24/7 Adelaide Critical Crypto-Ransomware
Computer Malware Detection and Repair Consultants

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a too-frequent cyberplague that poses an existential danger for organizations vulnerable to an attack. Different iterations of ransomware such as CryptoLocker, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and continue to cause havoc. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as more as yet unnamed malware, not only encrypt on-line files but also infect many available system backups. Data replicated to off-site disaster recovery sites can also be encrypted. In a poorly designed environment, this can render automatic restoration hopeless and effectively knocks the network back to square one.

Getting back services and information after a ransomware event becomes a race against the clock as the victim fights to stop the spread, clear the ransomware, and restore enterprise-critical operations. Because ransomware takes time to move laterally, assaults are usually launched during weekends and nights, when attacks in many cases take longer to notice. This compounds the difficulty of promptly assembling and coordinating a qualified response team.

Progent has an assortment of support services for securing businesses from ransomware penetrations. These include staff education to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of next-generation security appliances with artificial intelligence technology from SentinelOne to discover and quarantine new cyber threats rapidly. Progent in addition can provide the assistance of seasoned crypto-ransomware recovery consultants with the skills and perseverance to rebuild a breached network as rapidly as possible.

Progent's Crypto-Ransomware Restoration Services
After a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not ensure that cyber criminals will respond with the codes to unencrypt any of your information. Kaspersky determined that 17% of ransomware victims never restored their information even after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to piece back together the essential elements of your IT environment. Without the availability of essential data backups, this calls for a wide range of skills, top notch team management, and the ability to work 24x7 until the job is completed.

For decades, Progent has made available certified expert IT services for companies across the United States and has achieved Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained top certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with accounting and ERP applications. This breadth of expertise gives Progent the ability to quickly ascertain critical systems and organize the surviving components of your IT system following a crypto-ransomware event and configure them into an operational network.

Progent's ransomware team of experts utilizes top notch project management tools to coordinate the complicated recovery process. Progent appreciates the urgency of working swiftly and in unison with a client's management and IT staff to prioritize tasks and to get essential services back online as soon as humanly possible.

Client Case Study: A Successful Ransomware Intrusion Recovery
A business sought out Progent after their network system was penetrated by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state sponsored criminal gangs, suspected of adopting approaches leaked from the United States NSA organization. Ryuk seeks specific organizations with limited ability to sustain disruption and is among the most lucrative instances of ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturer located in the Chicago metro area with about 500 employees. The Ryuk attack had frozen all essential operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the beginning of the intrusion and were destroyed. The client considered paying the ransom (exceeding $200,000) and praying for the best, but ultimately made the decision to use Progent.

Progent worked together with the customer to quickly identify and prioritize the most important elements that needed to be addressed in order to resume company operations:

• Windows Active Directory
• Email
• Financials/MRP

In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then charged ahead with rebuilding and hard drive recovery of key systems. All Exchange schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to assemble intact OST files (Microsoft Outlook Offline Folder Files) on staff desktop computers to recover mail data. A not too old off-line backup of the client's accounting/ERP software made it possible to recover these essential programs back online. Although a large amount of work was left to recover fully from the Ryuk event, essential services were restored quickly:

During the next month critical milestones in the restoration process were completed through tight cooperation between Progent team members and the customer:

• In-house web applications were brought back up without losing any data.
• The MailStore Microsoft Exchange Server exceeding four million historical messages was restored to operations and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were 100% restored.
• A new Palo Alto 850 security appliance was installed and configured.
• Ninety percent of the desktops and laptops were being used by staff.

Conclusion
A possible business-ending disaster was dodged through the efforts of results-oriented experts, a broad spectrum of knowledge, and tight teamwork. Although in post mortem the ransomware virus incident described here should have been shut down with current cyber security technology and security best practices, staff training, and properly executed incident response procedures for information protection and keeping systems up to date with security patches, the reality is that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware incident, remember that Progent's team of experts has extensive experience in ransomware virus blocking, cleanup, and file restoration.

To read or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Adelaide a portfolio of remote monitoring and security assessment services designed to assist you to reduce the threat from ransomware. These services utilize modern machine learning technology to uncover zero-day strains of ransomware that are able to get past legacy signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to keep your network running at peak levels by tracking the state of critical assets that drive your business network. When ProSight LAN Watch detects a problem, an alert is sent immediately to your designated IT personnel and your assigned Progent consultant so that any potential issues can be addressed before they can disrupt your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for managing your network, server, and desktop devices by offering tools for streamlining common time-consuming tasks. These include health monitoring, update management, automated remediation, endpoint deployment, backup and restore, A/V defense, secure remote access, standard and custom scripts, asset inventory, endpoint status reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it sends an alarm to your specified IT staff and your assigned Progent technical consultant so potential issues can be taken care of before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for small and mid-sized businesses to diagram, monitor, enhance and troubleshoot their connectivity appliances like routers and switches, firewalls, and wireless controllers plus servers, printers, endpoints and other devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch ensures that network maps are always updated, captures and manages the configuration of virtually all devices on your network, monitors performance, and sends alerts when issues are discovered. By automating tedious management and troubleshooting activities, ProSight WAN Watch can knock hours off ordinary chores like making network diagrams, reconfiguring your network, finding appliances that need critical software patches, or identifying the cause of performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of real-time and in-depth management reporting tools designed to work with the top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with advanced backup/restore technology companies to create ProSight Data Protection Services (DPS), a selection of offerings that provide backup-as-a-service (BaaS). ProSight DPS services manage and track your backup operations and allow transparent backup and rapid recovery of vital files, applications, images, and virtual machines. ProSight DPS helps you recover from data loss caused by equipment failures, natural disasters, fire, cyber attacks like ransomware, user mistakes, ill-intentioned insiders, or software bugs. Managed services in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to identify which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading information security companies to provide centralized control and world-class security for your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with a local security gateway appliance to offer complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne malware. The cloud filter serves as a first line of defense and blocks most threats from reaching your network firewall. This decreases your vulnerability to external attacks and saves network bandwidth and storage space. Email Guard's onsite security gateway appliance provides a deeper layer of analysis for inbound email. For outgoing email, the local gateway provides AV and anti-spam filtering, DLP, and email encryption. The local gateway can also help Exchange Server to track and safeguard internal email traffic that stays within your corporate firewall. For more information, see Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo technology to defend against stolen passwords through the use of two-factor authentication. Duo enables single-tap identity verification on Apple iOS, Google Android, and other personal devices. With 2FA, when you log into a secured online account and give your password you are requested to confirm your identity on a device that only you have and that is accessed using a different network channel. A wide range of out-of-band devices can be used as this second form of ID validation such as a smartphone or wearable, a hardware/software token, a landline phone, etc. You can register multiple validation devices. For more information about Duo two-factor identity authentication services, refer to Cisco Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Desk: Call Center Managed Services
  Progent's Call Center managed services allow your information technology staff to offload Support Desk services to Progent or divide activity for Service Desk support seamlessly between your internal support staff and Progent's extensive roster of IT support engineers and subject matter experts. Progent's Shared Help Desk Service provides a smooth supplement to your internal network support resources. End user interaction with the Service Desk, provision of support, problem escalation, ticket generation and updates, efficiency metrics, and maintenance of the support database are cohesive regardless of whether incidents are taken care of by your core support organization, by Progent's team, or by a combination. Read more about Progent's outsourced/shared Help Desk services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that utilizes cutting edge behavior analysis technology to defend endpoints as well as physical and virtual servers against modern malware assaults like ransomware and file-less exploits, which routinely evade legacy signature-based anti-virus products. Progent Active Security Monitoring services safeguard local and cloud resources and provides a single platform to automate the complete malware attack progression including filtering, identification, containment, remediation, and post-attack forensics. Top features include one-click rollback with Windows VSS and automatic system-wide immunization against newly discovered attacks. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, retrieve and safeguard data about your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or serial numbers and be warned automatically about upcoming expirations of SSL certificates or domains. By updating and organizing your network documentation, you can save as much as half of time thrown away looking for vital information about your network. ProSight IT Asset Management features a centralized repository for holding and collaborating on all documents required for managing your business network like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT data. Whether you're making enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the knowledge you need as soon as you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management provide organizations of any size a flexible and cost-effective solution for assessing, testing, scheduling, implementing, and tracking updates to your ever-evolving IT system. In addition to optimizing the protection and functionality of your computer environment, Progent's software/firmware update management services free up time for your IT staff to focus on more strategic projects and tasks that deliver maximum business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a protected fault tolerant data center on a high-performance virtual machine host configured and managed by Progent's network support professionals. Under the ProSight Virtual Hosting model, the customer owns the data, the operating system platforms, and the applications. Since the system is virtualized, it can be ported easily to an alternate hardware environment without a time-consuming and difficult configuration process. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior machine learning tools to guard physical and virtual endpoint devices against modern malware assaults such as ransomware and file-less exploits, which easily get by traditional signature-based AV tools. ProSight ASM safeguards on-premises and cloud resources and provides a unified platform to address the complete malware attack lifecycle including blocking, infiltration detection, mitigation, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection services deliver economical in-depth security for physical and virtual servers, desktops, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and advanced heuristics for continuously monitoring and responding to security assaults from all attack vectors. ProSight ESP delivers firewall protection, intrusion alarms, device management, and web filtering through leading-edge tools incorporated within a single agent managed from a unified control. Progent's data protection and virtualization consultants can help you to design and implement a ProSight ESP deployment that meets your company's unique needs and that allows you achieve and demonstrate compliance with legal and industry data protection standards. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for immediate action. Progent's consultants can also help your company to install and verify a backup and disaster recovery system such as ProSight Data Protection Services so you can recover rapidly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange filtering.