24/7/365 Birmingham Urgent Crypto
Virus Detection and Remediation Consultants

Crypto-Ransomware : Your Crippling IT Catastrophe
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level threat for businesses of all sizes vulnerable to an assault. Different iterations of ransomware such as CryptoLocker, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been circulating for years and continue to inflict damage. Recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, along with additional as yet unnamed malware, not only do encryption of on-line files but also infiltrate any configured system backups. Information synched to the cloud can also be encrypted. In a poorly architected data protection solution, this can make automated restoration useless and basically sets the network back to zero.

Getting back online programs and information after a ransomware event becomes a race against time as the targeted organization fights to stop the spread, eradicate the ransomware, and restore business-critical operations. Since ransomware needs time to spread, penetrations are usually launched at night, when successful attacks in many cases take longer to notice. This compounds the difficulty of promptly assembling and orchestrating a capable response team.

Progent offers a variety of help services for protecting businesses from ransomware penetrations. These include team training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of next-generation security gateways with machine learning technology from SentinelOne to detect and quarantine day-zero threats automatically. Progent also can provide the assistance of seasoned ransomware recovery professionals with the skills and perseverance to re-deploy a breached network as rapidly as possible.

Progent's Ransomware Restoration Support Services
Following a crypto-ransomware penetration, paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will provide the needed codes to decipher any of your information. Kaspersky determined that seventeen percent of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to setup from scratch the vital elements of your IT environment. Absent access to complete information backups, this requires a wide complement of skill sets, well-coordinated project management, and the capability to work non-stop until the job is completed.

For twenty years, Progent has provided expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have been awarded top industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with accounting and ERP software solutions. This breadth of expertise gives Progent the capability to rapidly identify necessary systems and organize the remaining pieces of your computer network environment following a ransomware attack and rebuild them into an operational system.

Progent's recovery team of experts uses powerful project management systems to coordinate the complicated restoration process. Progent knows the urgency of working rapidly and in unison with a customer's management and IT resources to prioritize tasks and to put the most important systems back on-line as soon as possible.

Customer Story: A Successful Crypto-Ransomware Penetration Recovery
A client sought out Progent after their network was penetrated by Ryuk ransomware virus. Ryuk is believed to have been launched by North Korean government sponsored cybercriminals, suspected of using strategies leaked from America's NSA organization. Ryuk targets specific organizations with limited ability to sustain operational disruption and is one of the most lucrative instances of ransomware viruses. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago and has around 500 employees. The Ryuk intrusion had frozen all company operations and manufacturing processes. Most of the client's information backups had been online at the time of the attack and were encrypted. The client was actively seeking loans for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the customer to quickly assess and prioritize the mission critical applications that had to be restored to make it possible to resume departmental functions:

• Active Directory (AD)
• Microsoft Exchange Email
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then initiated reinstallations and hard drive recovery of essential applications. All Microsoft Exchange Server data and configuration information were usable, which facilitated the restore of Exchange. Progent was able to locate local OST data files (Outlook Off-Line Folder Files) on staff PCs to recover mail messages. A recent offline backup of the businesses manufacturing software made them able to return these vital services back servicing users. Although a large amount of work remained to recover fully from the Ryuk damage, the most important services were restored rapidly:

Throughout the following month key milestones in the recovery process were accomplished through tight collaboration between Progent team members and the customer:

• Internal web applications were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million historical emails was brought online and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control modules were 100 percent restored.
• A new Palo Alto 850 security appliance was deployed.
• Ninety percent of the user desktops were fully operational.

Conclusion
A likely enterprise-killing catastrophe was evaded through the efforts of dedicated professionals, a wide spectrum of subject matter expertise, and close collaboration. Although upon completion of forensics the ransomware virus penetration described here should have been stopped with current security technology solutions and NIST Cybersecurity Framework best practices, staff training, and well designed security procedures for information protection and applying software patches, the reality remains that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a crypto-ransomware penetration, remember that Progent's team of professionals has proven experience in crypto-ransomware virus blocking, mitigation, and information systems restoration.

To review or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Birmingham a range of online monitoring and security evaluation services to assist you to minimize the threat from ransomware. These services include modern artificial intelligence capability to uncover new strains of ransomware that are able to evade legacy signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management (RMM) technology to keep your network operating efficiently by checking the state of vital computers that power your business network. When ProSight LAN Watch uncovers a problem, an alert is sent immediately to your designated IT personnel and your Progent engineering consultant so that any looming issues can be resolved before they have a chance to impact your network. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for monitoring and managing your network, server, and desktop devices by providing an environment for performing common time-consuming tasks. These can include health checking, update management, automated repairs, endpoint deployment, backup and recovery, anti-virus defense, secure remote access, standard and custom scripts, resource inventory, endpoint status reporting, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your designated IT management personnel and your Progent technical consultant so potential issues can be taken care of before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to map, monitor, optimize and troubleshoot their networking hardware such as switches, firewalls, and wireless controllers plus servers, printers, client computers and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology maps are kept updated, copies and displays the configuration information of virtually all devices on your network, monitors performance, and sends notices when potential issues are detected. By automating tedious network management processes, ProSight WAN Watch can knock hours off ordinary tasks like network mapping, reconfiguring your network, finding appliances that require critical updates, or identifying the cause of performance problems. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of in-depth reporting utilities created to work with the industry's top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues like inconsistent support follow-up or machines with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with leading backup technology companies to create ProSight Data Protection Services, a selection of subscription-based offerings that provide backup-as-a-service. ProSight DPS products manage and track your data backup processes and enable non-disruptive backup and fast restoration of critical files, applications, system images, and virtual machines. ProSight DPS lets you recover from data loss caused by equipment breakdown, natural calamities, fire, cyber attacks like ransomware, user error, malicious insiders, or application bugs. Managed backup services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of top information security companies to provide centralized management and world-class security for all your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service integrates cloud-based filtering with a local gateway device to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The cloud filter acts as a first line of defense and keeps most unwanted email from making it to your network firewall. This decreases your exposure to external attacks and saves network bandwidth and storage. Email Guard's on-premises gateway appliance provides a deeper level of analysis for incoming email. For outgoing email, the local security gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The onsite gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email that stays inside your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication service plans utilize Cisco's Duo technology to defend against compromised passwords through the use of two-factor authentication (2FA). Duo supports single-tap identity confirmation on iOS, Android, and other out-of-band devices. With Duo 2FA, when you log into a protected online account and give your password you are requested to confirm who you are on a unit that only you have and that uses a different ("out-of-band") network channel. A wide selection of out-of-band devices can be used as this added form of ID validation such as a smartphone or wearable, a hardware token, a landline telephone, etc. You can designate multiple validation devices. To find out more about Duo identity authentication services, see Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Help Desk: Help Desk Managed Services
  Progent's Help Center managed services enable your IT team to outsource Call Center services to Progent or divide activity for support services transparently between your in-house network support team and Progent's extensive pool of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a smooth extension of your in-house support resources. User access to the Service Desk, provision of technical assistance, issue escalation, ticket generation and tracking, performance measurement, and maintenance of the support database are cohesive whether issues are resolved by your in-house network support resources, by Progent, or a mix of the two. Find out more about Progent's outsourced/co-managed Service Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that utilizes cutting edge behavior-based machine learning tools to defend endpoint devices as well as physical and virtual servers against modern malware attacks such as ransomware and file-less exploits, which easily get by traditional signature-matching anti-virus products. Progent Active Security Monitoring services protect local and cloud resources and offers a unified platform to address the complete malware attack lifecycle including protection, identification, mitigation, remediation, and post-attack forensics. Top capabilities include single-click rollback with Windows VSS and automatic system-wide immunization against new attacks. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, maintain, retrieve and protect information related to your network infrastructure, procedures, business apps, and services. You can quickly find passwords or IP addresses and be alerted about impending expirations of SSLs ,domains or warranties. By cleaning up and managing your network documentation, you can eliminate up to 50% of time thrown away looking for critical information about your IT network. ProSight IT Asset Management includes a centralized location for storing and collaborating on all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're making enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the information you need as soon as you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide organizations of all sizes a flexible and cost-effective solution for assessing, validating, scheduling, applying, and documenting updates to your ever-evolving IT network. Besides optimizing the protection and reliability of your IT network, Progent's software/firmware update management services permit your IT staff to focus on more strategic projects and activities that deliver maximum business value from your information network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a secure Tier III data center on a fast virtual host set up and managed by Progent's IT support experts. With the ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the applications. Since the environment is virtualized, it can be moved easily to an alternate hardware solution without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not tied a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior machine learning tools to defend physical and virtual endpoints against modern malware assaults like ransomware and file-less exploits, which routinely escape traditional signature-based AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a single platform to address the complete threat progression including filtering, identification, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection services deliver ultra-affordable multi-layer protection for physical and virtual servers, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and responding to security assaults from all attack vectors. ProSight ESP offers two-way firewall protection, penetration alarms, device management, and web filtering through cutting-edge tools incorporated within a single agent managed from a single console. Progent's data protection and virtualization consultants can help you to design and implement a ProSight ESP environment that meets your organization's specific requirements and that helps you demonstrate compliance with government and industry information protection regulations. Progent will help you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that call for urgent attention. Progent's consultants can also help your company to set up and test a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange filtering.