system. In addition to optimizing the security and reliability of your computer environment, Progent's patch management services allow your in-house IT team to concentrate on line-of-business projects and tasks that derive maximum business value from your information network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected fault tolerant data center on a high-performance virtual machine host configured and managed by Progent's network support experts. Under Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the OS software, and the applications. Since the system is virtualized, it can be ported easily to an alternate hardware solution without a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not tied a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior machine learning tools to defend physical and virtual endpoint devices against new malware attacks such as ransomware and email phishing, which routinely evade traditional signature-based anti-virus tools. ProSight Active Security Monitoring safeguards local and cloud-based resources and offers a single platform to address the complete threat lifecycle including filtering, identification, mitigation, cleanup, and forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection services offer affordable in-depth protection for physical and virtual servers, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and reacting to security threats from all vectors. ProSight ESP provides two-way firewall protection, penetration alarms, endpoint control, and web filtering via leading-edge tools incorporated within one agent accessible from a unified console. Progent's security and virtualization experts can help your business to design and configure a ProSight ESP environment that meets your company's specific needs and that helps you achieve and demonstrate compliance with legal and industry data protection standards. Progent will help you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for immediate action. Progent can also assist your company to set up and test a backup and disaster recovery solution like ProSight Data Protection Services so you can recover quickly from a potentially disastrous security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange email filtering.