Ransomware Filtering and Removal Expertise

Ransomware Hot Line: 800-462-8800

24x7 Remote Help from a Top-tier Ransomware Consultant
Ransomware requires time to steal its way through a target network. Because of this, ransomware attacks are typically unleashed on weekends and at night, when IT personnel may be slower to recognize a break-in and are least able to organize a quick and forceful defense. The more lateral movement ransomware is able to achieve inside a victim's network, the more time it takes to recover core IT services and damaged files and the more information can be exfiltrated to the dark web.

Progent's Ransomware Hot Line is designed to guide you to complete the urgent first step in responding to a ransomware attack by containing the malware. Progent's online ransomware experts can assist businesses to locate and quarantine infected servers and endpoints and protect clean resources from being compromised.

If your network has been penetrated by any strain of ransomware, don't panic. Get immediate help by calling Progent's Ransomware Hot Line at 800-462-8800.

Progent's Ransomware Response Services
Current strains of ransomware such as Ryuk, Sodinokibi, Netwalker, and Egregor encrypt online files and infiltrate any available system restores and backups. Files synched to the cloud can also be corrupted. For a poorly defended network, this can make automated restoration nearly impossible and effectively throws the datacenter back to the beginning. So-called Threat Actors (TAs), the hackers behind a ransomware assault, demand a settlement fee in exchange for the decryptors needed to unlock encrypted data. Ransomware attacks also try to steal (or "exfiltrate") information and TAs demand an additional payment in exchange for not publishing this information on the dark web. Even if you are able to rollback your network to a tolerable point in time, exfiltration can pose a big problem according to the nature of the downloaded information.

The recovery process subsequent to ransomware penetration has several crucial phases, most of which can be performed in parallel if the response workgroup has a sufficient number of members with the necessary skill sets.

• Containment: This time-critical initial step involves arresting the lateral spread of the attack across your network. The more time a ransomware attack is permitted to go unchecked, the more complex and more expensive the recovery effort. Recognizing this, Progent keeps a round-the-clock Ransomware Hotline staffed by seasoned ransomware recovery experts. Quarantine activities include isolating affected endpoints from the rest of network to minimize the contagion, documenting the IT system, and protecting entry points.
• System continuity: This covers restoring the network to a basic acceptable degree of functionality with the least delay. This effort is usually at the highest level of urgency for the victims of the ransomware attack, who often see it as a life-or-death issue for their company. This activity also requires the broadest array of technical skills that cover domain controllers, DHCP servers, physical and virtual servers, desktops, laptops and smart phones, databases, office and mission-critical applications, network architecture, and safe remote access management. Progent's recovery experts use state-of-the-art workgroup tools to organize the complex restoration process. Progent understands the importance of working quickly, tirelessly, and in unison with a customer's management and network support staff to prioritize tasks and to put vital resources on line again as quickly as feasible.
• Data recovery: The effort required to recover data damaged by a ransomware assault depends on the condition of the network, how many files are affected, and what recovery methods are needed. Ransomware attacks can take down critical databases which, if not carefully shut down, may need to be reconstructed from the beginning. This can apply to DNS and AD databases. Microsoft Exchange and Microsoft SQL Server depend on AD, and many ERP and other mission-critical platforms are powered by SQL Server. Often some detective work may be needed to find clean data. For instance, undamaged OST files may exist on employees' desktop computers and notebooks that were not connected at the time of the ransomware assault.
• Setting up advanced AV/ransomware defense: Progent's Active Security Monitoring utilizes SentinelOne's behavioral analysis technology to give small and mid-sized businesses the benefits of the same anti-virus tools implemented by some of the world's largest enterprises including Netflix, Citi, and Salesforce. By delivering in-line malware blocking, identification, mitigation, repair and analysis in one integrated platform, ProSight ASM cuts total cost of ownership, simplifies administration, and expedites operational continuity. SentinelOne's next-generation endpoint protection (NGEP) built into in Progent's ProSight Active Security Monitoring was listed by Gartner Group as the industry's "most visionary Endpoint Protection Platform." Progent is a certified SentinelOne Partner. Learn about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery with SentinelOne technology.
• Negotiating a settlement with the threat actor (TA): Progent has experience negotiating ransom settlements with threat actors. This requires working closely with the ransomware victim and the insurance carrier, if any. Activities consist of establishing the type of ransomware used in the assault; identifying and making contact with the hacker; testing decryption capabilities; deciding on a settlement amount with the ransomware victim and the insurance provider; establishing a settlement amount and timeline with the hacker; checking adherence to anti-money laundering regulations; overseeing the crypto-currency payment to the TA; acquiring, learning, and operating the decryption utility; debugging decryption problems; building a clean environment; mapping and reconnecting datastores to reflect precisely their pre-attack state; and restoring physical and virtual devices and services.
• Forensics: This process involves discovering the ransomware assault's storyline across the targeted network from beginning to end. This audit trail of the way a ransomware assault progressed through the network helps your IT staff to assess the damage and brings to light shortcomings in rules or processes that need to be corrected to prevent future breaches. Forensics entails the review of all logs, registry, Group Policy Object, AD, DNS servers, routers, firewalls, scheduled tasks, and basic Windows systems to look for changes. Forensic analysis is usually assigned a high priority by the insurance carrier. Because forensics can take time, it is vital that other important activities like business resumption are performed in parallel. Progent has a large roster of information technology and security professionals with the skills required to perform the work of containment, operational continuity, and data restoration without disrupting forensics.

Download Datasheet: Progent's Ransomware Endpoint Detection and Response (EDR) Services
To read or download a datasheet describing Progent's ransomware endpoint protection and response services, click:
Progent's Progent's Ransomware Endpoint Detection and Response (EDR) Services Datasheet. (PDF - 748 KB)

Contact Progent for Ransomware System Restoration Consulting Services
For ransomware system recovery expertise, phone Progent at 800-462-8800 or see Contact Progent.