Campinas 24x7 Emergency CryptoLocker
Virus Detection and Repair Help

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a modern cyberplague that poses an enterprise-level threat for businesses poorly prepared for an attack. Different iterations of ransomware such as CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for a long time and still cause destruction. The latest versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, as well as more as yet unnamed newcomers, not only encrypt on-line data but also infect many available system backups. Information replicated to cloud environments can also be ransomed. In a vulnerable system, this can make any restore operations useless and effectively knocks the entire system back to square one.

Restoring programs and data following a crypto-ransomware attack becomes a race against time as the targeted business fights to contain the damage, cleanup the ransomware, and restore business-critical operations. Because crypto-ransomware requires time to spread, attacks are usually launched during nights and weekends, when successful attacks tend to take longer to discover. This compounds the difficulty of rapidly marshalling and organizing a knowledgeable mitigation team.

Progent offers an assortment of services for protecting organizations from ransomware penetrations. These include user education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of modern security gateways with AI technology from SentinelOne to detect and quarantine day-zero threats quickly. Progent also can provide the assistance of experienced ransomware recovery engineers with the track record and perseverance to reconstruct a compromised environment as rapidly as possible.

Progent's Crypto-Ransomware Restoration Support Services
Soon after a crypto-ransomware attack, sending the ransom in cryptocurrency does not provide any assurance that cyber hackers will provide the needed keys to decipher any of your files. Kaspersky estimated that seventeen percent of crypto-ransomware victims never restored their information after having paid the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to setup from scratch the key components of your Information Technology environment. Absent access to complete data backups, this calls for a wide complement of IT skills, professional project management, and the ability to work 24x7 until the task is completed.

For decades, Progent has offered certified expert IT services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained top industry certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP software solutions. This breadth of expertise provides Progent the skills to quickly understand critical systems and organize the remaining components of your Information Technology system following a crypto-ransomware attack and rebuild them into an operational network.

Progent's security group deploys best of breed project management applications to orchestrate the complicated restoration process. Progent appreciates the importance of working rapidly and in concert with a customer's management and IT staff to prioritize tasks and to get the most important applications back online as fast as possible.

Case Study: A Successful Ransomware Attack Restoration
A client escalated to Progent after their network system was attacked by the Ryuk ransomware. Ryuk is thought to have been developed by Northern Korean government sponsored hackers, possibly adopting technology exposed from the U.S. National Security Agency. Ryuk seeks specific organizations with little or no tolerance for disruption and is among the most lucrative iterations of ransomware malware. Major targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company based in Chicago with around 500 employees. The Ryuk attack had brought down all essential operations and manufacturing capabilities. The majority of the client's system backups had been online at the beginning of the attack and were damaged. The client was actively seeking loans for paying the ransom (in excess of two hundred thousand dollars) and praying for good luck, but ultimately utilized Progent.

Progent worked with the customer to rapidly determine and assign priority to the critical applications that had to be restored in order to restart business operations:

• Active Directory
• Electronic Messaging
• Accounting/MRP

Within two days, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then initiated reinstallations and hard drive recovery of the most important servers. All Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to assemble local OST files (Outlook Offline Data Files) on staff workstations and laptops in order to recover email data. A not too old off-line backup of the client's accounting/MRP systems made them able to restore these vital programs back online for users. Although a large amount of work was left to recover fully from the Ryuk damage, the most important systems were returned to operations quickly:

During the following month important milestones in the recovery project were achieved in tight cooperation between Progent team members and the customer:

• Self-hosted web sites were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server exceeding 4 million historical emails was spun up and accessible to users.
• CRM/Product Ordering/Invoicing/AP/AR/Inventory Control modules were 100 percent restored.
• A new Palo Alto 850 security appliance was set up.
• Most of the user workstations were back into operation.

Conclusion
A likely company-ending disaster was evaded through the efforts of results-oriented experts, a broad array of subject matter expertise, and close collaboration. Although upon completion of forensics the crypto-ransomware penetration detailed here would have been identified and blocked with up-to-date cyber security technology solutions and ISO/IEC 27001 best practices, staff training, and well designed incident response procedures for backup and proper patching controls, the reality is that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware incursion, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, removal, and file restoration.

To read or download a PDF version of this case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Campinas a variety of remote monitoring and security assessment services to assist you to reduce the threat from ransomware. These services incorporate next-generation artificial intelligence technology to uncover new variants of ransomware that are able to escape detection by legacy signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management techniques to keep your IT system operating efficiently by checking the state of vital assets that drive your business network. When ProSight LAN Watch uncovers an issue, an alarm is sent automatically to your specified IT staff and your assigned Progent engineering consultant so all potential problems can be addressed before they can impact your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your client-server infrastructure by offering tools for performing common tedious tasks. These include health checking, update management, automated repairs, endpoint setup, backup and restore, anti-virus protection, secure remote access, standard and custom scripts, asset inventory, endpoint status reports, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your designated IT management personnel and your assigned Progent technical consultant so that emerging problems can be taken care of before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to map, track, optimize and debug their networking appliances like routers, firewalls, and load balancers as well as servers, printers, endpoints and other networked devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that network maps are kept updated, captures and displays the configuration information of virtually all devices on your network, tracks performance, and sends alerts when potential issues are detected. By automating time-consuming network management processes, ProSight WAN Watch can knock hours off common chores like making network diagrams, expanding your network, locating devices that require important updates, or identifying the cause of performance issues. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of in-depth management reporting tools designed to integrate with the leading ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with leading backup software providers to produce ProSight Data Protection Services, a portfolio of offerings that deliver backup-as-a-service. ProSight DPS products manage and track your backup processes and enable transparent backup and rapid recovery of vital files, apps, images, plus VMs. ProSight DPS lets you protect against data loss resulting from equipment breakdown, natural disasters, fire, malware like ransomware, user mistakes, ill-intentioned insiders, or software bugs. Managed backup services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent expert can help you to identify which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of leading data security companies to provide web-based management and comprehensive protection for all your email traffic. The powerful structure of Progent's Email Guard combines cloud-based filtering with an on-premises gateway appliance to offer complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The Cloud Protection Layer acts as a preliminary barricade and keeps the vast majority of unwanted email from reaching your security perimeter. This reduces your exposure to external threats and conserves system bandwidth and storage. Email Guard's on-premises gateway appliance provides a deeper layer of analysis for inbound email. For outgoing email, the local gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Exchange Server to monitor and safeguard internal email traffic that stays inside your security perimeter. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to defend against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation on Apple iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a protected online account and enter your password you are requested to confirm your identity on a device that only you have and that is accessed using a separate network channel. A broad selection of devices can be used for this second form of ID validation such as an iPhone or Android or wearable, a hardware token, a landline phone, etc. You can designate several verification devices. For details about Duo two-factor identity validation services, go to Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Center: Help Desk Managed Services
  Progent's Support Desk managed services allow your IT group to outsource Help Desk services to Progent or divide responsibilities for Help Desk services seamlessly between your in-house network support team and Progent's nationwide pool of IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a smooth supplement to your core support team. End user access to the Help Desk, delivery of support services, issue escalation, ticket generation and tracking, performance measurement, and management of the support database are consistent regardless of whether issues are taken care of by your in-house support organization, by Progent's team, or both. Read more about Progent's outsourced/shared Call Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that utilizes next generation behavior analysis technology to defend endpoints and servers and VMs against modern malware assaults such as ransomware and email phishing, which routinely get by traditional signature-matching AV products. Progent Active Security Monitoring services protect local and cloud resources and provides a unified platform to automate the entire threat progression including protection, detection, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback with Windows VSS and automatic system-wide immunization against newly discovered attacks. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and safeguard information about your IT infrastructure, procedures, applications, and services. You can instantly find passwords or IP addresses and be warned about upcoming expirations of SSL certificates ,domains or warranties. By updating and organizing your IT documentation, you can save up to half of time spent searching for critical information about your IT network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents required for managing your business network like standard operating procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT data. Whether you're planning improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you require when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide organizations of all sizes a flexible and cost-effective solution for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving IT system. Besides optimizing the security and functionality of your IT environment, Progent's patch management services allow your in-house IT staff to focus on line-of-business projects and tasks that deliver the highest business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host set up and maintained by Progent's network support professionals. Under Progent's ProSight Virtual Hosting model, the client owns the data, the OS software, and the apps. Since the system is virtualized, it can be ported easily to a different hardware environment without a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior-based machine learning technology to defend physical and virtual endpoints against modern malware attacks such as ransomware and file-less exploits, which routinely get by legacy signature-matching AV tools. ProSight ASM safeguards on-premises and cloud-based resources and offers a unified platform to address the entire malware attack progression including protection, identification, containment, cleanup, and forensics. Top capabilities include single-click rollback using Windows VSS and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services deliver affordable multi-layer security for physical and virtual servers, workstations, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to security assaults from all vectors. ProSight ESP offers firewall protection, intrusion alarms, device management, and web filtering via leading-edge technologies incorporated within one agent accessible from a unified console. Progent's data protection and virtualization experts can help your business to design and configure a ProSight ESP deployment that meets your company's unique needs and that helps you prove compliance with legal and industry information security standards. Progent will assist you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that call for urgent action. Progent can also help your company to install and verify a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.