24x7x365 Adelaide Immediate Crypto-Ransomware
Computer Malware Identification and Remediation Services

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become an escalating cyber pandemic that poses an existential threat for businesses of all sizes vulnerable to an assault. Different versions of ransomware like the CryptoLocker, Fusob, Locky, SamSam and MongoLock cryptoworms have been running rampant for many years and still cause harm. More recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, along with frequent unnamed newcomers, not only do encryption of on-line critical data but also infect all available system protection mechanisms. Information synchronized to cloud environments can also be corrupted. In a poorly designed data protection solution, it can render automated restore operations hopeless and basically knocks the network back to square one.

Getting back on-line programs and information after a ransomware attack becomes a sprint against the clock as the victim fights to stop lateral movement, remove the crypto-ransomware, and resume mission-critical activity. Because ransomware takes time to replicate, penetrations are often launched on weekends and holidays, when attacks tend to take longer to uncover. This multiplies the difficulty of promptly marshalling and orchestrating a qualified mitigation team.

Progent offers a variety of services for securing enterprises from ransomware attacks. These include user training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus installation of modern security gateways with AI technology from SentinelOne to discover and quarantine new cyber threats rapidly. Progent also can provide the services of expert crypto-ransomware recovery consultants with the talent and commitment to re-deploy a compromised environment as rapidly as possible.

Progent's Crypto-Ransomware Recovery Services
Following a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will return the codes to decrypt all your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their data after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to piece back together the essential elements of your IT environment. Absent access to full system backups, this requires a broad complement of skills, professional project management, and the capability to work non-stop until the job is finished.

For decades, Progent has offered expert Information Technology services for companies throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned top certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of expertise provides Progent the ability to knowledgably determine critical systems and integrate the remaining parts of your Information Technology environment following a ransomware penetration and configure them into an operational network.

Progent's ransomware team deploys state-of-the-art project management applications to coordinate the complex restoration process. Progent understands the importance of acting rapidly and in concert with a client's management and IT staff to prioritize tasks and to put the most important services back online as fast as possible.

Customer Story: A Successful Ransomware Attack Response
A small business contacted Progent after their organization was penetrated by Ryuk ransomware. Ryuk is thought to have been developed by Northern Korean state sponsored criminal gangs, suspected of using approaches leaked from America's NSA organization. Ryuk attacks specific organizations with limited room for disruption and is among the most lucrative versions of ransomware malware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in the Chicago metro area with about 500 workers. The Ryuk event had disabled all essential operations and manufacturing processes. The majority of the client's backups had been on-line at the beginning of the intrusion and were damaged. The client considered paying the ransom demand (more than two hundred thousand dollars) and praying for the best, but in the end called Progent.

Progent worked with the client to rapidly assess and prioritize the most important areas that had to be restored to make it possible to restart business functions:

• Microsoft Active Directory
• E-Mail
• MRP System

In less than 2 days, Progent was able to re-build Windows Active Directory to its pre-intrusion state. Progent then assisted with rebuilding and hard drive recovery of critical applications. All Exchange Server ties and attributes were intact, which facilitated the restore of Exchange. Progent was also able to assemble local OST files (Microsoft Outlook Off-Line Data Files) on various workstations to recover email data. A recent offline backup of the businesses accounting/ERP software made them able to restore these vital programs back online for users. Although significant work still had to be done to recover totally from the Ryuk event, essential services were recovered rapidly:

During the next couple of weeks important milestones in the restoration project were accomplished in tight collaboration between Progent team members and the client:

• Internal web applications were returned to operation without losing any data.
• The MailStore Server exceeding 4 million archived emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory functions were fully functional.
• A new Palo Alto 850 security appliance was brought online.
• Ninety percent of the user workstations were functioning as before the incident.

Conclusion
A likely business disaster was evaded with hard-working experts, a wide spectrum of IT skills, and close collaboration. Although in post mortem the ransomware virus attack detailed here could have been stopped with advanced cyber security solutions and best practices, staff training, and properly executed incident response procedures for data protection and proper patching controls, the fact is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a ransomware incursion, feel confident that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, mitigation, and file disaster recovery.

To read or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Adelaide a variety of remote monitoring and security assessment services to help you to reduce your vulnerability to crypto-ransomware. These services utilize next-generation AI technology to detect zero-day strains of ransomware that are able to evade legacy signature-based security products.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management technology to keep your IT system running at peak levels by tracking the health of critical computers that power your business network. When ProSight LAN Watch uncovers a problem, an alarm is transmitted immediately to your designated IT management personnel and your assigned Progent consultant so any looming problems can be resolved before they can disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven solution for monitoring and managing your client-server infrastructure by offering tools for streamlining common time-consuming tasks. These can include health monitoring, update management, automated repairs, endpoint deployment, backup and recovery, A/V response, secure remote access, standard and custom scripts, asset inventory, endpoint profile reports, and debugging support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it transmits an alarm to your specified IT personnel and your assigned Progent consultant so emerging issues can be fixed before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for small and mid-sized businesses to map out, track, reconfigure and debug their networking hardware like routers, firewalls, and wireless controllers as well as servers, printers, client computers and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that infrastructure topology maps are kept current, copies and displays the configuration of almost all devices connected to your network, monitors performance, and sends alerts when potential issues are detected. By automating time-consuming management processes, WAN Watch can knock hours off ordinary tasks like making network diagrams, expanding your network, locating devices that need critical updates, or identifying the cause of performance issues. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time reporting tools created to work with the top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues like inconsistent support follow-through or endpoints with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with advanced backup software providers to create ProSight Data Protection Services (DPS), a selection of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services manage and monitor your backup processes and enable non-disruptive backup and rapid restoration of vital files, applications, images, plus Hyper-V and VMware virtual machines. ProSight DPS lets your business protect against data loss caused by equipment failures, natural disasters, fire, malware like ransomware, user mistakes, ill-intentioned insiders, or software glitches. Managed services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to identify which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of top information security vendors to deliver web-based control and comprehensive protection for your email traffic. The hybrid architecture of Email Guard combines a Cloud Protection Layer with an on-premises gateway appliance to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. The Cloud Protection Layer acts as a first line of defense and keeps most threats from making it to your network firewall. This reduces your exposure to external attacks and saves network bandwidth and storage. Email Guard's on-premises gateway device adds a deeper layer of inspection for incoming email. For outgoing email, the onsite security gateway offers AV and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also assist Microsoft Exchange Server to monitor and protect internal email traffic that stays within your corporate firewall. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA service plans utilize Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication. Duo supports one-tap identity verification with Apple iOS, Android, and other out-of-band devices. With 2FA, whenever you log into a secured online account and enter your password you are asked to verify who you are on a unit that only you possess and that uses a separate network channel. A wide range of out-of-band devices can be utilized for this second means of ID validation including a smartphone or watch, a hardware/software token, a landline phone, etc. You may register multiple verification devices. For details about ProSight Duo two-factor identity validation services, see Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Call Desk: Support Desk Managed Services
  Progent's Support Desk services permit your information technology team to offload Call Center services to Progent or split responsibilities for Help Desk services seamlessly between your internal network support resources and Progent's extensive roster of certified IT service technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a smooth supplement to your core network support organization. Client access to the Help Desk, provision of technical assistance, escalation, ticket creation and updates, performance measurement, and maintenance of the service database are cohesive whether incidents are taken care of by your core network support organization, by Progent's team, or both. Read more about Progent's outsourced/co-managed Help Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) solution that incorporates cutting edge behavior machine learning technology to guard endpoint devices as well as servers and VMs against new malware attacks such as ransomware and email phishing, which routinely get by traditional signature-matching anti-virus tools. Progent ASM services safeguard on-premises and cloud resources and offers a single platform to automate the entire threat progression including filtering, infiltration detection, mitigation, cleanup, and post-attack forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new attacks. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and protect data about your network infrastructure, procedures, business apps, and services. You can instantly find passwords or IP addresses and be warned about upcoming expirations of SSL certificates or warranties. By updating and managing your network documentation, you can eliminate up to 50% of time thrown away looking for vital information about your IT network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT data. Whether you're planning improvements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a versatile and affordable alternative for assessing, testing, scheduling, applying, and documenting updates to your dynamic information system. In addition to optimizing the security and functionality of your IT network, Progent's patch management services allow your IT staff to concentrate on line-of-business projects and tasks that derive maximum business value from your information network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host set up and managed by Progent's IT support professionals. With the ProSight Virtual Hosting model, the customer owns the data, the OS platforms, and the applications. Since the environment is virtualized, it can be ported easily to a different hosting environment without a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's next generation behavior machine learning tools to guard physical and virtual endpoint devices against modern malware attacks like ransomware and file-less exploits, which routinely evade traditional signature-matching AV products. ProSight Active Security Monitoring protects on-premises and cloud resources and offers a single platform to automate the entire threat progression including protection, infiltration detection, containment, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection managed services offer ultra-affordable in-depth security for physical servers and virtual machines, desktops, smartphones, and Exchange Server. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP delivers firewall protection, intrusion alerts, device control, and web filtering through cutting-edge tools incorporated within a single agent accessible from a single console. Progent's security and virtualization experts can assist your business to plan and configure a ProSight ESP environment that meets your organization's specific needs and that helps you prove compliance with legal and industry information protection regulations. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for urgent action. Progent can also assist you to set up and test a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover quickly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange email filtering.