Network Help for Small Organizations

Ransomware Hot Line: 800-462-8800

24x7 Remote Help from a Top-tier Ransomware Engineer
Ransomware needs time to steal its way across a network. For this reason, ransomware assaults are typically launched on weekends and late at night, when IT personnel are likely to be slower to become aware of a break-in and are less able to mount a rapid and forceful response. The more lateral progress ransomware is able to achieve within a victim's network, the more time it takes to restore basic operations and scrambled files and the more information can be stolen and posted to the dark web.

Progent's Ransomware Hot Line is designed to help organizations to take the time-critical first phase in mitigating a ransomware attack by stopping the bleeding. Progent's online ransomware engineers can help businesses to locate and quarantine breached servers and endpoints and guard clean resources from being penetrated.

If your system has been penetrated by any version of ransomware, act fast. Get immediate help by calling Progent's 24-hour Ransomware Hot Line at 800-462-8800.

Progent's Ransomware Recovery Expertise
Current strains of crypto-ransomware like Ryuk, Sodinokibi, DopplePaymer, and Nephilim encrypt online data and invade any accessible system restores and backups. Data synchronized to the cloud can also be corrupted. For a vulnerable network, this can make automated restoration almost impossible and basically sets the IT system back to square one. So-called Threat Actors (TAs), the hackers responsible for ransomware attack, insist on a ransom fee in exchange for the decryption tools required to unlock scrambled files. Ransomware attacks also attempt to steal (or "exfiltrate") information and TAs require an extra ransom in exchange for not posting this data or selling it. Even if you can rollback your network to an acceptable date in time, exfiltration can pose a big problem according to the sensitivity of the stolen information.

The recovery process subsequent to ransomware penetration involves a number of crucial phases, the majority of which can proceed concurrently if the recovery team has enough people with the required experience.

• Containment: This urgent initial response requires blocking the sideways spread of ransomware within your network. The more time a ransomware assault is allowed to go unchecked, the longer and more costly the restoration process. Because of this, Progent maintains a 24x7 Ransomware Hotline monitored by seasoned ransomware response engineers. Quarantine activities consist of isolating infected endpoint devices from the rest of network to minimize the spread, documenting the environment, and protecting entry points.
• System continuity: This covers restoring the network to a minimal acceptable level of functionality with the least downtime. This effort is typically the top priority for the victims of the ransomware assault, who often see it as an existential issue for their business. This activity also demands the widest array of IT skills that cover domain controllers, DHCP servers, physical and virtual machines, PCs, notebooks and mobile phones, databases, office and mission-critical apps, network architecture, and protected endpoint access management. Progent's recovery team uses advanced collaboration tools to organize the complex restoration process. Progent understands the importance of working quickly, tirelessly, and in concert with a client's managers and IT staff to prioritize tasks and to put critical resources on line again as fast as feasible.
• Data restoration: The effort necessary to restore files impacted by a ransomware attack varies according to the state of the systems, the number of files that are affected, and what restore methods are needed. Ransomware assaults can destroy key databases which, if not carefully closed, may have to be rebuilt from scratch. This can apply to DNS and Active Directory (AD) databases. Exchange and Microsoft SQL Server depend on AD, and many financial and other business-critical applications depend on Microsoft SQL Server. Some detective work could be needed to find undamaged data. For instance, non-encrypted OST files may have survived on employees' PCs and notebooks that were off line during the assault. Progent's ProSight Data Protection Services utilize Altaro VM Backup tools to defend against ransomware via Immutable Cloud Storage. This produces tamper-proof data that cannot be erased or modified by anyone including root users.
• Setting up modern AV/ransomware defense: Progent's Active Security Monitoring utilizes SentinelOne's behavioral analysis technology to give small and medium-sized businesses the advantages of the same AV technology implemented by some of the world's biggest enterprises such as Netflix, Citi, and Salesforce. By providing real-time malware blocking, classification, containment, recovery and analysis in one integrated platform, ProSight Active Security Monitoring reduces total cost of ownership, streamlines administration, and promotes rapid recovery. SentinelOne's next-generation endpoint protection engine built into in Progent's Active Security Monitoring was ranked by Gartner Group as the "most visionary Endpoint Protection Platform (EPP)." Progent is a SentinelOne Partner, dealer, and integrator. Learn about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense with SentinelOne technology.
• Negotiation with the threat actor (TA): Progent is experienced in negotiating ransom settlements with hackers. This calls for close co-operation with the ransomware victim and the insurance carrier, if there is one. Services consist of establishing the type of ransomware used in the assault; identifying and establishing communications the hacker persona; verifying decryption capabilities; budgeting a settlement with the victim and the cyber insurance provider; establishing a settlement amount and timeline with the hacker; confirming compliance with anti-money laundering sanctions; carrying out the crypto-currency transfer to the hacker; acquiring, reviewing, and operating the decryptor utility; debugging decryption problems; creating a clean environment; remapping and connecting drives to match exactly their pre-encryption condition; and recovering computers and software services.
• Forensics: This activity involves uncovering the ransomware assault's progress throughout the network from start to finish. This history of the way a ransomware assault progressed within the network assists your IT staff to assess the impact and uncovers weaknesses in policies or work habits that need to be rectified to prevent later break-ins. Forensics entails the examination of all logs, registry, Group Policy Object, Active Directory, DNS servers, routers, firewalls, scheduled tasks, and core Windows systems to detect anomalies. Forensic analysis is usually assigned a top priority by the insurance provider. Since forensics can take time, it is essential that other key recovery processes such as business continuity are executed concurrently. Progent maintains a large roster of IT and data security experts with the knowledge and experience needed to carry out activities for containment, operational continuity, and data recovery without disrupting forensics.

Download Datasheet: Progent's Ransomware Endpoint Detection and Response Services
For a PDF datasheet describing Progent's ransomware endpoint detection and response (EDR) services, click:
Progent's Progent's Ransomware Endpoint Detection and Response (EDR) Services Datasheet. (PDF - 748 KB)

Contact Progent for Ransomware System Recovery Consulting
For ransomware system recovery consulting, call Progent at 800-462-8800 or visit Contact Progent.