Charlotte 24/7/365 Urgent Ransomware
Computer Virus Assessment and Repair Experts

Ransomware : Your Worst Information Technology Disaster
Ransomware has become a too-frequent cyber pandemic that presents an extinction-level danger for businesses of all sizes vulnerable to an assault. Multiple generations of crypto-ransomware such as Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been circulating for many years and still inflict havoc. Recent versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Egregor, as well as daily as yet unnamed newcomers, not only encrypt on-line data but also infiltrate many configured system backup. Information replicated to the cloud can also be corrupted. In a poorly designed data protection solution, this can render any restore operations useless and effectively knocks the datacenter back to zero.

Getting back services and data after a ransomware event becomes a race against time as the targeted organization struggles to contain, remove the ransomware, and restore mission-critical operations. Due to the fact that ransomware requires time to replicate, attacks are frequently launched at night, when successful penetrations in many cases take more time to identify. This compounds the difficulty of promptly mobilizing and coordinating a knowledgeable mitigation team.

Progent offers a range of support services for protecting enterprises from ransomware events. Among these are team education to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of modern security solutions with AI capabilities from SentinelOne to identify and extinguish zero-day cyber attacks automatically. Progent also offers the assistance of seasoned ransomware recovery professionals with the track record and commitment to re-deploy a breached environment as quickly as possible.

Progent's Ransomware Recovery Support Services
Soon after a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will respond with the codes to decrypt any or all of your data. Kaspersky estimated that 17% of ransomware victims never recovered their information after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The fallback is to re-install the mission-critical elements of your IT environment. Without the availability of full system backups, this requires a wide range of IT skills, professional team management, and the ability to work 24x7 until the recovery project is complete.

For twenty years, Progent has offered certified expert Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have earned top certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in financial management and ERP application software. This breadth of experience gives Progent the ability to quickly understand necessary systems and organize the remaining pieces of your computer network system following a ransomware penetration and assemble them into a functioning system.

Progent's recovery team utilizes best of breed project management applications to coordinate the sophisticated restoration process. Progent understands the urgency of acting rapidly and in unison with a customer's management and Information Technology team members to assign priority to tasks and to put critical systems back on line as soon as humanly possible.

Business Case Study: A Successful Ransomware Penetration Recovery
A small business hired Progent after their organization was brought down by the Ryuk crypto-ransomware. Ryuk is thought to have been launched by Northern Korean state criminal gangs, possibly using approaches leaked from America's NSA organization. Ryuk attacks specific organizations with little or no tolerance for operational disruption and is among the most lucrative incarnations of ransomware viruses. Headline victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing company headquartered in the Chicago metro area and has around 500 staff members. The Ryuk event had shut down all essential operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the beginning of the attack and were damaged. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but in the end called Progent.

Progent worked with the client to rapidly get our arms around and assign priority to the mission critical elements that needed to be addressed in order to continue business operations:

• Active Directory
• Electronic Mail
• MRP System

In less than 2 days, Progent was able to restore Active Directory services to its pre-attack state. Progent then accomplished reinstallations and hard drive recovery on mission critical systems. All Microsoft Exchange Server schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was also able to collect local OST data files (Outlook Off-Line Folder Files) on staff desktop computers in order to recover mail messages. A not too old off-line backup of the client's financials/MRP software made it possible to recover these vital applications back on-line. Although major work was left to recover fully from the Ryuk damage, core systems were recovered quickly:

During the next few weeks critical milestones in the restoration process were achieved in tight cooperation between Progent consultants and the client:

• In-house web applications were returned to operation with no loss of data.
• The MailStore Exchange Server containing more than four million historical emails was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory modules were fully functional.
• A new Palo Alto 850 firewall was deployed.
• Ninety percent of the user desktops were functioning as before the incident.

Conclusion
A probable company-ending catastrophe was averted by dedicated professionals, a wide range of IT skills, and close collaboration. Although in retrospect the ransomware virus attack described here could have been identified and disabled with modern security solutions and ISO/IEC 27001 best practices, user and IT administrator training, and well designed incident response procedures for data protection and applying software patches, the reality remains that government-sponsored cybercriminals from China, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware penetration, feel confident that Progent's roster of professionals has extensive experience in ransomware virus defense, mitigation, and data restoration.

To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Charlotte a variety of online monitoring and security evaluation services to help you to reduce the threat from ransomware. These services include modern artificial intelligence technology to uncover zero-day strains of crypto-ransomware that are able to escape detection by traditional signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management techniques to help keep your IT system operating at peak levels by checking the state of critical assets that power your business network. When ProSight LAN Watch uncovers a problem, an alert is transmitted immediately to your designated IT personnel and your assigned Progent engineering consultant so any looming problems can be addressed before they can impact your network. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for managing your network, server, and desktop devices by offering tools for streamlining common time-consuming tasks. These can include health monitoring, update management, automated remediation, endpoint setup, backup and restore, anti-virus defense, remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alert to your specified IT staff and your Progent consultant so emerging issues can be fixed before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized organizations to diagram, monitor, reconfigure and troubleshoot their networking appliances such as switches, firewalls, and access points plus servers, printers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch ensures that infrastructure topology diagrams are kept updated, copies and manages the configuration of almost all devices connected to your network, monitors performance, and sends notices when issues are discovered. By automating tedious management activities, ProSight WAN Watch can knock hours off common tasks such as making network diagrams, expanding your network, finding devices that need critical updates, or isolating performance issues. Find out more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of in-depth reporting tools designed to integrate with the top ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as inconsistent support follow-up or machines with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with leading backup technology providers to create ProSight Data Protection Services (DPS), a family of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS products manage and track your data backup operations and allow non-disruptive backup and rapid restoration of vital files, applications, system images, plus VMs. ProSight DPS lets your business avoid data loss resulting from equipment breakdown, natural calamities, fire, cyber attacks such as ransomware, human error, ill-intentioned insiders, or software glitches. Managed backup services in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of top data security companies to provide centralized control and world-class protection for your email traffic. The hybrid architecture of Email Guard combines a Cloud Protection Layer with an on-premises security gateway appliance to provide complete protection against spam, viruses, Dos Attacks, DHAs, and other email-based threats. The cloud filter acts as a first line of defense and blocks the vast majority of unwanted email from making it to your security perimeter. This decreases your exposure to inbound threats and saves network bandwidth and storage space. Email Guard's on-premises gateway device adds a further layer of analysis for incoming email. For outbound email, the local gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The onsite gateway can also assist Microsoft Exchange Server to track and protect internal email traffic that originates and ends inside your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo MFA service plans utilize Cisco's Duo cloud technology to defend against stolen passwords by using two-factor authentication (2FA). Duo enables single-tap identity confirmation on Apple iOS, Android, and other personal devices. Using 2FA, when you sign into a secured online account and give your password you are asked to confirm who you are via a unit that only you have and that is accessed using a different ("out-of-band") network channel. A broad selection of out-of-band devices can be utilized as this second form of ID validation such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You can designate multiple validation devices. For details about ProSight Duo identity validation services, visit Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Desk: Help Desk Managed Services
  Progent's Help Center services enable your IT group to outsource Support Desk services to Progent or split responsibilities for Service Desk support transparently between your in-house support group and Progent's nationwide roster of certified IT support technicians, engineers and subject matter experts. Progent's Co-managed Service Desk offers a seamless supplement to your corporate IT support staff. User access to the Help Desk, provision of support services, escalation, trouble ticket generation and updates, performance metrics, and maintenance of the service database are cohesive whether issues are resolved by your core support staff, by Progent, or by a combination. Find out more about Progent's outsourced/co-managed Service Desk services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior analysis tools to defend endpoint devices as well as servers and VMs against new malware attacks like ransomware and email phishing, which easily evade legacy signature-matching AV tools. Progent ASM services safeguard on-premises and cloud-based resources and offers a unified platform to address the complete threat progression including blocking, infiltration detection, mitigation, cleanup, and forensics. Key capabilities include one-click rollback using Windows VSS and real-time network-wide immunization against newly discovered attacks. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, find and safeguard data related to your network infrastructure, procedures, business apps, and services. You can instantly find passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates or domains. By cleaning up and managing your IT infrastructure documentation, you can save as much as 50% of time wasted trying to find critical information about your network. ProSight IT Asset Management features a common repository for holding and sharing all documents related to managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT information. Whether you're making enhancements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management gets you the data you need as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a versatile and affordable alternative for assessing, testing, scheduling, applying, and tracking updates to your dynamic information network. In addition to maximizing the security and reliability of your computer network, Progent's software/firmware update management services free up time for your in-house IT staff to focus on more strategic initiatives and activities that deliver maximum business value from your information network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the customer owns the data, the operating system software, and the apps. Because the environment is virtualized, it can be moved immediately to an alternate hardware environment without a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not tied one hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's cutting edge behavior-based machine learning technology to guard physical and virtual endpoint devices against modern malware assaults like ransomware and file-less exploits, which easily escape legacy signature-based anti-virus tools. ProSight ASM safeguards on-premises and cloud-based resources and offers a single platform to address the entire threat progression including protection, infiltration detection, mitigation, remediation, and post-attack forensics. Top capabilities include one-click rollback with Windows VSS and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable multi-layer security for physical and virtual servers, desktops, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to security assaults from all vectors. ProSight ESP delivers firewall protection, intrusion alerts, endpoint management, and web filtering via cutting-edge tools packaged within a single agent managed from a single console. Progent's security and virtualization experts can help you to design and configure a ProSight ESP environment that meets your organization's unique requirements and that allows you demonstrate compliance with legal and industry data protection regulations. Progent will help you specify and implement security policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require urgent attention. Progent's consultants can also assist your company to install and test a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can recover quickly from a destructive cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Exchange email filtering.