24/7/365 Brighton Urgent Crypto-Ransomware
Computer Malware Assessment and Removal Support

Ransomware : Your Feared Information Technology Disaster
Crypto-Ransomware has become a too-frequent cyberplague that represents an enterprise-level threat for businesses of all sizes unprepared for an attack. Multiple generations of crypto-ransomware like the Reveton, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for a long time and still inflict harm. Recent strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, as well as frequent as yet unnamed viruses, not only do encryption of online files but also infect any configured system restores and backups. Data synchronized to cloud environments can also be corrupted. In a poorly designed data protection solution, this can make automated restore operations useless and basically sets the datacenter back to zero.

Getting back online applications and data following a ransomware outage becomes a race against time as the victim fights to contain the damage, remove the ransomware, and restore enterprise-critical activity. Due to the fact that ransomware needs time to spread, assaults are often sprung at night, when attacks typically take longer to detect. This multiplies the difficulty of quickly mobilizing and organizing a qualified mitigation team.

Progent offers a range of support services for protecting businesses from ransomware penetrations. Among these are team education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of modern security appliances with artificial intelligence technology from SentinelOne to identify and suppress zero-day threats quickly. Progent in addition provides the assistance of experienced ransomware recovery consultants with the track record and perseverance to restore a compromised environment as soon as possible.

Progent's Ransomware Restoration Services
Subsequent to a crypto-ransomware penetration, paying the ransom in cryptocurrency does not guarantee that cyber criminals will return the codes to decipher all your data. Kaspersky Labs determined that seventeen percent of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The alternative is to piece back together the vital elements of your IT environment. Without the availability of complete data backups, this requires a broad complement of skill sets, professional project management, and the capability to work 24x7 until the task is over.

For two decades, Progent has made available certified expert IT services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned advanced industry certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of experience provides Progent the capability to efficiently identify critical systems and re-organize the remaining parts of your Information Technology environment following a ransomware event and configure them into a functioning system.

Progent's recovery team of experts utilizes state-of-the-art project management tools to coordinate the complex recovery process. Progent appreciates the urgency of acting swiftly and in unison with a client's management and IT team members to prioritize tasks and to put critical systems back online as soon as possible.

Client Case Study: A Successful Crypto-Ransomware Penetration Response
A business engaged Progent after their organization was attacked by the Ryuk ransomware. Ryuk is generally considered to have been developed by Northern Korean state hackers, suspected of using technology leaked from America's NSA organization. Ryuk seeks specific businesses with little room for operational disruption and is one of the most profitable iterations of ransomware viruses. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing business based in Chicago and has around 500 employees. The Ryuk penetration had paralyzed all essential operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the time of the intrusion and were destroyed. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for the best, but in the end reached out to Progent.

Progent worked together with the client to rapidly get our arms around and prioritize the key systems that needed to be recovered to make it possible to continue company functions:

• Active Directory (AD)
• Email
• Financials/MRP

In less than 2 days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then performed setup and storage recovery of critical servers. All Microsoft Exchange Server schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Microsoft Outlook Offline Data Files) on various PCs in order to recover mail information. A not too old off-line backup of the customer's accounting software made it possible to restore these essential programs back on-line. Although a lot of work remained to recover fully from the Ryuk attack, critical services were recovered quickly:

During the following couple of weeks important milestones in the recovery process were completed in close cooperation between Progent consultants and the client:

• In-house web applications were brought back up with no loss of data.
• The MailStore Server exceeding four million historical emails was spun up and accessible to users.
• CRM/Customer Orders/Invoicing/AP/AR/Inventory Control modules were completely recovered.
• A new Palo Alto 850 firewall was brought online.
• Ninety percent of the user desktops and notebooks were back into operation.

Conclusion
A probable business extinction catastrophe was evaded due to top-tier professionals, a broad range of subject matter expertise, and tight collaboration. Although in retrospect the ransomware virus incident described here should have been prevented with up-to-date cyber security technology and NIST Cybersecurity Framework best practices, staff training, and well designed incident response procedures for information protection and applying software patches, the fact remains that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware penetration, remember that Progent's roster of experts has substantial experience in crypto-ransomware virus defense, remediation, and information systems restoration.

To read or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Brighton a variety of remote monitoring and security assessment services to assist you to reduce the threat from ransomware. These services include modern AI capability to uncover zero-day strains of crypto-ransomware that can escape detection by legacy signature-based security solutions.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management technology to keep your IT system operating at peak levels by checking the state of vital computers that drive your business network. When ProSight LAN Watch detects an issue, an alarm is sent immediately to your designated IT personnel and your assigned Progent consultant so any potential issues can be resolved before they have a chance to disrupt productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for managing your client-server infrastructure by providing tools for performing common time-consuming tasks. These can include health monitoring, update management, automated remediation, endpoint configuration, backup and recovery, anti-virus defense, remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and debugging help. If ProSight LAN Watch with NinjaOne RMM spots a serious problem, it transmits an alarm to your specified IT personnel and your Progent technical consultant so potential problems can be taken care of before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for small and mid-sized organizations to map, monitor, enhance and debug their connectivity hardware like routers, firewalls, and access points plus servers, printers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that infrastructure topology maps are always current, captures and displays the configuration of virtually all devices connected to your network, tracks performance, and generates notices when issues are detected. By automating tedious management processes, ProSight WAN Watch can knock hours off ordinary chores like network mapping, expanding your network, finding devices that need important software patches, or identifying the cause of performance issues. Find out more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time and in-depth management reporting tools created to integrate with the top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues like inconsistent support follow-up or machines with missing patches. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with leading backup technology companies to create ProSight Data Protection Services, a family of subscription-based offerings that provide backup-as-a-service. ProSight DPS services automate and monitor your data backup operations and allow non-disruptive backup and fast recovery of critical files, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps you protect against data loss resulting from equipment failures, natural disasters, fire, malware such as ransomware, user mistakes, malicious employees, or application glitches. Managed backup services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to identify which of these fully managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the technology of leading information security companies to deliver centralized control and world-class protection for your inbound and outbound email. The hybrid architecture of Progent's Email Guard integrates cloud-based filtering with an on-premises security gateway appliance to provide advanced protection against spam, viruses, Denial of Service Attacks, DHAs, and other email-based malware. The cloud filter acts as a first line of defense and keeps the vast majority of threats from reaching your network firewall. This decreases your vulnerability to inbound threats and saves network bandwidth and storage. Email Guard's on-premises gateway device provides a further layer of analysis for inbound email. For outgoing email, the onsite security gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local gateway can also assist Exchange Server to track and protect internal email that originates and ends within your security perimeter. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication service plans incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication (2FA). Duo enables single-tap identity confirmation with Apple iOS, Android, and other out-of-band devices. Using 2FA, whenever you sign into a protected online account and enter your password you are requested to verify your identity on a device that only you possess and that is accessed using a separate network channel. A wide range of out-of-band devices can be utilized as this second means of authentication such as a smartphone or wearable, a hardware/software token, a landline phone, etc. You may designate multiple validation devices. To learn more about ProSight Duo two-factor identity validation services, go to Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Call Desk: Help Desk Managed Services
  Progent's Call Center services permit your information technology team to offload Call Center services to Progent or split activity for support services seamlessly between your internal support group and Progent's nationwide roster of IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a transparent supplement to your core support group. User access to the Service Desk, provision of support, issue escalation, ticket creation and tracking, performance metrics, and maintenance of the support database are consistent whether issues are taken care of by your core support group, by Progent, or by a combination. Find out more about Progent's outsourced/co-managed Help Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior analysis technology to defend endpoint devices and physical and virtual servers against new malware assaults like ransomware and file-less exploits, which easily get by traditional signature-matching AV products. Progent Active Security Monitoring services protect local and cloud resources and offers a single platform to automate the complete threat lifecycle including blocking, identification, mitigation, cleanup, and post-attack forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against new threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, update, retrieve and protect data about your IT infrastructure, processes, applications, and services. You can instantly find passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates or domains. By cleaning up and organizing your IT infrastructure documentation, you can save as much as half of time wasted searching for vital information about your network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents related to managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT data. Whether you're making improvements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need when you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide organizations of any size a versatile and affordable alternative for assessing, testing, scheduling, implementing, and tracking updates to your dynamic information system. Besides optimizing the protection and functionality of your computer environment, Progent's patch management services allow your IT team to concentrate on more strategic projects and tasks that derive the highest business value from your network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host configured and managed by Progent's IT support professionals. With Progent's ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the applications. Since the system is virtualized, it can be ported easily to a different hardware environment without a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that utilizes SentinelOne's next generation behavior machine learning tools to defend physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which routinely evade traditional signature-based anti-virus tools. ProSight ASM protects local and cloud resources and provides a single platform to manage the entire threat progression including protection, detection, containment, remediation, and post-attack forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer affordable in-depth security for physical servers and VMs, workstations, smartphones, and Exchange email. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and responding to cyber threats from all attack vectors. ProSight ESP offers two-way firewall protection, penetration alarms, endpoint control, and web filtering via leading-edge tools incorporated within one agent managed from a single console. Progent's data protection and virtualization consultants can help your business to plan and implement a ProSight ESP deployment that addresses your organization's unique requirements and that helps you prove compliance with government and industry data protection regulations. Progent will assist you define and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that require immediate action. Progent's consultants can also help your company to set up and test a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange filtering.