Austin 24/7 Immediate Ransomware
Infection Damage Assessment and Removal Support

Crypto-Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a modern cyber pandemic that represents an enterprise-level threat for organizations vulnerable to an assault. Different iterations of ransomware such as CryptoLocker, Fusob, Locky, NotPetya and MongoLock cryptoworms have been running rampant for many years and still inflict destruction. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with frequent as yet unnamed malware, not only do encryption of online critical data but also infect any configured system backup. Files synchronized to the cloud can also be held hostage. In a poorly designed environment, it can render automated restore operations useless and effectively knocks the entire system back to zero.

Getting back on-line services and information following a ransomware event becomes a sprint against time as the victim struggles to stop lateral movement, eradicate the virus, and restore enterprise-critical activity. Since crypto-ransomware requires time to move laterally, attacks are usually sprung at night, when attacks may take more time to notice. This multiplies the difficulty of promptly mobilizing and organizing a qualified response team.

Progent has a variety of solutions for securing businesses from ransomware attacks. Among these are staff training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to installation of next-generation security appliances with machine learning capabilities from SentinelOne to identify and disable day-zero cyber threats quickly. Progent also provides the services of experienced crypto-ransomware recovery consultants with the track record and perseverance to reconstruct a compromised system as soon as possible.

Progent's Ransomware Recovery Services
Soon after a ransomware attack, paying the ransom in cryptocurrency does not ensure that cyber hackers will return the codes to unencrypt any of your files. Kaspersky estimated that seventeen percent of ransomware victims never recovered their files after having paid the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to setup from scratch the critical parts of your Information Technology environment. Without the availability of complete information backups, this requires a broad complement of IT skills, top notch project management, and the ability to work non-stop until the task is complete.

For twenty years, Progent has offered expert Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded high-level certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial systems and ERP application software. This breadth of expertise affords Progent the capability to knowledgably ascertain critical systems and consolidate the remaining parts of your network system after a crypto-ransomware event and rebuild them into an operational network.

Progent's ransomware team of experts utilizes top notch project management tools to orchestrate the complex recovery process. Progent understands the urgency of acting rapidly and together with a customer's management and IT team members to assign priority to tasks and to get essential applications back on line as fast as possible.

Customer Case Study: A Successful Crypto-Ransomware Attack Recovery
A small business contacted Progent after their company was brought down by the Ryuk ransomware. Ryuk is thought to have been created by North Korean government sponsored hackers, suspected of adopting techniques leaked from the U.S. NSA organization. Ryuk seeks specific companies with little or no room for disruption and is one of the most lucrative examples of ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company located in Chicago and has around 500 employees. The Ryuk event had brought down all business operations and manufacturing processes. Most of the client's information backups had been on-line at the start of the intrusion and were eventually encrypted. The client was pursuing financing for paying the ransom (exceeding $200K) and wishfully thinking for good luck, but ultimately made the decision to use Progent.

Progent worked together with the customer to quickly understand and prioritize the critical elements that needed to be addressed in order to resume company operations:

• Active Directory (AD)
• E-Mail
• MRP System

Within 2 days, Progent was able to recover Active Directory services to its pre-attack state. Progent then assisted with rebuilding and hard drive recovery of needed systems. All Exchange Server data and attributes were intact, which facilitated the restore of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Off-Line Folder Files) on user desktop computers and laptops in order to recover mail information. A recent offline backup of the businesses manufacturing software made them able to restore these vital programs back on-line. Although a large amount of work still had to be done to recover completely from the Ryuk damage, core services were restored rapidly:

Throughout the next few weeks key milestones in the restoration process were achieved through close cooperation between Progent engineers and the customer:

• Self-hosted web applications were restored without losing any data.
• The MailStore Exchange Server containing more than 4 million historical emails was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory Control modules were 100 percent recovered.
• A new Palo Alto 850 firewall was brought online.
• 90% of the user desktops were functioning as before the incident.

Conclusion
A probable business extinction disaster was avoided with hard-working experts, a broad range of knowledge, and tight collaboration. Although in hindsight the ransomware virus penetration described here could have been stopped with modern cyber security technology solutions and recognized best practices, user and IT administrator education, and well thought out incident response procedures for information backup and keeping systems up to date with security patches, the reality is that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has extensive experience in ransomware virus defense, cleanup, and file recovery.

To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide companies in Austin a variety of online monitoring and security evaluation services to assist you to minimize your vulnerability to ransomware. These services utilize next-generation artificial intelligence capability to uncover zero-day variants of ransomware that are able to evade legacy signature-based anti-virus solutions.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's next generation behavior-based analysis technology to guard physical and virtual endpoints against modern malware assaults like ransomware and file-less exploits, which routinely get by legacy signature-matching AV products. ProSight ASM protects local and cloud-based resources and provides a unified platform to address the complete malware attack lifecycle including protection, identification, containment, cleanup, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection managed services offer affordable in-depth security for physical servers and VMs, workstations, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and responding to security assaults from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, device control, and web filtering through cutting-edge tools incorporated within one agent managed from a unified control. Progent's security and virtualization consultants can help you to plan and configure a ProSight ESP deployment that addresses your organization's specific needs and that allows you prove compliance with legal and industry information security regulations. Progent will help you define and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require immediate action. Progent can also assist you to set up and test a backup and restore system such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with advanced backup software companies to create ProSight Data Protection Services, a family of subscription-based management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS products automate and monitor your data backup operations and allow transparent backup and fast recovery of important files/folders, apps, images, plus VMs. ProSight DPS helps your business protect against data loss caused by hardware breakdown, natural disasters, fire, malware such as ransomware, user mistakes, ill-intentioned insiders, or software glitches. Managed backup services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to identify which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top data security vendors to deliver web-based management and world-class security for your email traffic. The hybrid structure of Email Guard managed service combines cloud-based filtering with a local security gateway appliance to offer advanced protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The cloud filter serves as a preliminary barricade and keeps the vast majority of unwanted email from reaching your network firewall. This decreases your exposure to external attacks and saves system bandwidth and storage space. Email Guard's on-premises security gateway device adds a further level of analysis for inbound email. For outgoing email, the onsite gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also assist Exchange Server to track and protect internal email traffic that stays within your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for small and mid-sized organizations to diagram, monitor, enhance and debug their networking appliances such as switches, firewalls, and access points as well as servers, client computers and other networked devices. Incorporating cutting-edge RMM technology, WAN Watch ensures that network diagrams are always updated, captures and displays the configuration information of almost all devices on your network, monitors performance, and generates alerts when potential issues are discovered. By automating complex management and troubleshooting processes, ProSight WAN Watch can cut hours off common chores like network mapping, reconfiguring your network, locating appliances that need important software patches, or identifying the cause of performance problems. Find out more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) technology to keep your IT system running efficiently by tracking the health of critical computers that power your business network. When ProSight LAN Watch uncovers an issue, an alarm is sent automatically to your specified IT management personnel and your assigned Progent engineering consultant so any looming issues can be addressed before they can disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual host configured and managed by Progent's IT support experts. With the ProSight Virtual Hosting service model, the client owns the data, the operating system platforms, and the applications. Because the system is virtualized, it can be moved immediately to a different hosting environment without requiring a time-consuming and difficult configuration process. With ProSight Virtual Hosting, you are not tied a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and safeguard data about your network infrastructure, processes, business apps, and services. You can quickly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSLs or warranties. By updating and organizing your IT infrastructure documentation, you can eliminate up to half of time thrown away searching for critical information about your network. ProSight IT Asset Management features a common repository for holding and collaborating on all documents required for managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT information. Whether you're making enhancements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you need when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that utilizes next generation behavior-based machine learning tools to guard endpoint devices and physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which easily escape traditional signature-matching AV products. Progent Active Security Monitoring services protect local and cloud-based resources and provides a unified platform to manage the complete threat progression including protection, detection, containment, remediation, and forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and cleanup services.

• Progent's Outsourced/Shared Service Center: Support Desk Managed Services
  Progent's Help Center services enable your IT team to offload Help Desk services to Progent or divide activity for Service Desk support seamlessly between your internal support staff and Progent's extensive pool of IT support technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a transparent supplement to your internal IT support resources. Client interaction with the Service Desk, provision of support, escalation, trouble ticket creation and updates, efficiency metrics, and maintenance of the service database are cohesive regardless of whether incidents are taken care of by your core network support staff, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Service Center services.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and affordable alternative for assessing, testing, scheduling, applying, and documenting software and firmware updates to your dynamic information network. Besides optimizing the security and functionality of your computer network, Progent's patch management services allow your IT team to concentrate on more strategic initiatives and activities that derive maximum business value from your information network. Learn more about Progent's patch management services.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo MFA services utilize Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo supports single-tap identity confirmation on iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a secured online account and give your password you are asked to confirm who you are on a device that only you have and that uses a separate network channel. A broad range of out-of-band devices can be utilized as this added form of authentication such as a smartphone or watch, a hardware token, a landline phone, etc. You may register several verification devices. To learn more about ProSight Duo two-factor identity authentication services, visit Duo MFA two-factor authentication (2FA) services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of real-time and in-depth reporting plug-ins designed to work with the leading ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as inconsistent support follow-through or machines with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.