24-Hour Atlanta Emergency Crypto-Ransomware
Infection Damage Assessment and Restoration Services

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a modern cyberplague that presents an existential threat for businesses of all sizes vulnerable to an assault. Multiple generations of ransomware such as Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been circulating for a long time and still cause harm. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, plus additional as yet unnamed viruses, not only encrypt on-line files but also infiltrate all accessible system backups. Information synchronized to cloud environments can also be corrupted. In a poorly architected system, this can render automated restoration impossible and basically sets the network back to square one.

Retrieving programs and data following a crypto-ransomware attack becomes a race against time as the targeted organization tries its best to contain, eradicate the ransomware, and resume business-critical activity. Due to the fact that crypto-ransomware takes time to replicate, attacks are frequently sprung during weekends and nights, when successful penetrations are likely to take more time to recognize. This multiplies the difficulty of rapidly assembling and orchestrating a qualified response team.

Progent has a range of solutions for securing businesses from crypto-ransomware events. These include team member education to help recognize and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus installation of next-generation security gateways with machine learning capabilities from SentinelOne to identify and extinguish zero-day cyber threats quickly. Progent also can provide the assistance of expert crypto-ransomware recovery consultants with the talent and perseverance to rebuild a breached network as quickly as possible.

Progent's Crypto-Ransomware Recovery Services
Subsequent to a crypto-ransomware penetration, paying the ransom in cryptocurrency does not guarantee that merciless criminals will respond with the codes to decrypt any or all of your information. Kaspersky ascertained that 17% of ransomware victims never recovered their information after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to piece back together the key parts of your Information Technology environment. Absent the availability of full data backups, this requires a broad complement of IT skills, well-coordinated team management, and the ability to work 24x7 until the job is done.

For two decades, Progent has offered professional Information Technology services for businesses throughout the U.S. and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have been awarded top certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial management and ERP applications. This breadth of experience provides Progent the capability to rapidly understand necessary systems and organize the surviving parts of your computer network environment after a crypto-ransomware attack and configure them into a functioning system.

Progent's recovery group utilizes powerful project management systems to coordinate the complicated restoration process. Progent appreciates the importance of acting rapidly and together with a customer's management and Information Technology staff to prioritize tasks and to put critical applications back online as fast as humanly possible.

Customer Story: A Successful Ransomware Intrusion Recovery
A small business sought out Progent after their network was attacked by the Ryuk crypto-ransomware. Ryuk is thought to have been developed by Northern Korean state sponsored cybercriminals, suspected of adopting approaches exposed from America's NSA organization. Ryuk goes after specific businesses with little or no tolerance for operational disruption and is among the most lucrative versions of ransomware viruses. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in the Chicago metro area and has around 500 workers. The Ryuk intrusion had brought down all business operations and manufacturing processes. Most of the client's backups had been online at the start of the intrusion and were destroyed. The client considered paying the ransom demand (in excess of two hundred thousand dollars) and hoping for the best, but in the end made the decision to use Progent.

Progent worked with the client to quickly get our arms around and prioritize the essential systems that had to be restored in order to resume company functions:

• Active Directory (AD)
• Email
• Accounting/MRP

Within two days, Progent was able to re-build Active Directory services to its pre-virus state. Progent then accomplished reinstallations and storage recovery of mission critical applications. All Exchange data and configuration information were intact, which accelerated the rebuild of Exchange. Progent was also able to locate intact OST files (Outlook Email Off-Line Data Files) on user workstations and laptops in order to recover mail data. A recent off-line backup of the client's accounting/MRP systems made it possible to recover these essential applications back online for users. Although major work was left to recover fully from the Ryuk damage, critical services were restored quickly:

During the next couple of weeks key milestones in the restoration project were completed in tight collaboration between Progent engineers and the customer:

• In-house web applications were restored without losing any information.
• The MailStore Exchange Server with over four million historical messages was spun up and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were 100 percent operational.
• A new Palo Alto 850 security appliance was set up.
• Ninety percent of the desktops and laptops were fully operational.

Conclusion
A potential enterprise-killing disaster was averted with results-oriented experts, a wide spectrum of knowledge, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware attack described here should have been identified and blocked with advanced cyber security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and appropriate incident response procedures for data protection and keeping systems up to date with security patches, the fact is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, removal, and data restoration.

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Atlanta a range of remote monitoring and security assessment services designed to help you to reduce the threat from ransomware. These services utilize modern machine learning capability to detect zero-day strains of ransomware that can escape detection by legacy signature-based anti-virus solutions.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior machine learning tools to defend physical and virtual endpoint devices against modern malware assaults like ransomware and file-less exploits, which routinely evade legacy signature-based AV products. ProSight Active Security Monitoring protects local and cloud-based resources and offers a single platform to address the complete malware attack lifecycle including filtering, identification, mitigation, remediation, and forensics. Key features include single-click rollback using Windows VSS and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection services deliver affordable multi-layer protection for physical servers and virtual machines, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and modern behavior analysis for round-the-clock monitoring and responding to security assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, endpoint control, and web filtering via leading-edge technologies incorporated within a single agent accessible from a single console. Progent's security and virtualization experts can help your business to design and implement a ProSight ESP deployment that addresses your company's specific needs and that helps you demonstrate compliance with government and industry data security regulations. Progent will help you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that require urgent attention. Progent can also help you to set up and test a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a destructive cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with advanced backup software providers to create ProSight Data Protection Services (DPS), a selection of management outsourcing plans that provide backup-as-a-service. ProSight DPS products automate and monitor your data backup operations and enable non-disruptive backup and fast recovery of vital files/folders, apps, system images, plus virtual machines. ProSight DPS helps you recover from data loss resulting from equipment failures, natural calamities, fire, malware such as ransomware, user mistakes, malicious insiders, or software bugs. Managed backup services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the technology of leading data security vendors to provide web-based management and comprehensive protection for your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service combines a Cloud Protection Layer with a local gateway appliance to offer complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The Cloud Protection Layer serves as a first line of defense and blocks the vast majority of threats from making it to your network firewall. This reduces your exposure to external threats and conserves system bandwidth and storage space. Email Guard's on-premises gateway appliance provides a further layer of inspection for incoming email. For outbound email, the local gateway provides AV and anti-spam protection, DLP, and email encryption. The local gateway can also help Microsoft Exchange Server to monitor and safeguard internal email that stays inside your security perimeter. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and inexpensive for smaller organizations to map out, track, reconfigure and troubleshoot their networking hardware such as switches, firewalls, and load balancers plus servers, client computers and other devices. Incorporating cutting-edge Remote Monitoring and Management technology, WAN Watch ensures that infrastructure topology maps are always updated, copies and displays the configuration information of virtually all devices on your network, monitors performance, and generates alerts when problems are discovered. By automating time-consuming management and troubleshooting activities, ProSight WAN Watch can knock hours off common chores such as network mapping, expanding your network, locating appliances that require important updates, or isolating performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management consulting.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management (RMM) techniques to keep your IT system operating efficiently by tracking the health of vital computers that power your business network. When ProSight LAN Watch uncovers a problem, an alarm is transmitted immediately to your designated IT management personnel and your assigned Progent consultant so that any potential problems can be resolved before they can impact your network. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a secure Tier III data center on a high-performance virtual host configured and maintained by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the applications. Since the environment is virtualized, it can be moved easily to a different hosting solution without a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, find and protect information related to your network infrastructure, procedures, applications, and services. You can instantly locate passwords or IP addresses and be alerted about upcoming expirations of SSL certificates ,domains or warranties. By cleaning up and managing your IT documentation, you can save as much as half of time spent looking for critical information about your IT network. ProSight IT Asset Management features a common repository for holding and collaborating on all documents related to managing your business network such as recommended procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and relating IT data. Whether you're making enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the knowledge you require when you need it. Read more about ProSight IT Asset Management service.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior machine learning technology to defend endpoint devices as well as physical and virtual servers against new malware attacks like ransomware and email phishing, which easily evade traditional signature-based AV tools. Progent ASM services safeguard local and cloud resources and offers a single platform to manage the complete malware attack progression including filtering, identification, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Read more about Progent's ransomware defense and cleanup services.

• Outsourced/Co-managed Help Desk: Call Center Managed Services
  Progent's Help Desk services enable your IT team to offload Support Desk services to Progent or split responsibilities for Help Desk services transparently between your internal support group and Progent's nationwide roster of IT service engineers and subject matter experts. Progent's Shared Help Desk Service provides a transparent extension of your in-house network support team. Client access to the Help Desk, delivery of support, problem escalation, ticket generation and tracking, efficiency metrics, and maintenance of the support database are cohesive whether incidents are resolved by your corporate support resources, by Progent's team, or by a combination. Find out more about Progent's outsourced/shared Service Center services.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer organizations of all sizes a flexible and affordable solution for assessing, testing, scheduling, applying, and tracking software and firmware updates to your ever-evolving IT system. Besides optimizing the security and functionality of your computer network, Progent's patch management services permit your IT team to concentrate on more strategic initiatives and tasks that derive maximum business value from your information network. Find out more about Progent's patch management support services.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo supports single-tap identity confirmation with Apple iOS, Android, and other out-of-band devices. Using 2FA, whenever you sign into a protected application and enter your password you are requested to verify who you are via a device that only you have and that uses a different ("out-of-band") network channel. A broad range of devices can be utilized for this second means of authentication such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can register multiple validation devices. To find out more about Duo identity authentication services, go to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of in-depth reporting plug-ins created to integrate with the industry's leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as spotty support follow-up or machines with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.