Brighton 24x7x365 Emergency Crypto-Ransomware
Malware Detection and Recovery Help

Crypto-Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that represents an existential danger for businesses of all sizes poorly prepared for an assault. Different iterations of ransomware such as Reveton, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for years and continue to inflict havoc. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Nephilim, as well as frequent unnamed malware, not only encrypt on-line data files but also infect many accessible system backups. Data synched to the cloud can also be ransomed. In a poorly architected system, this can make automatic restore operations impossible and basically sets the network back to zero.

Restoring services and information following a ransomware attack becomes a sprint against the clock as the targeted business struggles to stop lateral movement, cleanup the ransomware, and resume mission-critical operations. Because ransomware needs time to move laterally, penetrations are usually launched on weekends and holidays, when attacks may take more time to recognize. This compounds the difficulty of promptly assembling and coordinating a qualified response team.

Progent provides a range of solutions for securing organizations from ransomware penetrations. Among these are user education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, in addition to setup and configuration of next-generation security appliances with AI capabilities from SentinelOne to detect and extinguish new cyber threats quickly. Progent also provides the services of veteran ransomware recovery engineers with the track record and commitment to rebuild a compromised system as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not provide any assurance that distant criminals will return the keys to decipher any of your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to setup from scratch the mission-critical parts of your IT environment. Absent access to full system backups, this requires a wide range of IT skills, professional team management, and the capability to work 24x7 until the job is over.

For two decades, Progent has offered professional IT services for companies across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded top certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP applications. This breadth of expertise gives Progent the capability to efficiently understand necessary systems and re-organize the remaining parts of your network environment after a ransomware event and rebuild them into a functioning network.

Progent's security group utilizes powerful project management systems to orchestrate the complex recovery process. Progent understands the importance of acting rapidly and in concert with a client's management and IT resources to assign priority to tasks and to put key systems back on line as fast as humanly possible.

Case Study: A Successful Ransomware Penetration Recovery
A business contacted Progent after their company was penetrated by Ryuk crypto-ransomware. Ryuk is believed to have been launched by Northern Korean state cybercriminals, possibly adopting strategies exposed from the U.S. National Security Agency. Ryuk targets specific businesses with little or no ability to sustain disruption and is one of the most profitable incarnations of ransomware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company based in Chicago with about 500 staff members. The Ryuk penetration had brought down all company operations and manufacturing capabilities. The majority of the client's data backups had been on-line at the start of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and wishfully thinking for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the client to quickly get our arms around and prioritize the key areas that needed to be addressed in order to restart company functions:

• Microsoft Active Directory
• Electronic Messaging
• Accounting/MRP

Within two days, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then performed reinstallations and hard drive recovery on mission critical servers. All Exchange schema and attributes were usable, which accelerated the restore of Exchange. Progent was able to locate non-encrypted OST files (Outlook Email Off-Line Data Files) on various desktop computers and laptops in order to recover mail information. A recent off-line backup of the client's accounting/ERP systems made them able to return these essential services back on-line. Although major work still had to be done to recover completely from the Ryuk virus, critical services were returned to operations rapidly:

During the following few weeks important milestones in the restoration project were made in tight cooperation between Progent engineers and the client:

• In-house web applications were brought back up with no loss of information.
• The MailStore Exchange Server exceeding 4 million historical emails was brought online and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control capabilities were fully recovered.
• A new Palo Alto 850 firewall was set up and programmed.
• 90% of the user desktops were operational.

Conclusion
A probable company-ending catastrophe was dodged through the efforts of hard-working professionals, a wide range of IT skills, and close collaboration. Although in retrospect the ransomware attack detailed here would have been shut down with current cyber security systems and ISO/IEC 27001 best practices, team training, and appropriate incident response procedures for backup and applying software patches, the fact remains that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's team of experts has extensive experience in crypto-ransomware virus defense, cleanup, and information systems recovery.

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Brighton a portfolio of remote monitoring and security evaluation services to assist you to reduce the threat from ransomware. These services utilize modern artificial intelligence technology to uncover zero-day strains of crypto-ransomware that are able to evade legacy signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates state-of-the-art remote monitoring and management technology to help keep your network operating efficiently by checking the state of vital computers that power your information system. When ProSight LAN Watch detects an issue, an alert is sent automatically to your specified IT staff and your Progent engineering consultant so that any looming issues can be resolved before they have a chance to disrupt productivity. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based solution for managing your client-server infrastructure by providing tools for streamlining common tedious tasks. These can include health monitoring, patch management, automated repairs, endpoint setup, backup and restore, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alert to your designated IT personnel and your Progent technical consultant so that potential issues can be taken care of before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for smaller businesses to diagram, monitor, reconfigure and debug their networking hardware such as routers, firewalls, and access points plus servers, endpoints and other networked devices. Using cutting-edge RMM technology, ProSight WAN Watch makes sure that infrastructure topology maps are always current, copies and displays the configuration information of virtually all devices connected to your network, monitors performance, and sends alerts when problems are detected. By automating time-consuming management processes, ProSight WAN Watch can cut hours off ordinary tasks such as making network diagrams, expanding your network, finding devices that require critical software patches, or resolving performance issues. Find out more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of in-depth reporting tools designed to work with the industry's leading ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues such as spotty support follow-up or machines with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore software providers to create ProSight Data Protection Services (DPS), a family of offerings that deliver backup-as-a-service. ProSight DPS services manage and track your backup processes and allow non-disruptive backup and fast recovery of important files, apps, system images, plus virtual machines. ProSight DPS lets you recover from data loss caused by equipment breakdown, natural disasters, fire, malware such as ransomware, human mistakes, malicious insiders, or application bugs. Managed services available in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to determine which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of leading information security companies to deliver web-based management and world-class security for all your email traffic. The powerful architecture of Progent's Email Guard managed service integrates cloud-based filtering with a local security gateway device to provide advanced protection against spam, viruses, Dos Attacks, DHAs, and other email-based threats. The Cloud Protection Layer acts as a preliminary barricade and keeps most threats from making it to your security perimeter. This decreases your vulnerability to inbound attacks and conserves network bandwidth and storage space. Email Guard's onsite gateway device provides a further layer of analysis for inbound email. For outgoing email, the local gateway offers anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The local gateway can also assist Microsoft Exchange Server to track and safeguard internal email traffic that originates and ends within your security perimeter. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo MFA managed services incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication. Duo enables one-tap identity confirmation with iOS, Google Android, and other out-of-band devices. With Duo 2FA, whenever you log into a secured application and give your password you are asked to confirm who you are on a unit that only you have and that uses a separate network channel. A broad range of devices can be utilized for this second form of ID validation including a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can designate multiple verification devices. For more information about Duo identity authentication services, visit Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Desk: Help Desk Managed Services
  Progent's Call Center managed services allow your information technology staff to outsource Support Desk services to Progent or divide activity for Service Desk support transparently between your in-house network support team and Progent's nationwide roster of certified IT support engineers and subject matter experts. Progent's Shared Help Desk Service provides a smooth extension of your in-house support resources. End user access to the Service Desk, provision of support services, problem escalation, ticket creation and tracking, efficiency metrics, and management of the support database are consistent whether incidents are resolved by your internal network support staff, by Progent, or both. Find out more about Progent's outsourced/co-managed Call Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior machine learning tools to guard endpoint devices and physical and virtual servers against new malware assaults like ransomware and file-less exploits, which easily evade legacy signature-matching anti-virus products. Progent ASM services safeguard on-premises and cloud resources and provides a single platform to automate the complete threat lifecycle including blocking, identification, containment, cleanup, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered attacks. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, retrieve and protect information about your IT infrastructure, processes, business apps, and services. You can instantly find passwords or serial numbers and be warned automatically about impending expirations of SSL certificates or warranties. By cleaning up and organizing your IT documentation, you can eliminate as much as 50% of time wasted trying to find vital information about your IT network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents required for managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're making enhancements, performing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the information you need when you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide businesses of any size a flexible and affordable alternative for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your dynamic IT system. Besides maximizing the security and reliability of your IT environment, Progent's software/firmware update management services permit your in-house IT staff to concentrate on line-of-business projects and tasks that derive the highest business value from your information network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host configured and managed by Progent's network support professionals. With Progent's ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS platforms, and the apps. Since the environment is virtualized, it can be moved immediately to a different hardware solution without a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that incorporates SentinelOne's cutting edge behavior-based machine learning technology to guard physical and virtual endpoint devices against new malware assaults like ransomware and email phishing, which routinely evade traditional signature-matching anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and provides a single platform to address the complete malware attack lifecycle including filtering, identification, containment, remediation, and post-attack forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer affordable multi-layer security for physical servers and virtual machines, desktops, smartphones, and Exchange email. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and responding to security threats from all attack vectors. ProSight ESP delivers firewall protection, penetration alarms, endpoint control, and web filtering via leading-edge tools packaged within one agent managed from a single control. Progent's data protection and virtualization experts can help your business to plan and configure a ProSight ESP deployment that addresses your company's specific requirements and that helps you demonstrate compliance with legal and industry data security regulations. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that require urgent action. Progent can also help you to set up and test a backup and disaster recovery system such as ProSight Data Protection Services so you can recover rapidly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange email filtering.