24x7x365 Pasadena Immediate Crypto
Malware Assessment and Removal Support

Ransomware : Your Crippling IT Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an extinction-level danger for organizations poorly prepared for an assault. Different iterations of ransomware such as Dharma, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for many years and still inflict havoc. Recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, as well as daily as yet unnamed newcomers, not only do encryption of online information but also infect many configured system backups. Files synched to the cloud can also be corrupted. In a vulnerable environment, it can make automatic restore operations useless and basically knocks the entire system back to square one.

Retrieving programs and information after a crypto-ransomware attack becomes a sprint against time as the targeted organization fights to contain the damage, clear the ransomware, and restore mission-critical operations. Since ransomware takes time to spread, assaults are often launched during nights and weekends, when successful penetrations typically take more time to notice. This multiplies the difficulty of quickly marshalling and organizing an experienced mitigation team.

Progent has a variety of support services for protecting organizations from ransomware events. These include staff training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of next-generation security gateways with AI technology from SentinelOne to identify and quarantine day-zero cyber threats automatically. Progent in addition can provide the services of experienced ransomware recovery consultants with the talent and commitment to rebuild a breached network as quickly as possible.

Progent's Crypto-Ransomware Restoration Services
Following a crypto-ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will respond with the keys to decipher any or all of your files. Kaspersky ascertained that 17% of crypto-ransomware victims never restored their information after having paid the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to setup from scratch the key components of your IT environment. Without access to full system backups, this calls for a wide range of IT skills, well-coordinated project management, and the ability to work continuously until the task is over.

For two decades, Progent has provided certified expert IT services for companies throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned top certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of experience affords Progent the capability to knowledgably identify important systems and re-organize the remaining pieces of your Information Technology system after a ransomware penetration and assemble them into an operational network.

Progent's recovery team utilizes best of breed project management applications to orchestrate the complicated restoration process. Progent appreciates the urgency of acting rapidly and in unison with a client's management and Information Technology team members to prioritize tasks and to put key applications back online as soon as humanly possible.

Client Story: A Successful Ransomware Virus Recovery
A customer engaged Progent after their network system was attacked by Ryuk ransomware. Ryuk is generally considered to have been developed by North Korean government sponsored cybercriminals, suspected of adopting strategies exposed from the U.S. National Security Agency. Ryuk targets specific businesses with limited room for disruption and is one of the most lucrative versions of ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing company based in the Chicago metro area with about 500 workers. The Ryuk penetration had frozen all company operations and manufacturing processes. The majority of the client's data protection had been online at the beginning of the attack and were damaged. The client was evaluating paying the ransom demand (in excess of two hundred thousand dollars) and praying for good luck, but ultimately called Progent.

Progent worked hand in hand the customer to quickly assess and prioritize the mission critical elements that needed to be addressed to make it possible to resume departmental operations:

• Active Directory
• Exchange Server
• Financials/MRP

Within two days, Progent was able to restore Active Directory to its pre-intrusion state. Progent then initiated reinstallations and storage recovery of essential applications. All Exchange ties and attributes were usable, which accelerated the restore of Exchange. Progent was also able to collect local OST data files (Microsoft Outlook Off-Line Data Files) on staff desktop computers to recover mail information. A not too old offline backup of the client's manufacturing systems made them able to restore these required programs back online for users. Although a lot of work still had to be done to recover completely from the Ryuk event, essential services were recovered quickly:

Throughout the following month critical milestones in the restoration process were achieved through close collaboration between Progent engineers and the customer:

• Internal web applications were returned to operation with no loss of information.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control modules were 100% recovered.
• A new Palo Alto 850 firewall was deployed.
• Ninety percent of the user workstations were being used by staff.

Conclusion
A likely enterprise-killing catastrophe was dodged due to top-tier professionals, a wide range of technical expertise, and tight teamwork. Although upon completion of forensics the crypto-ransomware virus attack described here should have been prevented with modern security systems and recognized best practices, user training, and well designed incident response procedures for backup and proper patching controls, the fact remains that government-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware attack, remember that Progent's roster of experts has substantial experience in crypto-ransomware virus blocking, mitigation, and file restoration.

To review or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Pasadena a variety of remote monitoring and security evaluation services designed to assist you to reduce the threat from ransomware. These services include modern AI technology to uncover new variants of crypto-ransomware that can get past traditional signature-based security solutions.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior machine learning tools to defend physical and virtual endpoints against modern malware attacks such as ransomware and email phishing, which easily evade legacy signature-matching AV products. ProSight Active Security Monitoring protects on-premises and cloud-based resources and offers a single platform to automate the complete malware attack progression including blocking, infiltration detection, containment, cleanup, and post-attack forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services offer ultra-affordable multi-layer security for physical servers and VMs, workstations, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, device control, and web filtering via leading-edge technologies incorporated within one agent accessible from a unified console. Progent's security and virtualization consultants can help your business to plan and implement a ProSight ESP environment that meets your organization's unique needs and that helps you achieve and demonstrate compliance with government and industry data security standards. Progent will assist you define and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that require immediate action. Progent can also assist your company to set up and verify a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore software providers to produce ProSight Data Protection Services (DPS), a portfolio of management offerings that provide backup-as-a-service. ProSight DPS services manage and monitor your backup operations and allow non-disruptive backup and fast recovery of vital files/folders, applications, images, plus virtual machines. ProSight DPS lets your business recover from data loss resulting from equipment failures, natural calamities, fire, malware such as ransomware, human mistakes, malicious employees, or application glitches. Managed services available in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent expert can help you to determine which of these managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading information security vendors to provide centralized control and world-class security for your email traffic. The powerful architecture of Progent's Email Guard managed service combines a Cloud Protection Layer with an on-premises security gateway appliance to provide advanced defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne malware. The Cloud Protection Layer acts as a first line of defense and blocks most threats from making it to your network firewall. This reduces your vulnerability to inbound threats and saves system bandwidth and storage space. Email Guard's onsite security gateway device adds a further layer of inspection for incoming email. For outbound email, the onsite security gateway provides anti-virus and anti-spam filtering, DLP, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to track and safeguard internal email traffic that stays within your corporate firewall. For more information, visit Email Guard spam and content filtering.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it simple and affordable for smaller organizations to diagram, monitor, enhance and troubleshoot their networking appliances such as routers, firewalls, and wireless controllers plus servers, printers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network diagrams are always current, captures and displays the configuration information of almost all devices on your network, monitors performance, and generates notices when potential issues are detected. By automating tedious management and troubleshooting processes, WAN Watch can knock hours off ordinary chores like network mapping, expanding your network, locating devices that require important updates, or resolving performance issues. Learn more details about ProSight WAN Watch infrastructure management services.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to keep your IT system running at peak levels by tracking the state of vital computers that drive your information system. When ProSight LAN Watch detects a problem, an alarm is transmitted automatically to your designated IT management personnel and your Progent consultant so that any potential issues can be resolved before they can impact productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host set up and managed by Progent's network support experts. With the ProSight Virtual Hosting model, the client retains ownership of the data, the OS platforms, and the applications. Because the environment is virtualized, it can be ported easily to an alternate hardware environment without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and safeguard information related to your IT infrastructure, procedures, applications, and services. You can quickly find passwords or serial numbers and be warned about impending expirations of SSLs or domains. By cleaning up and managing your network documentation, you can save as much as half of time spent trying to find vital information about your network. ProSight IT Asset Management includes a centralized location for storing and sharing all documents required for managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're making enhancements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that incorporates next generation behavior-based machine learning technology to defend endpoint devices as well as physical and virtual servers against new malware assaults like ransomware and email phishing, which easily get by legacy signature-matching AV tools. Progent ASM services safeguard on-premises and cloud resources and provides a unified platform to manage the entire threat progression including protection, detection, containment, remediation, and post-attack forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new threats. Find out more about Progent's ransomware defense and cleanup services.

• Progent's Outsourced/Shared Service Desk: Help Desk Managed Services
  Progent's Call Center managed services permit your IT team to outsource Help Desk services to Progent or divide activity for Help Desk services transparently between your internal support resources and Progent's nationwide roster of IT service engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a smooth supplement to your internal IT support team. End user access to the Help Desk, provision of technical assistance, issue escalation, ticket creation and updates, efficiency metrics, and maintenance of the support database are consistent regardless of whether issues are resolved by your in-house network support staff, by Progent's team, or by a combination. Read more about Progent's outsourced/shared Service Desk services.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and affordable alternative for assessing, validating, scheduling, applying, and tracking software and firmware updates to your dynamic IT system. In addition to optimizing the security and functionality of your IT network, Progent's patch management services free up time for your in-house IT team to focus on line-of-business projects and activities that deliver the highest business value from your network. Find out more about Progent's software/firmware update management support services.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication services utilize Cisco's Duo technology to defend against compromised passwords by using two-factor authentication. Duo supports single-tap identity confirmation on iOS, Android, and other out-of-band devices. Using 2FA, when you sign into a protected application and give your password you are asked to verify your identity on a device that only you have and that is accessed using a different ("out-of-band") network channel. A broad selection of devices can be utilized as this added form of ID validation including a smartphone or wearable, a hardware token, a landline phone, etc. You can register multiple validation devices. For details about Duo identity authentication services, refer to Duo MFA two-factor authentication services for access security.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time and in-depth reporting plug-ins designed to work with the industry's top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-through or machines with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.