24x7 Richmond Urgent Crypto
Infection Damage Assessment and Recovery Experts

Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become an escalating cyberplague that represents an extinction-level danger for organizations vulnerable to an attack. Multiple generations of crypto-ransomware like the Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and still inflict harm. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, as well as more as yet unnamed malware, not only do encryption of on-line data files but also infect most configured system backups. Data synched to the cloud can also be ransomed. In a poorly designed system, it can make automatic restoration useless and effectively sets the network back to square one.

Retrieving programs and information after a ransomware intrusion becomes a race against time as the victim fights to stop lateral movement, remove the virus, and restore enterprise-critical activity. Due to the fact that ransomware requires time to spread, attacks are usually launched on weekends and holidays, when penetrations typically take more time to identify. This multiplies the difficulty of promptly marshalling and orchestrating a qualified response team.

Progent makes available a range of support services for securing organizations from ransomware events. These include team education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with installation of modern security appliances with AI technology from SentinelOne to discover and extinguish day-zero cyber attacks quickly. Progent in addition provides the services of seasoned ransomware recovery engineers with the talent and perseverance to reconstruct a breached network as soon as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware event, sending the ransom in cryptocurrency does not provide any assurance that cyber criminals will respond with the needed codes to decrypt any of your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The other path is to piece back together the vital components of your Information Technology environment. Absent access to complete data backups, this requires a broad range of skill sets, well-coordinated team management, and the willingness to work 24x7 until the job is done.

For decades, Progent has offered expert IT services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained top industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of expertise affords Progent the capability to knowledgably ascertain important systems and organize the surviving components of your IT system following a crypto-ransomware penetration and configure them into a functioning system.

Progent's security team of experts deploys state-of-the-art project management applications to orchestrate the complicated recovery process. Progent appreciates the urgency of acting quickly and in concert with a client's management and IT staff to prioritize tasks and to put critical applications back on line as soon as humanly possible.

Customer Case Study: A Successful Ransomware Intrusion Recovery
A customer sought out Progent after their organization was brought down by Ryuk ransomware. Ryuk is thought to have been deployed by Northern Korean government sponsored criminal gangs, suspected of adopting techniques exposed from the United States NSA organization. Ryuk seeks specific organizations with little ability to sustain operational disruption and is among the most lucrative incarnations of ransomware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer headquartered in Chicago and has around 500 employees. The Ryuk event had shut down all business operations and manufacturing processes. The majority of the client's information backups had been directly accessible at the beginning of the attack and were damaged. The client was evaluating paying the ransom (exceeding two hundred thousand dollars) and hoping for good luck, but ultimately utilized Progent.

Progent worked with the customer to quickly identify and prioritize the essential areas that had to be addressed to make it possible to resume company functions:

• Windows Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then accomplished reinstallations and storage recovery of the most important systems. All Exchange ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to find local OST files (Outlook Off-Line Data Files) on user desktop computers and laptops to recover email data. A recent offline backup of the customer's accounting software made it possible to restore these vital applications back available to users. Although significant work remained to recover totally from the Ryuk attack, critical services were recovered rapidly:

During the following month critical milestones in the recovery project were made through close collaboration between Progent engineers and the customer:

• Internal web sites were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server exceeding 4 million historical emails was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables/Inventory Control capabilities were completely functional.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Most of the desktops and laptops were functioning as before the incident.

Conclusion
A potential business disaster was evaded through the efforts of dedicated professionals, a broad range of IT skills, and close teamwork. Although upon completion of forensics the ransomware penetration detailed here could have been identified and disabled with advanced security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and well thought out security procedures for backup and keeping systems up to date with security patches, the fact remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware virus, remember that Progent's team of experts has extensive experience in ransomware virus blocking, remediation, and information systems restoration.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Richmond a variety of remote monitoring and security assessment services to help you to minimize your vulnerability to ransomware. These services include modern AI capability to uncover zero-day strains of ransomware that are able to get past legacy signature-based security solutions.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to keep your IT system operating efficiently by tracking the health of vital computers that drive your information system. When ProSight LAN Watch detects a problem, an alert is sent immediately to your designated IT staff and your assigned Progent engineering consultant so that all looming problems can be addressed before they have a chance to impact productivity. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for managing your network, server, and desktop devices by providing an environment for performing common time-consuming tasks. These include health monitoring, update management, automated repairs, endpoint configuration, backup and recovery, anti-virus defense, remote access, standard and custom scripts, asset inventory, endpoint status reports, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious problem, it transmits an alert to your specified IT personnel and your assigned Progent technical consultant so emerging issues can be taken care of before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for smaller organizations to map out, track, optimize and troubleshoot their connectivity appliances such as routers and switches, firewalls, and wireless controllers plus servers, client computers and other networked devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that infrastructure topology diagrams are always updated, captures and manages the configuration of virtually all devices on your network, tracks performance, and generates alerts when issues are discovered. By automating tedious management activities, ProSight WAN Watch can cut hours off ordinary tasks like network mapping, reconfiguring your network, locating appliances that require important software patches, or resolving performance problems. Find out more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time and in-depth management reporting utilities designed to work with the top ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues like inconsistent support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup/restore technology companies to produce ProSight Data Protection Services, a selection of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS products automate and track your data backup processes and allow non-disruptive backup and fast restoration of vital files/folders, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss resulting from hardware failures, natural disasters, fire, cyber attacks such as ransomware, human mistakes, malicious employees, or software bugs. Managed backup services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading data security companies to deliver web-based control and world-class security for your inbound and outbound email. The powerful structure of Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway device to offer advanced defense against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-borne threats. Email Guard's cloud filter acts as a first line of defense and blocks the vast majority of unwanted email from reaching your network firewall. This reduces your exposure to inbound attacks and saves network bandwidth and storage space. Email Guard's onsite security gateway appliance adds a deeper level of analysis for incoming email. For outgoing email, the onsite security gateway offers AV and anti-spam protection, DLP, and email encryption. The onsite gateway can also help Exchange Server to track and safeguard internal email traffic that stays inside your corporate firewall. For more information, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication managed services incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication. Duo enables single-tap identity verification with iOS, Android, and other personal devices. Using 2FA, whenever you sign into a secured application and enter your password you are requested to confirm your identity on a device that only you have and that is accessed using a different network channel. A broad range of devices can be used as this added form of ID validation such as a smartphone or wearable, a hardware token, a landline phone, etc. You can designate multiple verification devices. For more information about Duo identity authentication services, go to Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Call Desk: Help Desk Managed Services
  Progent's Call Center managed services allow your information technology team to outsource Call Center services to Progent or divide activity for support services seamlessly between your internal network support team and Progent's nationwide roster of IT support engineers and subject matter experts. Progent's Shared Service Desk offers a seamless extension of your in-house network support team. End user access to the Service Desk, delivery of technical assistance, escalation, trouble ticket generation and updates, efficiency metrics, and maintenance of the service database are consistent whether incidents are resolved by your in-house network support resources, by Progent's team, or both. Read more about Progent's outsourced/shared Help Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes cutting edge behavior-based analysis technology to guard endpoints and servers and VMs against modern malware attacks such as ransomware and file-less exploits, which routinely escape legacy signature-matching AV tools. Progent Active Security Monitoring services protect local and cloud-based resources and offers a single platform to automate the complete threat lifecycle including protection, identification, mitigation, remediation, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, retrieve and safeguard data about your network infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be alerted automatically about impending expirations of SSL certificates or warranties. By updating and organizing your network documentation, you can eliminate as much as 50% of time spent looking for vital information about your network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents related to managing your network infrastructure such as recommended procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and relating IT data. Whether you're planning enhancements, doing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management provide organizations of any size a flexible and affordable alternative for evaluating, validating, scheduling, implementing, and documenting updates to your dynamic IT system. In addition to maximizing the security and functionality of your computer environment, Progent's patch management services allow your in-house IT staff to concentrate on line-of-business projects and tasks that deliver maximum business value from your information network. Find out more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and applications hosted in a protected Tier III data center on a high-performance virtual host set up and managed by Progent's network support professionals. With the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the apps. Since the system is virtualized, it can be ported immediately to an alternate hosting solution without a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior analysis tools to guard physical and virtual endpoint devices against modern malware assaults like ransomware and file-less exploits, which routinely escape legacy signature-based anti-virus tools. ProSight Active Security Monitoring protects on-premises and cloud-based resources and offers a single platform to automate the entire threat progression including protection, infiltration detection, containment, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows VSS and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection services deliver economical multi-layer security for physical servers and virtual machines, desktops, smartphones, and Exchange email. ProSight ESP uses adaptive security and advanced heuristics for round-the-clock monitoring and responding to cyber threats from all vectors. ProSight ESP offers two-way firewall protection, penetration alerts, endpoint control, and web filtering through cutting-edge technologies packaged within one agent accessible from a unified console. Progent's data protection and virtualization experts can assist you to plan and configure a ProSight ESP environment that addresses your organization's unique requirements and that allows you achieve and demonstrate compliance with legal and industry information protection regulations. Progent will assist you define and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that call for urgent action. Progent's consultants can also help your company to set up and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange filtering.