24x7 Hartford Urgent Crypto
Virus Assessment and Remediation Consulting

Crypto-Ransomware : Your Crippling IT Disaster
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level threat for organizations vulnerable to an attack. Multiple generations of ransomware like the CryptoLocker, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for a long time and continue to inflict havoc. The latest versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, plus frequent as yet unnamed viruses, not only do encryption of online data files but also infiltrate most configured system protection mechanisms. Data synchronized to off-site disaster recovery sites can also be corrupted. In a poorly architected data protection solution, it can render automatic restoration hopeless and basically sets the entire system back to square one.

Getting back online applications and information after a crypto-ransomware outage becomes a sprint against the clock as the targeted organization fights to contain the damage, remove the virus, and resume enterprise-critical activity. Since ransomware takes time to spread, penetrations are usually sprung on weekends, when successful attacks may take more time to identify. This multiplies the difficulty of rapidly assembling and organizing a qualified response team.

Progent has an assortment of solutions for protecting businesses from ransomware events. These include team education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of modern security solutions with artificial intelligence capabilities from SentinelOne to identify and disable zero-day cyber threats intelligently. Progent also provides the assistance of expert crypto-ransomware recovery consultants with the talent and commitment to rebuild a breached system as rapidly as possible.

Progent's Ransomware Restoration Services
Subsequent to a ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that distant criminals will return the codes to decrypt all your data. Kaspersky Labs determined that 17% of crypto-ransomware victims never restored their files even after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The fallback is to re-install the key components of your IT environment. Without access to complete system backups, this requires a broad range of skills, well-coordinated team management, and the capability to work continuously until the recovery project is complete.

For two decades, Progent has offered certified expert IT services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded high-level certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have garnered internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience in accounting and ERP software solutions. This breadth of experience affords Progent the ability to efficiently understand critical systems and organize the remaining parts of your network environment after a crypto-ransomware attack and assemble them into a functioning network.

Progent's recovery team of experts deploys state-of-the-art project management tools to coordinate the sophisticated restoration process. Progent appreciates the urgency of acting rapidly and in concert with a client's management and Information Technology staff to prioritize tasks and to put key services back on-line as soon as humanly possible.

Client Story: A Successful Ransomware Virus Recovery
A small business sought out Progent after their network was crashed by the Ryuk ransomware virus. Ryuk is generally considered to have been developed by Northern Korean government sponsored cybercriminals, possibly adopting techniques exposed from the U.S. National Security Agency. Ryuk goes after specific companies with little or no room for disruption and is among the most profitable versions of ransomware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in Chicago and has about 500 staff members. The Ryuk attack had disabled all business operations and manufacturing capabilities. Most of the client's information backups had been directly accessible at the time of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (exceeding $200K) and wishfully thinking for good luck, but in the end utilized Progent.

Progent worked hand in hand the customer to rapidly assess and prioritize the critical services that had to be restored in order to resume company functions:

• Active Directory
• Exchange Server
• MRP System

Within 2 days, Progent was able to rebuild Active Directory services to its pre-intrusion state. Progent then initiated rebuilding and hard drive recovery of needed applications. All Exchange Server data and configuration information were usable, which greatly helped the restore of Exchange. Progent was able to collect non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on staff desktop computers to recover mail data. A recent offline backup of the customer's accounting/MRP systems made it possible to return these essential programs back servicing users. Although a lot of work needed to be completed to recover completely from the Ryuk event, essential services were restored quickly:

During the next month critical milestones in the restoration project were made through tight collaboration between Progent team members and the client:

• In-house web applications were restored without losing any data.
• The MailStore Server with over four million historical messages was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were completely functional.
• A new Palo Alto Networks 850 security appliance was set up.
• Ninety percent of the user workstations were fully operational.

Conclusion
A potential company-ending catastrophe was avoided with dedicated professionals, a wide spectrum of knowledge, and tight collaboration. Although in analyzing the event afterwards the ransomware virus incident detailed here would have been shut down with up-to-date cyber security technology solutions and recognized best practices, user and IT administrator education, and well thought out security procedures for data protection and proper patching controls, the fact is that state-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has substantial experience in crypto-ransomware virus blocking, mitigation, and data restoration.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Hartford a portfolio of remote monitoring and security assessment services designed to assist you to minimize your vulnerability to ransomware. These services include modern machine learning technology to detect zero-day variants of crypto-ransomware that are able to get past traditional signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) technology to help keep your network operating efficiently by checking the health of critical assets that power your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your designated IT management personnel and your Progent consultant so that any potential problems can be resolved before they have a chance to disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your client-server infrastructure by offering tools for streamlining common tedious jobs. These include health checking, update management, automated repairs, endpoint setup, backup and restore, A/V response, secure remote access, built-in and custom scripts, asset inventory, endpoint profile reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it transmits an alarm to your designated IT management personnel and your Progent consultant so emerging issues can be fixed before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for smaller organizations to map out, monitor, reconfigure and troubleshoot their networking appliances like switches, firewalls, and load balancers plus servers, printers, client computers and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network diagrams are always updated, copies and manages the configuration of virtually all devices on your network, monitors performance, and sends alerts when issues are detected. By automating time-consuming network management activities, WAN Watch can cut hours off ordinary tasks like network mapping, reconfiguring your network, locating devices that require critical software patches, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of real-time and in-depth management reporting plug-ins designed to work with the top ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues such as inconsistent support follow-up or endpoints with missing patches. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup technology providers to create ProSight Data Protection Services (DPS), a family of subscription-based offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup operations and allow non-disruptive backup and fast restoration of critical files, applications, images, and VMs. ProSight DPS lets your business protect against data loss caused by equipment failures, natural calamities, fire, cyber attacks like ransomware, user error, ill-intentioned employees, or software glitches. Managed services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Hybrid Backup. Your Progent service representative can assist you to determine which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the technology of top data security vendors to provide web-based control and world-class protection for all your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service combines cloud-based filtering with an on-premises gateway device to offer complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. The Cloud Protection Layer serves as a first line of defense and blocks most threats from reaching your network firewall. This reduces your vulnerability to inbound attacks and saves network bandwidth and storage space. Email Guard's on-premises security gateway device adds a further level of analysis for inbound email. For outgoing email, the local gateway provides anti-virus and anti-spam filtering, DLP, and email encryption. The local security gateway can also assist Microsoft Exchange Server to track and safeguard internal email that originates and ends inside your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo technology to defend against compromised passwords by using two-factor authentication. Duo supports one-tap identity confirmation with iOS, Android, and other out-of-band devices. Using Duo 2FA, when you sign into a protected application and enter your password you are asked to confirm your identity via a unit that only you have and that uses a separate network channel. A wide selection of out-of-band devices can be utilized as this second means of ID validation including an iPhone or Android or wearable, a hardware token, a landline telephone, etc. You may designate multiple validation devices. To learn more about Duo two-factor identity validation services, go to Cisco Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Service Center: Help Desk Managed Services
  Progent's Support Center managed services allow your IT team to offload Support Desk services to Progent or divide responsibilities for Help Desk services seamlessly between your in-house network support team and Progent's extensive roster of certified IT support engineers and subject matter experts (SMEs). Progent's Shared Service Desk offers a seamless extension of your internal network support organization. User access to the Service Desk, provision of support, escalation, ticket generation and tracking, efficiency metrics, and maintenance of the service database are consistent regardless of whether incidents are resolved by your core support organization, by Progent's team, or both. Read more about Progent's outsourced/shared Help Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates cutting edge behavior analysis technology to defend endpoints and servers and VMs against new malware assaults such as ransomware and email phishing, which routinely escape legacy signature-matching anti-virus tools. Progent ASM services protect on-premises and cloud-based resources and provides a single platform to automate the complete malware attack progression including filtering, identification, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, find and protect information about your network infrastructure, procedures, business apps, and services. You can instantly find passwords or serial numbers and be alerted automatically about upcoming expirations of SSLs ,domains or warranties. By cleaning up and organizing your IT infrastructure documentation, you can save up to 50% of time spent searching for vital information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and sharing all documents related to managing your network infrastructure like standard operating procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're making enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you require when you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a versatile and cost-effective alternative for assessing, testing, scheduling, applying, and tracking updates to your dynamic information system. In addition to maximizing the security and reliability of your IT network, Progent's software/firmware update management services permit your IT staff to focus on line-of-business projects and tasks that derive maximum business value from your network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a secure fault tolerant data center on a high-performance virtual host configured and maintained by Progent's network support experts. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system platforms, and the apps. Since the system is virtualized, it can be ported immediately to a different hardware solution without requiring a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior-based analysis technology to guard physical and virtual endpoint devices against new malware attacks like ransomware and file-less exploits, which routinely escape traditional signature-based AV tools. ProSight Active Security Monitoring protects on-premises and cloud resources and offers a single platform to manage the complete threat lifecycle including filtering, identification, containment, cleanup, and forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable multi-layer security for physical servers and virtual machines, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and responding to security assaults from all vectors. ProSight ESP provides two-way firewall protection, penetration alarms, endpoint control, and web filtering through leading-edge technologies incorporated within a single agent accessible from a single control. Progent's data protection and virtualization consultants can assist you to design and implement a ProSight ESP deployment that addresses your company's specific needs and that helps you demonstrate compliance with legal and industry information protection regulations. Progent will help you define and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that require urgent attention. Progent's consultants can also help you to install and verify a backup and restore solution such as ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange filtering.