Riverside 24x7 Immediate Crypto-Ransomware
Computer Virus Detection and Remediation Help

Ransomware : Your Feared IT Disaster
Ransomware has become an escalating cyber pandemic that represents an extinction-level danger for organizations unprepared for an assault. Multiple generations of ransomware such as CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for a long time and still inflict destruction. Recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, plus additional unnamed malware, not only encrypt online data files but also infect many accessible system protection mechanisms. Data synchronized to the cloud can also be encrypted. In a vulnerable system, this can make automatic restore operations useless and effectively sets the entire system back to zero.

Retrieving programs and information after a ransomware outage becomes a sprint against time as the victim struggles to stop lateral movement, remove the ransomware, and resume mission-critical activity. Since ransomware needs time to spread, assaults are frequently launched on weekends, when successful penetrations typically take more time to notice. This multiplies the difficulty of quickly mobilizing and orchestrating an experienced mitigation team.

Progent provides a range of help services for securing organizations from crypto-ransomware attacks. Among these are team training to help identify and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of modern security appliances with AI capabilities from SentinelOne to identify and disable zero-day cyber threats rapidly. Progent also offers the assistance of experienced ransomware recovery professionals with the track record and perseverance to restore a compromised environment as soon as possible.

Progent's Ransomware Recovery Support Services
After a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not ensure that merciless criminals will provide the codes to decrypt any of your data. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their data after having paid the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The other path is to setup from scratch the vital parts of your Information Technology environment. Absent the availability of full information backups, this requires a broad range of skills, well-coordinated project management, and the ability to work 24x7 until the recovery project is complete.

For two decades, Progent has made available certified expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained advanced certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have earned internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP application software. This breadth of expertise provides Progent the ability to quickly identify important systems and consolidate the remaining components of your IT system following a ransomware penetration and configure them into an operational network.

Progent's ransomware team deploys top notch project management tools to orchestrate the complicated restoration process. Progent knows the urgency of acting swiftly and in unison with a client's management and Information Technology resources to assign priority to tasks and to put the most important systems back on line as fast as possible.

Customer Case Study: A Successful Ransomware Intrusion Response
A customer escalated to Progent after their organization was taken over by the Ryuk ransomware. Ryuk is thought to have been created by North Korean state criminal gangs, possibly adopting technology exposed from the U.S. National Security Agency. Ryuk goes after specific businesses with limited tolerance for operational disruption and is one of the most lucrative versions of ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturing company located in Chicago and has about 500 workers. The Ryuk attack had disabled all business operations and manufacturing processes. Most of the client's backups had been online at the start of the intrusion and were damaged. The client was actively seeking loans for paying the ransom demand (in excess of $200,000) and praying for the best, but in the end made the decision to use Progent.

Progent worked with the client to quickly assess and prioritize the critical services that needed to be recovered in order to continue departmental functions:

• Windows Active Directory
• Microsoft Exchange Server
• Financials/MRP

Within 48 hours, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then initiated setup and hard drive recovery of mission critical systems. All Exchange schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to collect non-encrypted OST files (Microsoft Outlook Offline Data Files) on various workstations in order to recover mail data. A not too old offline backup of the businesses manufacturing software made them able to return these essential applications back servicing users. Although a lot of work remained to recover fully from the Ryuk attack, critical services were restored rapidly:

During the next month important milestones in the recovery process were achieved in close cooperation between Progent team members and the client:

• Internal web sites were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was spun up and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory capabilities were fully recovered.
• A new Palo Alto 850 firewall was set up and programmed.
• Most of the user workstations were being used by staff.

Conclusion
A likely company-ending catastrophe was evaded due to top-tier experts, a broad array of IT skills, and tight teamwork. Although in hindsight the crypto-ransomware virus incident described here should have been disabled with up-to-date security technology and recognized best practices, user and IT administrator training, and properly executed incident response procedures for backup and applying software patches, the reality is that state-sponsored cybercriminals from Russia, China and elsewhere are tireless and will continue. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has a proven track record in ransomware virus defense, cleanup, and information systems restoration.

To read or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Riverside a portfolio of online monitoring and security assessment services to assist you to minimize the threat from ransomware. These services include next-generation machine learning capability to uncover new variants of crypto-ransomware that can escape detection by traditional signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management (RMM) technology to keep your network running at peak levels by tracking the state of vital computers that drive your information system. When ProSight LAN Watch uncovers a problem, an alert is sent automatically to your designated IT staff and your Progent engineering consultant so that any potential issues can be resolved before they can disrupt productivity. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for monitoring and managing your network, server, and desktop devices by offering tools for performing common time-consuming jobs. These include health monitoring, patch management, automated repairs, endpoint setup, backup and restore, A/V response, secure remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your designated IT personnel and your Progent consultant so that emerging problems can be taken care of before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for smaller organizations to map out, track, enhance and troubleshoot their networking appliances such as routers, firewalls, and load balancers plus servers, endpoints and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, WAN Watch ensures that infrastructure topology diagrams are kept current, captures and displays the configuration information of almost all devices on your network, monitors performance, and sends notices when problems are detected. By automating complex management and troubleshooting activities, WAN Watch can cut hours off common tasks like making network diagrams, reconfiguring your network, locating devices that need important software patches, or resolving performance problems. Learn more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of real-time and in-depth management reporting utilities designed to integrate with the industry's leading ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues like spotty support follow-through or endpoints with missing patches. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with leading backup software providers to produce ProSight Data Protection Services, a family of offerings that provide backup-as-a-service. ProSight DPS products manage and monitor your backup operations and allow non-disruptive backup and rapid recovery of critical files/folders, applications, system images, plus VMs. ProSight DPS helps your business recover from data loss caused by hardware breakdown, natural calamities, fire, cyber attacks like ransomware, human mistakes, malicious employees, or application bugs. Managed backup services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of top data security vendors to provide centralized management and comprehensive protection for all your email traffic. The powerful structure of Email Guard managed service integrates a Cloud Protection Layer with an on-premises security gateway appliance to offer complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's Cloud Protection Layer serves as a first line of defense and keeps the vast majority of unwanted email from making it to your network firewall. This decreases your vulnerability to external threats and saves system bandwidth and storage. Email Guard's onsite security gateway device adds a further layer of inspection for incoming email. For outbound email, the local gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local gateway can also help Microsoft Exchange Server to track and protect internal email traffic that stays within your security perimeter. For more details, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo authentication service plans utilize Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity verification on Apple iOS, Android, and other out-of-band devices. Using 2FA, whenever you sign into a secured online account and enter your password you are requested to verify who you are via a device that only you have and that uses a separate network channel. A wide selection of devices can be utilized for this second means of ID validation such as a smartphone or watch, a hardware token, a landline telephone, etc. You can register multiple validation devices. To find out more about ProSight Duo identity validation services, refer to Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Center: Call Center Managed Services
  Progent's Help Desk services allow your information technology team to offload Support Desk services to Progent or split activity for support services seamlessly between your internal support group and Progent's nationwide pool of certified IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a seamless extension of your internal support organization. Client access to the Service Desk, delivery of support, issue escalation, ticket creation and tracking, performance metrics, and maintenance of the support database are consistent whether issues are resolved by your internal network support organization, by Progent, or both. Read more about Progent's outsourced/co-managed Service Desk services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates cutting edge behavior machine learning tools to defend endpoints and physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which easily escape legacy signature-matching anti-virus tools. Progent ASM services safeguard local and cloud resources and offers a unified platform to address the entire malware attack progression including filtering, identification, containment, remediation, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered attacks. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, update, find and protect information related to your network infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be warned about upcoming expirations of SSL certificates or domains. By cleaning up and managing your IT documentation, you can save as much as half of time thrown away trying to find vital information about your IT network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT data. Whether you're making enhancements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you need the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for patch management offer organizations of all sizes a versatile and cost-effective alternative for assessing, testing, scheduling, implementing, and documenting updates to your ever-evolving information system. Besides optimizing the security and reliability of your computer environment, Progent's software/firmware update management services permit your in-house IT team to concentrate on more strategic initiatives and tasks that deliver the highest business value from your information network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a protected Tier III data center on a high-performance virtual host set up and maintained by Progent's network support professionals. Under Progent's ProSight Virtual Hosting model, the client retains ownership of the data, the OS platforms, and the apps. Since the system is virtualized, it can be ported immediately to a different hosting solution without requiring a time-consuming and difficult configuration process. With ProSight Virtual Hosting, your business is not tied one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior analysis technology to defend physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which easily get by legacy signature-based anti-virus products. ProSight Active Security Monitoring protects local and cloud-based resources and offers a single platform to automate the complete threat progression including filtering, infiltration detection, mitigation, remediation, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable in-depth security for physical and virtual servers, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced heuristics for continuously monitoring and reacting to security assaults from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, device management, and web filtering through leading-edge technologies incorporated within a single agent accessible from a single control. Progent's security and virtualization consultants can help you to plan and configure a ProSight ESP deployment that meets your organization's specific requirements and that allows you demonstrate compliance with legal and industry data security regulations. Progent will assist you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that require urgent action. Progent can also help your company to set up and test a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can get back in business rapidly from a potentially disastrous cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange filtering.