Ransomware Defense and Remediation Solutions

Ransomware Hot Line: 800-462-8800

24x7 Remote Access to a Top-tier Ransomware Engineer
Ransomware requires time to work its way through a network. Because of this, ransomware attacks are commonly launched on weekends and late at night, when support personnel may be slower to recognize a breach and are least able to mount a rapid and forceful response. The more lateral movement ransomware can make within a target's network, the more time it will require to restore basic operations and damaged files and the more data can be stolen and posted to the dark web.

Progent's Ransomware Hot Line is intended to guide you to complete the urgent first steps in responding to a ransomware attack by putting out the fire. Progent's online ransomware experts can assist businesses to locate and quarantine breached servers and endpoints and guard clean assets from being penetrated.

If your system has been penetrated by any strain of ransomware, don't panic. Get help quickly by calling Progent's 24-hour Ransomware Hot Line at 800-462-8800.

Progent's Ransomware Recovery Services
Modern strains of crypto-ransomware like Ryuk, Maze, Sodinokibi and Netwalker encrypt online data and infiltrate any accessible system restores and backups. Data synched to the cloud can also be corrupted. In a vulnerable environment, this can make automated recovery impossible and effectively knocks the datacenter back to square one. Threat actors (TAs), the cybercriminals behind a ransomware attack, demand a ransom payment for the decryptors needed to recover scrambled data. Ransomware attacks also try to exfiltrate information and TAs demand an additional ransom in exchange for not posting this data on the dark web. Even if you can rollback your system to an acceptable date in time, exfiltration can be a major issue depending on the sensitivity of the stolen data.

The recovery process after a ransomware breach involves several distinct stages, most of which can proceed in parallel if the recovery team has enough people with the necessary skill sets.

• Containment: This time-critical first step involves arresting the lateral spread of ransomware across your network. The longer a ransomware attack is allowed to run unchecked, the longer and more expensive the recovery process. Recognizing this, Progent maintains a 24x7 Ransomware Hotline staffed by seasoned ransomware recovery engineers. Containment activities include quarantining affected endpoint devices from the network to minimize the spread, documenting the environment, and securing entry points.
• Operational continuity: This involves restoring the network to a minimal acceptable level of functionality with the shortest possible delay. This process is typically the top priority of the victims of the ransomware attack, who often perceive it to be an existential issue. This activity also requires the broadest range of technical skills that cover domain controllers, DHCP servers, physical and virtual servers and endpoints, databases, productivity and line-of-business applications, network architecture, and secure endpoint access. Progent's recovery team uses state-of-the-art project management and collaboration tools to coordinate the complex recovery process. Progent understands the importance of working quickly, tirelessly, and in unison with a customer's management and IT staff to prioritize tasks and to put essential services back on line as fast as possible.
• Data recovery: The effort required to restore data damaged by a ransomware attack depends on the state of the systems, how many files are encrypted, and what methods of recovery are required. Ransomware attacks can destroy critical databases which, if not gracefully shut down, may have to be rebuilt from scratch. This can include DNS and Active Directory (AD) databases. Exchange and SQL Server depend on AD, and many ERP and other business-critical applications depend on SQL Server. Some detective work may be needed to find clean data. For example, non-encrypted OST files (Outlook Email Offline Folder Files) may exist on staff desktop computers and laptops that were not connected during the attack.
• Setting up modern antivirus/ransomware protection: Progent's Active Security Monitoring is a 24x7 service that incorporates AV/ransomware protection technology used by many of the world's largest corporations including Netflix, Visa, and NASDAQ to provide real-time malware filtering, detection, mitigation, rollback recovery and root-cause forensic analysis in one integrated platform.
• Negotiation with the Threat Actor: Progent has experience negotiating ransom settlements with attackers. This requires close co-operation with the victim and the cyber insurance carrier. Activities include determining the type of ransomware used in the attack; identifying and establishing contact with the hacker; verifying decryption capabilities; budgeting a settlement with the victim and insurance carrier; negotiating a settlement and timeline with the TA; confirming compliance with anti-money laundering regulations; handling the crypto-currency payment to the TA; acquiring, learning, and using the decryption tool; debugging failed files; creating a clean environment; and restoring machines and services.
• Forensics: Forensics can be time consuming, requiring the review of all logs, registry, Group Policy Object (GPO), Active Directory, DNS, routers, firewalls, scheduled tasks, and core Windows systems to check for variations. Progent makes sure that containment, operational continuity, settlement negotiation, and data recovery activity can be carried on without interfering with forensics or being delayed by forensics.

Download Datasheet: Progent's Ransomware Endpoint Detection and Response Services
To read or download a PDF datasheet describing Progent's ransomware endpoint detection and response (EDR) services, click:
Progent's Progent's Ransomware Endpoint Detection and Response Services Datasheet. (PDF - 748 KB)

Contact Progent for Ransomware Recovery Solutions
For ransomware recovery expertise, call Progent at 800-993-9400 or go to Contact Progent.

Ransomware 24x7 Hot Line: Call 800-462-8800
Progent's Ransomware 24x7 Hot Line is designed to assist organizations to complete the urgent first steps in mitigating a ransomware attack by putting out the fire. Progent's remote ransomware expert can help businesses to locate and isolate breached servers and endpoints and guard clean assets from being compromised. If your system has been penetrated by any version of ransomware, don't panic. Get immediate help by calling Progent's Ransomware Hot Line at 800-462-8800. For details, see Progent's Ransomware 24x7 Hot Line.