24/7 Los Angeles Immediate Ransomware
Malware Detection and Removal Support

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyberplague that represents an existential danger for organizations unprepared for an assault. Versions of crypto-ransomware like the CryptoLocker, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for many years and continue to inflict destruction. More recent variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, plus daily unnamed newcomers, not only do encryption of online critical data but also infiltrate all accessible system protection mechanisms. Data synched to off-site disaster recovery sites can also be corrupted. In a vulnerable data protection solution, it can make automatic restoration hopeless and basically knocks the datacenter back to zero.

Getting back on-line programs and information following a crypto-ransomware event becomes a race against the clock as the targeted organization tries its best to contain the damage and remove the virus and to restore mission-critical operations. Due to the fact that crypto-ransomware needs time to spread, assaults are usually sprung during nights and weekends, when successful penetrations are likely to take longer to notice. This multiplies the difficulty of promptly marshalling and organizing a qualified mitigation team.

Progent has a variety of support services for protecting organizations from ransomware penetrations. Among these are team training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of next-generation security appliances with artificial intelligence capabilities from SentinelOne to identify and suppress day-zero cyber threats automatically. Progent also provides the services of seasoned ransomware recovery consultants with the skills and perseverance to rebuild a breached system as urgently as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a ransomware attack, paying the ransom demands in Bitcoin cryptocurrency does not provide any assurance that cyber criminals will return the keys to decrypt all your information. Kaspersky Labs determined that 17% of ransomware victims never restored their files after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms frequently range from 15-40 BTC ($120,000 and $400,000). This is greatly above the average ransomware demands, which ZDNET averages to be in the range of $13,000. The alternative is to setup from scratch the mission-critical parts of your IT environment. Without access to complete data backups, this calls for a broad range of skills, top notch team management, and the capability to work 24x7 until the task is done.

For decades, Progent has provided professional IT services for businesses in Los Angeles and throughout the US and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, and SANS GIAC. (Refer to Progent's certifications). Progent in addition has experience in accounting and ERP application software. This breadth of experience gives Progent the skills to efficiently identify important systems and re-organize the remaining pieces of your IT environment after a ransomware penetration and rebuild them into a functioning system.

Progent's security team of experts has state-of-the-art project management systems to orchestrate the sophisticated restoration process. Progent knows the urgency of working rapidly and in concert with a client's management and IT resources to prioritize tasks and to put critical applications back online as soon as possible.

Client Case Study: A Successful Crypto-Ransomware Incident Recovery
A business engaged Progent after their network system was attacked by the Ryuk ransomware. Ryuk is thought to have been developed by Northern Korean state criminal gangs, possibly adopting approaches exposed from the United States National Security Agency. Ryuk targets specific businesses with little or no ability to sustain disruption and is among the most lucrative incarnations of ransomware viruses. Major targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing business based in Chicago and has about 500 workers. The Ryuk penetration had paralyzed all essential operations and manufacturing processes. The majority of the client's data backups had been online at the beginning of the intrusion and were eventually encrypted. The client considered paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for the best, but in the end utilized Progent.

Progent worked hand in hand the customer to rapidly identify and prioritize the critical systems that had to be addressed in order to resume departmental operations:

• Active Directory (AD)
• Microsoft Exchange Server
• Accounting/MRP

In less than two days, Progent was able to recover Active Directory services to its pre-attack state. Progent then charged ahead with reinstallations and hard drive recovery on key systems. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to collect intact OST data files (Microsoft Outlook Off-Line Data Files) on team workstations in order to recover email messages. A not too old offline backup of the customer's financials/ERP systems made it possible to return these vital applications back online for users. Although significant work still had to be done to recover totally from the Ryuk damage, critical services were recovered rapidly:

Over the next few weeks key milestones in the restoration process were accomplished in close collaboration between Progent engineers and the customer:

• In-house web applications were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server with over four million archived emails was spun up and available for users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control modules were completely restored.
• A new Palo Alto 850 security appliance was set up.
• Ninety percent of the desktop computers were fully operational.

Conclusion
A likely business-killing disaster was averted through the efforts of top-tier experts, a broad range of knowledge, and tight teamwork. Although in post mortem the crypto-ransomware penetration detailed here should have been stopped with up-to-date security solutions and best practices, user education, and appropriate security procedures for information backup and proper patching controls, the fact remains that state-sponsored hackers from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware penetration, remember that Progent's roster of professionals has proven experience in ransomware virus blocking, removal, and information systems recovery.

To read or download a PDF version of this customer story, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers businesses in Los Angeles a portfolio of remote monitoring and security evaluation services designed to help you to minimize your vulnerability to crypto-ransomware. These services utilize modern artificial intelligence capability to detect zero-day strains of ransomware that can escape detection by legacy signature-based anti-virus products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoints against modern malware assaults such as ransomware and email phishing, which routinely get by legacy signature-based AV products. ProSight ASM safeguards on-premises and cloud resources and provides a single platform to automate the entire malware attack lifecycle including blocking, detection, mitigation, remediation, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer economical multi-layer security for physical servers and virtual machines, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced machine learning for round-the-clock monitoring and responding to cyber assaults from all attack vectors. ProSight ESP offers firewall protection, penetration alarms, endpoint management, and web filtering through leading-edge technologies incorporated within one agent managed from a single console. Progent's data protection and virtualization consultants can assist your business to plan and configure a ProSight ESP deployment that meets your company's specific needs and that allows you prove compliance with legal and industry information security regulations. Progent will help you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that call for urgent action. Progent can also help your company to install and verify a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange filtering.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with leading backup software providers to create ProSight Data Protection Services (DPS), a portfolio of management outsourcing plans that provide backup-as-a-service. ProSight DPS products automate and track your backup processes and enable non-disruptive backup and rapid recovery of critical files/folders, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss caused by hardware breakdown, natural disasters, fire, malware such as ransomware, user error, ill-intentioned employees, or application bugs. Managed services in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to identify which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of top data security companies to provide web-based management and comprehensive security for your inbound and outbound email. The powerful architecture of Progent's Email Guard managed service combines a Cloud Protection Layer with a local gateway device to provide complete defense against spam, viruses, Dos Attacks, DHAs, and other email-borne malware. Email Guard's cloud filter acts as a preliminary barricade and blocks most threats from making it to your network firewall. This reduces your vulnerability to inbound attacks and saves network bandwidth and storage space. Email Guard's onsite security gateway appliance provides a further layer of analysis for incoming email. For outgoing email, the onsite gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Microsoft Exchange Server to track and safeguard internal email that stays inside your security perimeter. For more information, see Email Guard spam and content filtering.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to diagram, monitor, optimize and debug their connectivity appliances such as switches, firewalls, and access points plus servers, endpoints and other networked devices. Using cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network maps are kept current, copies and manages the configuration of almost all devices on your network, monitors performance, and generates alerts when potential issues are discovered. By automating time-consuming network management activities, ProSight WAN Watch can knock hours off common chores like network mapping, expanding your network, finding appliances that require critical software patches, or isolating performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management consulting.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) technology to keep your IT system running efficiently by checking the health of critical computers that drive your business network. When ProSight LAN Watch uncovers a problem, an alarm is sent automatically to your specified IT staff and your assigned Progent engineering consultant so any looming issues can be addressed before they can disrupt your network. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's network support experts. Under Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the OS platforms, and the apps. Since the environment is virtualized, it can be moved easily to an alternate hosting environment without requiring a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not locked into one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, find and safeguard information related to your network infrastructure, processes, applications, and services. You can quickly find passwords or serial numbers and be warned automatically about upcoming expirations of SSLs ,domains or warranties. By updating and organizing your IT documentation, you can eliminate up to half of time spent searching for vital information about your IT network. ProSight IT Asset Management features a centralized location for holding and sharing all documents related to managing your network infrastructure like recommended procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're planning enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you require when you need it. Find out more about ProSight IT Asset Management service.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that utilizes cutting edge behavior machine learning tools to defend endpoint devices and physical and virtual servers against new malware attacks such as ransomware and file-less exploits, which easily escape traditional signature-matching AV products. Progent ASM services safeguard local and cloud resources and provides a unified platform to automate the entire threat lifecycle including protection, identification, mitigation, cleanup, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against new threats. Learn more about Progent's ransomware defense and recovery services.

• Progent's Outsourced/Shared Call Desk: Support Desk Managed Services
  Progent's Call Center services enable your information technology team to outsource Support Desk services to Progent or divide responsibilities for support services transparently between your in-house support staff and Progent's extensive pool of certified IT service engineers and subject matter experts. Progent's Shared Service Desk offers a smooth supplement to your in-house IT support group. User interaction with the Service Desk, provision of support, issue escalation, ticket creation and updates, efficiency metrics, and management of the service database are consistent whether issues are taken care of by your core support group, by Progent, or by a combination. Read more about Progent's outsourced/shared Help Desk services.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a versatile and affordable alternative for assessing, testing, scheduling, implementing, and tracking software and firmware updates to your ever-evolving IT network. In addition to optimizing the security and functionality of your IT network, Progent's software/firmware update management services free up time for your IT team to focus on more strategic initiatives and activities that deliver maximum business value from your information network. Find out more about Progent's patch management services.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo technology to defend against stolen passwords through the use of two-factor authentication. Duo supports one-tap identity confirmation on Apple iOS, Android, and other personal devices. Using 2FA, whenever you sign into a protected application and enter your password you are asked to confirm your identity on a device that only you possess and that uses a different network channel. A broad range of out-of-band devices can be utilized as this added means of ID validation such as a smartphone or watch, a hardware token, a landline telephone, etc. You may designate several verification devices. To learn more about ProSight Duo identity authentication services, go to Cisco Duo MFA two-factor authentication (2FA) services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of in-depth reporting plug-ins created to integrate with the top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.