Barueri-Alphaville 24-Hour Immediate Crypto-Ransomware
Infection Detection and Remediation Services

Ransomware : Your Feared IT Disaster
Ransomware has become a modern cyberplague that represents an extinction-level danger for organizations vulnerable to an attack. Different iterations of crypto-ransomware like the Reveton, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for a long time and still inflict damage. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, along with frequent unnamed malware, not only encrypt on-line data but also infiltrate all accessible system protection mechanisms. Data synchronized to the cloud can also be corrupted. In a poorly designed environment, it can render automated recovery useless and basically sets the entire system back to zero.

Getting back on-line services and information after a ransomware event becomes a sprint against time as the targeted business struggles to contain, remove the crypto-ransomware, and resume mission-critical operations. Since ransomware needs time to spread, penetrations are often sprung during weekends and nights, when attacks may take longer to identify. This multiplies the difficulty of rapidly assembling and orchestrating a knowledgeable mitigation team.

Progent provides an assortment of help services for securing enterprises from ransomware events. Among these are team training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of next-generation security appliances with machine learning capabilities from SentinelOne to identify and extinguish zero-day cyber threats intelligently. Progent also provides the services of experienced ransomware recovery consultants with the talent and commitment to re-deploy a breached environment as soon as possible.

Progent's Ransomware Recovery Help
Subsequent to a ransomware event, even paying the ransom in cryptocurrency does not ensure that distant criminals will return the codes to unencrypt any of your files. Kaspersky ascertained that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to piece back together the key elements of your IT environment. Without access to complete information backups, this requires a wide range of IT skills, top notch project management, and the capability to work continuously until the task is over.

For two decades, Progent has made available expert Information Technology services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have earned top certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP application software. This breadth of expertise provides Progent the skills to rapidly ascertain necessary systems and consolidate the surviving components of your IT environment following a crypto-ransomware event and configure them into a functioning network.

Progent's security team of experts utilizes best of breed project management applications to coordinate the complex restoration process. Progent understands the importance of acting quickly and in concert with a customer's management and IT resources to prioritize tasks and to get critical services back online as soon as humanly possible.

Customer Case Study: A Successful Ransomware Virus Response
A business sought out Progent after their network system was brought down by Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean state sponsored hackers, suspected of using technology exposed from America's National Security Agency. Ryuk targets specific businesses with limited ability to sustain operational disruption and is among the most lucrative incarnations of ransomware viruses. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company based in Chicago with around 500 employees. The Ryuk penetration had paralyzed all company operations and manufacturing processes. The majority of the client's information backups had been online at the time of the intrusion and were damaged. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and praying for good luck, but ultimately utilized Progent.

Progent worked together with the customer to rapidly assess and assign priority to the mission critical systems that needed to be restored in order to resume business functions:

• Windows Active Directory
• Microsoft Exchange Server
• MRP System

In less than two days, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then performed rebuilding and hard drive recovery of needed applications. All Exchange ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to find intact OST data files (Outlook Email Off-Line Folder Files) on various workstations and laptops to recover mail messages. A recent off-line backup of the businesses accounting/ERP software made it possible to restore these essential programs back online. Although major work needed to be completed to recover completely from the Ryuk damage, essential services were returned to operations rapidly:

During the following few weeks key milestones in the restoration project were completed in close collaboration between Progent engineers and the client:

• Internal web applications were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server with over four million archived emails was restored to operations and available for users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory functions were 100 percent functional.
• A new Palo Alto Networks 850 firewall was set up.
• Nearly all of the user PCs were functioning as before the incident.

Conclusion
A likely enterprise-killing disaster was dodged with hard-working professionals, a broad array of IT skills, and close teamwork. Although in retrospect the ransomware virus incident detailed here could have been identified and prevented with modern security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and properly executed incident response procedures for data backup and keeping systems up to date with security patches, the reality remains that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's team of experts has substantial experience in ransomware virus defense, cleanup, and file restoration.

To review or download a PDF version of this customer case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Barueri-Alphaville a range of online monitoring and security evaluation services to assist you to minimize your vulnerability to ransomware. These services incorporate next-generation AI capability to detect zero-day strains of crypto-ransomware that can evade traditional signature-based anti-virus products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoint devices against modern malware assaults such as ransomware and email phishing, which routinely escape traditional signature-based anti-virus products. ProSight Active Security Monitoring safeguards local and cloud-based resources and provides a single platform to address the entire threat lifecycle including protection, infiltration detection, mitigation, remediation, and post-attack forensics. Key features include one-click rollback with Windows VSS and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer affordable multi-layer security for physical servers and VMs, workstations, smartphones, and Exchange email. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP offers firewall protection, intrusion alerts, endpoint control, and web filtering through leading-edge technologies incorporated within one agent accessible from a unified console. Progent's data protection and virtualization consultants can assist your business to design and configure a ProSight ESP deployment that addresses your organization's unique needs and that allows you achieve and demonstrate compliance with government and industry data protection regulations. Progent will help you define and implement policies that ProSight ESP will manage, and Progent will monitor your network and respond to alarms that call for immediate action. Progent can also assist you to install and verify a backup and restore solution like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup technology providers to produce ProSight Data Protection Services, a portfolio of offerings that provide backup-as-a-service. ProSight DPS services manage and monitor your backup processes and allow transparent backup and rapid restoration of important files, apps, images, and VMs. ProSight DPS lets your business recover from data loss resulting from hardware failures, natural disasters, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned insiders, or application glitches. Managed backup services available in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to identify which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of leading data security vendors to deliver centralized control and comprehensive protection for your email traffic. The powerful architecture of Progent's Email Guard integrates a Cloud Protection Layer with an on-premises gateway appliance to provide complete protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-based malware. Email Guard's cloud filter acts as a preliminary barricade and blocks the vast majority of unwanted email from making it to your network firewall. This decreases your vulnerability to inbound attacks and conserves system bandwidth and storage space. Email Guard's on-premises gateway device provides a further layer of inspection for inbound email. For outbound email, the onsite security gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also assist Exchange Server to track and protect internal email traffic that originates and ends within your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for smaller businesses to diagram, monitor, reconfigure and troubleshoot their networking appliances like switches, firewalls, and load balancers as well as servers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology maps are always updated, copies and manages the configuration of almost all devices connected to your network, tracks performance, and sends alerts when issues are discovered. By automating tedious management and troubleshooting processes, WAN Watch can knock hours off ordinary tasks like network mapping, reconfiguring your network, finding devices that need important software patches, or isolating performance problems. Learn more about ProSight WAN Watch infrastructure management services.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management technology to help keep your IT system operating at peak levels by checking the health of critical computers that power your information system. When ProSight LAN Watch uncovers a problem, an alarm is sent immediately to your specified IT management staff and your assigned Progent consultant so that any potential issues can be addressed before they can disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a protected Tier III data center on a high-performance virtual host configured and managed by Progent's network support professionals. Under the ProSight Virtual Hosting model, the client owns the data, the operating system software, and the applications. Since the environment is virtualized, it can be moved immediately to a different hosting environment without requiring a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, find and protect data related to your IT infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be warned about upcoming expirations of SSL certificates or domains. By updating and managing your IT documentation, you can save as much as 50% of time spent searching for critical information about your network. ProSight IT Asset Management features a centralized location for holding and sharing all documents related to managing your business network such as standard operating procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and relating IT data. Whether you're making enhancements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the knowledge you require the instant you need it. Learn more about ProSight IT Asset Management service.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes next generation behavior-based analysis tools to guard endpoint devices as well as physical and virtual servers against modern malware attacks such as ransomware and email phishing, which easily get by legacy signature-based anti-virus products. Progent ASM services safeguard on-premises and cloud-based resources and offers a unified platform to manage the entire malware attack lifecycle including filtering, detection, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new attacks. Read more about Progent's ransomware protection and cleanup services.

• Progent's Outsourced/Shared Service Desk: Support Desk Managed Services
  Progent's Call Center services allow your information technology staff to outsource Call Center services to Progent or split responsibilities for Help Desk services transparently between your in-house network support group and Progent's extensive pool of certified IT service engineers and subject matter experts. Progent's Co-managed Service Desk offers a seamless extension of your in-house support organization. End user access to the Service Desk, provision of technical assistance, problem escalation, trouble ticket creation and updates, performance metrics, and management of the support database are consistent whether incidents are resolved by your corporate IT support staff, by Progent, or a mix of the two. Read more about Progent's outsourced/co-managed Help Desk services.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management offer organizations of any size a versatile and affordable solution for assessing, testing, scheduling, applying, and documenting updates to your ever-evolving information network. Besides optimizing the protection and reliability of your IT environment, Progent's software/firmware update management services permit your in-house IT team to focus on line-of-business initiatives and activities that derive maximum business value from your network. Find out more about Progent's software/firmware update management support services.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA managed services incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication (2FA). Duo enables one-tap identity verification on iOS, Android, and other personal devices. Using 2FA, whenever you sign into a secured online account and give your password you are requested to confirm who you are on a device that only you have and that is accessed using a separate network channel. A broad range of devices can be utilized as this second means of ID validation including an iPhone or Android or wearable, a hardware/software token, a landline telephone, etc. You may designate multiple validation devices. For details about ProSight Duo identity authentication services, visit Cisco Duo MFA two-factor authentication (2FA) services for access security.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of in-depth reporting tools created to work with the industry's top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize key issues like inconsistent support follow-up or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.