24-7 El Paso Immediate Crypto-Ransomware
Computer Virus Assessment and Remediation Support

Ransomware : Your Worst IT Nightmare
Ransomware has become an escalating cyberplague that presents an existential danger for businesses vulnerable to an attack. Multiple generations of ransomware like the Dharma, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for many years and continue to cause havoc. Modern strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, along with daily unnamed viruses, not only do encryption of online data files but also infiltrate most accessible system restores and backups. Information replicated to the cloud can also be encrypted. In a poorly architected data protection solution, this can make automatic restoration hopeless and effectively sets the network back to zero.

Restoring programs and data after a ransomware outage becomes a sprint against the clock as the victim fights to stop the spread, clear the virus, and restore enterprise-critical operations. Because crypto-ransomware needs time to replicate, attacks are usually sprung on weekends and holidays, when penetrations may take more time to notice. This multiplies the difficulty of quickly marshalling and organizing a qualified response team.

Progent makes available an assortment of services for securing enterprises from crypto-ransomware attacks. These include team education to help identify and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of modern security appliances with artificial intelligence capabilities from SentinelOne to discover and suppress zero-day cyber attacks intelligently. Progent in addition provides the services of experienced ransomware recovery professionals with the track record and perseverance to rebuild a compromised system as rapidly as possible.

Progent's Ransomware Restoration Services
Subsequent to a crypto-ransomware event, paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the codes to unencrypt any or all of your information. Kaspersky ascertained that seventeen percent of ransomware victims never restored their data after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to piece back together the key parts of your IT environment. Without access to complete system backups, this requires a wide range of IT skills, top notch team management, and the ability to work continuously until the recovery project is done.

For twenty years, Progent has offered certified expert IT services for companies throughout the US and has achieved Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have earned advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have earned internationally-recognized industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP application software. This breadth of expertise gives Progent the capability to quickly understand necessary systems and re-organize the surviving parts of your Information Technology environment after a ransomware penetration and rebuild them into a functioning network.

Progent's recovery group utilizes state-of-the-art project management applications to coordinate the complex restoration process. Progent knows the urgency of acting rapidly and in unison with a customer's management and IT staff to prioritize tasks and to put key applications back on-line as fast as humanly possible.

Client Story: A Successful Crypto-Ransomware Intrusion Recovery
A small business engaged Progent after their company was attacked by Ryuk ransomware. Ryuk is believed to have been launched by Northern Korean state criminal gangs, suspected of using approaches exposed from the U.S. National Security Agency. Ryuk attacks specific companies with limited ability to sustain operational disruption and is one of the most lucrative iterations of ransomware viruses. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer located in the Chicago metro area and has around 500 employees. The Ryuk penetration had brought down all business operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the start of the attack and were damaged. The client was taking steps for paying the ransom (in excess of $200,000) and praying for good luck, but in the end utilized Progent.

Progent worked together with the customer to quickly understand and prioritize the key applications that needed to be addressed to make it possible to restart company functions:

• Microsoft Active Directory
• Microsoft Exchange
• Financials/MRP

In less than 48 hours, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then initiated reinstallations and storage recovery of critical systems. All Microsoft Exchange Server ties and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble local OST files (Microsoft Outlook Off-Line Folder Files) on various PCs and laptops in order to recover mail information. A not too old offline backup of the businesses accounting software made them able to recover these essential services back online. Although a lot of work remained to recover completely from the Ryuk virus, essential services were returned to operations rapidly:

During the next few weeks key milestones in the recovery project were accomplished through close cooperation between Progent consultants and the customer:

• Internal web applications were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server exceeding four million archived emails was brought online and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were fully functional.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Nearly all of the desktop computers were fully operational.

Conclusion
A potential business-killing disaster was avoided due to hard-working experts, a broad array of subject matter expertise, and close collaboration. Although in hindsight the ransomware virus penetration detailed here would have been identified and prevented with advanced cyber security technology and NIST Cybersecurity Framework best practices, team education, and well thought out security procedures for data backup and applying software patches, the fact remains that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware penetration, feel confident that Progent's team of experts has substantial experience in crypto-ransomware virus blocking, removal, and data restoration.

To read or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers businesses in El Paso a variety of remote monitoring and security evaluation services to assist you to reduce the threat from crypto-ransomware. These services include modern machine learning technology to detect new strains of ransomware that are able to get past legacy signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management techniques to help keep your IT system operating at peak levels by tracking the health of vital assets that drive your business network. When ProSight LAN Watch uncovers an issue, an alert is sent automatically to your designated IT staff and your Progent engineering consultant so that all looming issues can be addressed before they can disrupt productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based solution for monitoring and managing your network, server, and desktop devices by offering tools for streamlining common time-consuming tasks. These can include health monitoring, update management, automated repairs, endpoint setup, backup and recovery, A/V protection, remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alert to your designated IT staff and your assigned Progent consultant so emerging problems can be fixed before they interfere with your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to map out, track, optimize and troubleshoot their connectivity appliances such as routers and switches, firewalls, and wireless controllers plus servers, printers, client computers and other devices. Using state-of-the-art RMM technology, ProSight WAN Watch makes sure that infrastructure topology maps are always current, copies and displays the configuration information of virtually all devices on your network, tracks performance, and generates alerts when issues are detected. By automating complex network management activities, WAN Watch can knock hours off ordinary chores such as network mapping, reconfiguring your network, finding devices that need important software patches, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding line of real-time reporting tools designed to integrate with the leading ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize critical issues like inconsistent support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has worked with leading backup/restore software companies to produce ProSight Data Protection Services, a portfolio of subscription-based offerings that deliver backup-as-a-service. ProSight DPS services automate and monitor your backup operations and enable non-disruptive backup and rapid recovery of critical files/folders, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS helps you protect against data loss caused by hardware failures, natural disasters, fire, cyber attacks like ransomware, human error, ill-intentioned employees, or application bugs. Managed services available in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top information security companies to provide web-based management and comprehensive protection for all your email traffic. The hybrid structure of Progent's Email Guard combines cloud-based filtering with an on-premises gateway device to offer complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-borne malware. The cloud filter acts as a preliminary barricade and keeps the vast majority of unwanted email from reaching your security perimeter. This reduces your vulnerability to inbound attacks and saves system bandwidth and storage space. Email Guard's onsite gateway device provides a deeper layer of inspection for incoming email. For outgoing email, the onsite security gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The local gateway can also assist Microsoft Exchange Server to track and protect internal email traffic that originates and ends within your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo MFA managed services incorporate Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity verification on Apple iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you sign into a protected online account and give your password you are asked to verify who you are on a unit that only you possess and that is accessed using a different network channel. A broad range of devices can be utilized as this second means of ID validation such as a smartphone or watch, a hardware token, a landline telephone, etc. You may designate multiple verification devices. To learn more about ProSight Duo two-factor identity validation services, go to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Call Desk: Support Desk Managed Services
  Progent's Call Center services permit your information technology staff to offload Support Desk services to Progent or split activity for Service Desk support transparently between your internal support team and Progent's extensive pool of certified IT service engineers and subject matter experts. Progent's Shared Help Desk Service offers a transparent supplement to your internal network support group. End user access to the Service Desk, provision of support, issue escalation, ticket creation and updates, efficiency measurement, and maintenance of the support database are cohesive regardless of whether incidents are taken care of by your internal support organization, by Progent, or both. Learn more about Progent's outsourced/shared Service Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection service that utilizes next generation behavior analysis tools to defend endpoints and physical and virtual servers against new malware attacks such as ransomware and file-less exploits, which easily get by traditional signature-based anti-virus products. Progent ASM services safeguard local and cloud resources and provides a unified platform to address the complete malware attack progression including blocking, infiltration detection, mitigation, cleanup, and forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and safeguard data about your IT infrastructure, procedures, applications, and services. You can quickly locate passwords or IP addresses and be alerted automatically about upcoming expirations of SSL certificates or domains. By cleaning up and organizing your IT infrastructure documentation, you can eliminate up to 50% of time spent looking for critical information about your IT network. ProSight IT Asset Management includes a common repository for holding and sharing all documents related to managing your business network like standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and associating IT information. Whether you're planning enhancements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you need as soon as you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of all sizes a versatile and affordable alternative for evaluating, testing, scheduling, implementing, and tracking software and firmware updates to your dynamic information system. In addition to maximizing the protection and reliability of your computer environment, Progent's software/firmware update management services allow your IT staff to focus on more strategic projects and activities that derive the highest business value from your network. Find out more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected Tier III data center on a fast virtual host configured and managed by Progent's network support experts. Under the ProSight Virtual Hosting service model, the client retains ownership of the data, the operating system platforms, and the applications. Since the environment is virtualized, it can be moved easily to an alternate hosting environment without a lengthy and difficult configuration process. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoints against modern malware attacks like ransomware and email phishing, which easily escape legacy signature-matching AV tools. ProSight ASM safeguards on-premises and cloud resources and offers a unified platform to manage the complete malware attack lifecycle including blocking, infiltration detection, containment, remediation, and forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver affordable multi-layer security for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and responding to security threats from all vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, device control, and web filtering via leading-edge technologies incorporated within one agent managed from a single console. Progent's data protection and virtualization consultants can help your business to design and configure a ProSight ESP environment that meets your organization's unique requirements and that allows you demonstrate compliance with government and industry data protection regulations. Progent will assist you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that call for urgent attention. Progent's consultants can also help you to install and test a backup and restore solution like ProSight Data Protection Services so you can get back in business rapidly from a destructive security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange filtering.