Hialeah 24-7 Immediate Crypto-Ransomware
Malware Identification and Removal Consultants

Ransomware : Your Worst Information Technology Disaster
Ransomware has become a modern cyberplague that presents an extinction-level danger for organizations vulnerable to an attack. Different iterations of ransomware like the Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and continue to cause damage. Recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, along with daily as yet unnamed malware, not only encrypt online information but also infect all accessible system backups. Data replicated to the cloud can also be corrupted. In a poorly architected data protection solution, this can render automated restore operations useless and basically knocks the datacenter back to square one.

Retrieving programs and information after a ransomware event becomes a race against the clock as the targeted organization struggles to contain, eradicate the virus, and restore business-critical operations. Due to the fact that ransomware needs time to replicate, attacks are frequently launched on weekends, when successful penetrations tend to take more time to discover. This multiplies the difficulty of rapidly assembling and coordinating a capable mitigation team.

Progent provides a range of services for securing organizations from ransomware events. These include staff education to help identify and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of next-generation security solutions with AI capabilities from SentinelOne to identify and quarantine day-zero cyber threats quickly. Progent also provides the assistance of seasoned ransomware recovery consultants with the skills and perseverance to reconstruct a breached system as rapidly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will provide the needed codes to unencrypt all your files. Kaspersky determined that seventeen percent of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to setup from scratch the essential elements of your Information Technology environment. Absent the availability of full information backups, this requires a wide range of skill sets, professional project management, and the ability to work 24x7 until the recovery project is over.

For decades, Progent has offered expert IT services for companies across the United States and has earned Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained advanced industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP applications. This breadth of expertise affords Progent the ability to rapidly determine critical systems and integrate the surviving pieces of your computer network system after a crypto-ransomware penetration and configure them into an operational system.

Progent's ransomware group uses top notch project management applications to orchestrate the complex recovery process. Progent understands the urgency of acting rapidly and together with a client's management and IT resources to assign priority to tasks and to get the most important systems back on line as fast as possible.

Client Story: A Successful Crypto-Ransomware Virus Restoration
A client engaged Progent after their organization was brought down by Ryuk ransomware. Ryuk is thought to have been created by Northern Korean state hackers, possibly using approaches exposed from America's National Security Agency. Ryuk goes after specific companies with limited room for disruption and is one of the most profitable iterations of ransomware. Major targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer based in Chicago and has around 500 workers. The Ryuk penetration had frozen all business operations and manufacturing capabilities. Most of the client's system backups had been on-line at the time of the attack and were encrypted. The client considered paying the ransom (in excess of $200,000) and hoping for the best, but in the end engaged Progent.

Progent worked together with the customer to rapidly determine and assign priority to the key services that needed to be recovered to make it possible to resume departmental functions:

• Active Directory (AD)
• Microsoft Exchange Email
• Accounting/MRP

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then initiated rebuilding and hard drive recovery of critical applications. All Microsoft Exchange Server ties and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to locate local OST data files (Outlook Email Off-Line Data Files) on team workstations to recover email information. A recent offline backup of the businesses manufacturing systems made it possible to return these vital services back online. Although major work remained to recover completely from the Ryuk attack, critical systems were recovered rapidly:

Over the next couple of weeks critical milestones in the restoration project were completed in tight collaboration between Progent team members and the customer:

• In-house web sites were restored without losing any data.
• The MailStore Microsoft Exchange Server with over four million historical messages was spun up and accessible to users.
• CRM/Orders/Invoices/AP/AR/Inventory Control capabilities were fully restored.
• A new Palo Alto 850 firewall was deployed.
• Most of the user workstations were functioning as before the incident.

Conclusion
A potential business extinction catastrophe was dodged with results-oriented experts, a broad spectrum of knowledge, and tight collaboration. Although in hindsight the ransomware virus penetration detailed here could have been prevented with current cyber security solutions and ISO/IEC 27001 best practices, team training, and well designed security procedures for backup and proper patching controls, the fact is that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and are not going away. If you do fall victim to a crypto-ransomware incident, remember that Progent's roster of professionals has a proven track record in ransomware virus defense, removal, and information systems disaster recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers companies in Hialeah a range of online monitoring and security evaluation services designed to assist you to minimize the threat from ransomware. These services include modern AI technology to uncover new variants of ransomware that can escape detection by legacy signature-based security products.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoint devices against new malware assaults like ransomware and file-less exploits, which routinely get by traditional signature-matching AV products. ProSight ASM protects local and cloud resources and provides a single platform to address the complete malware attack lifecycle including filtering, infiltration detection, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services deliver affordable multi-layer security for physical and virtual servers, desktops, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and modern behavior analysis for round-the-clock monitoring and responding to cyber threats from all vectors. ProSight ESP provides firewall protection, penetration alarms, endpoint control, and web filtering via leading-edge tools packaged within a single agent managed from a unified control. Progent's data protection and virtualization consultants can help you to plan and implement a ProSight ESP environment that addresses your organization's unique requirements and that allows you achieve and demonstrate compliance with government and industry data security regulations. Progent will assist you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that require urgent attention. Progent's consultants can also help your company to set up and test a backup and disaster recovery system like ProSight Data Protection Services so you can recover rapidly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange email filtering.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has partnered with leading backup/restore technology providers to produce ProSight Data Protection Services (DPS), a portfolio of management offerings that deliver backup-as-a-service. ProSight DPS products automate and track your backup operations and allow non-disruptive backup and fast restoration of important files/folders, applications, images, plus virtual machines. ProSight DPS lets you avoid data loss caused by equipment failures, natural disasters, fire, malware like ransomware, user error, malicious insiders, or application bugs. Managed backup services available in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading information security vendors to provide centralized control and comprehensive protection for your email traffic. The hybrid architecture of Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway appliance to provide complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The Cloud Protection Layer serves as a preliminary barricade and keeps most unwanted email from reaching your network firewall. This reduces your vulnerability to external attacks and saves network bandwidth and storage. Email Guard's onsite gateway device provides a further level of inspection for inbound email. For outbound email, the on-premises security gateway provides AV and anti-spam protection, DLP, and email encryption. The local gateway can also assist Microsoft Exchange Server to track and protect internal email that stays inside your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for smaller businesses to map out, track, optimize and debug their networking appliances like routers, firewalls, and access points as well as servers, client computers and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology diagrams are kept updated, copies and manages the configuration information of almost all devices connected to your network, tracks performance, and sends notices when potential issues are detected. By automating time-consuming management processes, WAN Watch can cut hours off ordinary tasks like making network diagrams, expanding your network, finding appliances that need critical updates, or isolating performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management consulting.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management techniques to help keep your IT system running at peak levels by checking the state of vital assets that power your information system. When ProSight LAN Watch detects an issue, an alarm is sent immediately to your designated IT management staff and your Progent engineering consultant so all potential issues can be addressed before they can disrupt productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual machine host configured and managed by Progent's IT support professionals. With the ProSight Virtual Hosting model, the customer owns the data, the operating system platforms, and the apps. Since the environment is virtualized, it can be moved easily to a different hardware solution without a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, update, find and protect information related to your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or IP addresses and be alerted about impending expirations of SSLs or warranties. By updating and organizing your IT infrastructure documentation, you can save up to half of time spent trying to find critical information about your network. ProSight IT Asset Management features a centralized repository for storing and collaborating on all documents required for managing your network infrastructure like recommended procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and relating IT data. Whether you're making improvements, performing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the knowledge you need as soon as you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that utilizes cutting edge behavior machine learning tools to guard endpoint devices and servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily get by traditional signature-based anti-virus tools. Progent ASM services safeguard on-premises and cloud-based resources and provides a unified platform to address the complete malware attack progression including filtering, detection, containment, cleanup, and post-attack forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Find out more about Progent's ransomware protection and recovery services.

• Progent's Outsourced/Shared Service Desk: Support Desk Managed Services
  Progent's Call Desk managed services allow your IT group to offload Support Desk services to Progent or split activity for support services seamlessly between your in-house network support resources and Progent's extensive pool of certified IT service technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a smooth extension of your core support staff. Client access to the Help Desk, provision of support, problem escalation, trouble ticket generation and updates, efficiency measurement, and maintenance of the support database are consistent whether incidents are taken care of by your core network support group, by Progent, or by a combination. Read more about Progent's outsourced/shared Call Desk services.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide organizations of all sizes a versatile and affordable solution for evaluating, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving information network. In addition to optimizing the protection and functionality of your computer environment, Progent's patch management services allow your in-house IT team to focus on line-of-business initiatives and tasks that deliver the highest business value from your network. Learn more about Progent's patch management services.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA services utilize Cisco's Duo technology to defend against password theft through the use of two-factor authentication (2FA). Duo enables one-tap identity verification with Apple iOS, Android, and other personal devices. With 2FA, when you log into a secured application and enter your password you are requested to confirm who you are via a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A broad range of devices can be utilized as this added means of ID validation including an iPhone or Android or watch, a hardware token, a landline telephone, etc. You can register multiple verification devices. For details about Duo identity authentication services, go to Duo MFA two-factor authentication services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of real-time reporting tools created to work with the industry's leading ticketing and remote network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-up or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.