24/7 Albany Emergency Crypto
Computer Virus Damage Assessment and Removal Consultants

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become an escalating cyberplague that represents an extinction-level danger for businesses of all sizes unprepared for an assault. Different iterations of ransomware like the CryptoLocker, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for many years and still inflict damage. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, along with more as yet unnamed newcomers, not only do encryption of on-line data files but also infect most accessible system protection. Data replicated to cloud environments can also be encrypted. In a poorly designed system, this can render any restore operations hopeless and effectively knocks the datacenter back to zero.

Getting back online programs and data after a ransomware event becomes a race against the clock as the targeted business tries its best to contain, clear the ransomware, and resume mission-critical activity. Due to the fact that crypto-ransomware takes time to replicate, assaults are usually sprung at night, when penetrations in many cases take more time to notice. This compounds the difficulty of rapidly mobilizing and coordinating a qualified mitigation team.

Progent has an assortment of support services for protecting enterprises from ransomware attacks. These include team member education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of the latest generation security solutions with machine learning technology from SentinelOne to identify and quarantine day-zero cyber attacks quickly. Progent also provides the services of seasoned ransomware recovery engineers with the skills and commitment to reconstruct a compromised network as urgently as possible.

Progent's Ransomware Restoration Help
After a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that distant criminals will provide the needed codes to decipher any or all of your information. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their data even after having paid the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to setup from scratch the key parts of your Information Technology environment. Absent the availability of essential information backups, this calls for a wide complement of skills, top notch project management, and the capability to work continuously until the job is completed.

For two decades, Progent has offered certified expert IT services for businesses across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained advanced certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of experience affords Progent the ability to quickly identify critical systems and integrate the surviving pieces of your computer network system after a ransomware attack and assemble them into an operational system.

Progent's ransomware team of experts has top notch project management applications to coordinate the complicated restoration process. Progent knows the importance of acting rapidly and in concert with a customer's management and Information Technology staff to prioritize tasks and to get essential applications back online as fast as humanly possible.

Case Study: A Successful Ransomware Intrusion Restoration
A small business sought out Progent after their network system was crashed by Ryuk ransomware. Ryuk is believed to have been created by North Korean state sponsored criminal gangs, possibly using approaches leaked from the United States NSA organization. Ryuk attacks specific organizations with little or no tolerance for operational disruption and is among the most profitable incarnations of crypto-ransomware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business based in the Chicago metro area and has about 500 staff members. The Ryuk attack had paralyzed all business operations and manufacturing processes. The majority of the client's system backups had been on-line at the start of the intrusion and were destroyed. The client considered paying the ransom (in excess of $200K) and wishfully thinking for the best, but ultimately utilized Progent.

Progent worked with the client to quickly determine and prioritize the critical applications that had to be addressed to make it possible to restart business operations:

• Active Directory
• Microsoft Exchange
• Accounting/MRP

Within two days, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then helped perform setup and storage recovery on essential applications. All Exchange data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Microsoft Outlook Offline Folder Files) on staff desktop computers and laptops to recover email messages. A not too old off-line backup of the businesses accounting/MRP software made them able to restore these essential applications back online for users. Although a large amount of work still had to be done to recover completely from the Ryuk event, essential systems were restored rapidly:

Throughout the next month key milestones in the recovery process were completed through close cooperation between Progent team members and the client:

• In-house web applications were returned to operation without losing any data.
• The MailStore Server containing more than four million historical emails was brought online and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control modules were fully recovered.
• A new Palo Alto 850 security appliance was installed.
• 90% of the user desktops were functioning as before the incident.

Conclusion
A possible business-ending disaster was avoided by dedicated experts, a broad spectrum of subject matter expertise, and tight collaboration. Although in post mortem the ransomware penetration detailed here would have been identified and prevented with up-to-date security technology solutions and security best practices, user and IT administrator education, and well designed incident response procedures for information backup and applying software patches, the reality is that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware attack, feel confident that Progent's team of experts has a proven track record in ransomware virus defense, removal, and file restoration.

To read or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide companies in Albany a portfolio of remote monitoring and security evaluation services to help you to reduce the threat from crypto-ransomware. These services utilize next-generation machine learning capability to detect new strains of ransomware that are able to escape detection by legacy signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management techniques to keep your IT system running efficiently by tracking the state of critical computers that drive your business network. When ProSight LAN Watch detects an issue, an alert is sent immediately to your designated IT staff and your assigned Progent engineering consultant so all potential problems can be addressed before they can impact your network. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for managing your network, server, and desktop devices by offering an environment for streamlining common time-consuming tasks. These can include health checking, patch management, automated remediation, endpoint setup, backup and restore, A/V protection, remote access, standard and custom scripts, asset inventory, endpoint status reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your designated IT personnel and your assigned Progent technical consultant so emerging problems can be taken care of before they impact productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to map, track, reconfigure and troubleshoot their connectivity appliances such as routers and switches, firewalls, and load balancers plus servers, client computers and other devices. Incorporating state-of-the-art RMM technology, ProSight WAN Watch makes sure that network diagrams are kept current, copies and manages the configuration of virtually all devices on your network, monitors performance, and generates alerts when problems are detected. By automating time-consuming management activities, WAN Watch can knock hours off ordinary tasks like making network diagrams, expanding your network, locating appliances that require critical software patches, or identifying the cause of performance issues. Learn more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time management reporting utilities created to integrate with the industry's top ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues like spotty support follow-through or machines with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup technology companies to produce ProSight Data Protection Services (DPS), a family of offerings that provide backup-as-a-service (BaaS). ProSight DPS services automate and track your backup operations and enable transparent backup and rapid recovery of important files/folders, apps, system images, and VMs. ProSight DPS lets you protect against data loss caused by hardware failures, natural disasters, fire, cyber attacks like ransomware, human mistakes, malicious insiders, or software bugs. Managed backup services in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of top data security vendors to deliver centralized management and world-class security for your email traffic. The hybrid architecture of Email Guard managed service combines a Cloud Protection Layer with a local gateway appliance to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based threats. Email Guard's Cloud Protection Layer acts as a first line of defense and blocks most unwanted email from making it to your security perimeter. This reduces your exposure to inbound threats and saves system bandwidth and storage space. Email Guard's on-premises security gateway device provides a further layer of analysis for inbound email. For outbound email, the on-premises security gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The on-premises security gateway can also assist Microsoft Exchange Server to track and protect internal email traffic that stays within your security perimeter. For more details, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo technology to protect against password theft by using two-factor authentication (2FA). Duo enables one-tap identity confirmation with Apple iOS, Google Android, and other personal devices. Using 2FA, whenever you log into a protected online account and enter your password you are requested to confirm your identity on a device that only you possess and that is accessed using a separate network channel. A broad range of out-of-band devices can be utilized for this added form of ID validation such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You may designate multiple validation devices. To find out more about ProSight Duo two-factor identity validation services, go to Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Service Desk: Call Center Managed Services
  Progent's Support Desk services allow your information technology group to outsource Call Center services to Progent or divide activity for support services seamlessly between your in-house network support staff and Progent's nationwide roster of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service provides a smooth supplement to your core IT support organization. End user interaction with the Service Desk, delivery of support services, problem escalation, trouble ticket generation and updates, performance metrics, and maintenance of the support database are cohesive regardless of whether incidents are taken care of by your internal network support organization, by Progent's team, or by a combination. Learn more about Progent's outsourced/shared Call Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that utilizes next generation behavior analysis tools to defend endpoints as well as servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily evade legacy signature-based anti-virus products. Progent ASM services protect local and cloud-based resources and offers a single platform to address the entire malware attack progression including filtering, detection, mitigation, remediation, and forensics. Top capabilities include single-click rollback using Windows VSS and real-time system-wide immunization against newly discovered attacks. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, find and protect data about your IT infrastructure, procedures, business apps, and services. You can quickly locate passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates or warranties. By cleaning up and organizing your network documentation, you can eliminate up to 50% of time spent trying to find vital information about your network. ProSight IT Asset Management features a common location for holding and sharing all documents required for managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and relating IT data. Whether you're making improvements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you need as soon as you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer businesses of any size a versatile and cost-effective alternative for evaluating, testing, scheduling, applying, and tracking software and firmware updates to your ever-evolving IT network. In addition to optimizing the protection and reliability of your computer network, Progent's software/firmware update management services permit your IT staff to concentrate on more strategic initiatives and activities that deliver maximum business value from your information network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual host set up and maintained by Progent's IT support experts. Under Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system platforms, and the apps. Since the environment is virtualized, it can be ported easily to an alternate hosting solution without requiring a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior-based analysis tools to guard physical and virtual endpoint devices against modern malware attacks like ransomware and file-less exploits, which routinely get by traditional signature-matching AV tools. ProSight ASM safeguards local and cloud resources and provides a unified platform to automate the complete malware attack lifecycle including protection, infiltration detection, mitigation, remediation, and forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services offer affordable in-depth protection for physical servers and VMs, desktops, mobile devices, and Exchange Server. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and responding to cyber assaults from all vectors. ProSight ESP provides two-way firewall protection, penetration alerts, endpoint control, and web filtering via cutting-edge technologies packaged within one agent managed from a single control. Progent's data protection and virtualization consultants can assist your business to design and configure a ProSight ESP deployment that meets your organization's specific requirements and that allows you achieve and demonstrate compliance with legal and industry information security standards. Progent will help you define and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that require urgent action. Progent's consultants can also help your company to install and test a backup and disaster recovery solution like ProSight Data Protection Services so you can recover rapidly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange email filtering.