Hayward 24/7/365 Urgent CryptoLocker
Malware Identification and Remediation Consulting

Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become an escalating cyber pandemic that presents an enterprise-level threat for businesses of all sizes vulnerable to an attack. Different versions of ransomware such as CrySIS, Fusob, Locky, SamSam and MongoLock cryptoworms have been circulating for a long time and still inflict damage. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with daily unnamed malware, not only encrypt on-line data files but also infiltrate any configured system protection. Information synched to the cloud can also be corrupted. In a poorly designed data protection solution, it can make automatic restoration hopeless and effectively sets the network back to square one.

Getting back services and data following a ransomware outage becomes a race against time as the targeted organization struggles to contain, cleanup the ransomware, and restore mission-critical activity. Due to the fact that ransomware requires time to move laterally, penetrations are frequently sprung during weekends and nights, when successful penetrations may take longer to notice. This multiplies the difficulty of promptly mobilizing and coordinating a qualified response team.

Progent has an assortment of help services for securing organizations from crypto-ransomware attacks. Among these are team education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of the latest generation security appliances with machine learning capabilities from SentinelOne to identify and suppress zero-day cyber attacks automatically. Progent in addition provides the assistance of expert ransomware recovery professionals with the track record and commitment to reconstruct a breached network as quickly as possible.

Progent's Ransomware Restoration Help
After a crypto-ransomware attack, sending the ransom in cryptocurrency does not provide any assurance that distant criminals will provide the codes to decipher all your files. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to setup from scratch the mission-critical elements of your Information Technology environment. Without access to essential data backups, this requires a wide range of skills, professional team management, and the ability to work continuously until the job is finished.

For two decades, Progent has offered certified expert IT services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with financial systems and ERP applications. This breadth of experience provides Progent the ability to rapidly understand important systems and consolidate the surviving components of your Information Technology system after a crypto-ransomware penetration and assemble them into a functioning system.

Progent's security team of experts deploys state-of-the-art project management systems to coordinate the complex restoration process. Progent understands the urgency of working swiftly and in concert with a customer's management and IT resources to prioritize tasks and to put essential applications back on line as soon as possible.

Customer Story: A Successful Ransomware Virus Recovery
A business sought out Progent after their company was taken over by Ryuk ransomware. Ryuk is thought to have been deployed by Northern Korean government sponsored hackers, suspected of adopting algorithms exposed from America's NSA organization. Ryuk targets specific companies with little tolerance for operational disruption and is among the most lucrative instances of ransomware viruses. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company located in Chicago and has around 500 staff members. The Ryuk intrusion had frozen all essential operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the beginning of the attack and were damaged. The client considered paying the ransom demand (in excess of two hundred thousand dollars) and hoping for good luck, but ultimately made the decision to use Progent.

Progent worked together with the customer to quickly assess and assign priority to the key areas that needed to be restored in order to continue departmental operations:

• Active Directory (AD)
• Exchange Server
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to rebuild Active Directory to its pre-penetration state. Progent then assisted with setup and storage recovery of the most important systems. All Microsoft Exchange Server data and attributes were usable, which facilitated the restore of Exchange. Progent was able to assemble non-encrypted OST files (Microsoft Outlook Offline Data Files) on various workstations to recover mail data. A not too old off-line backup of the businesses financials/MRP software made them able to return these vital services back available to users. Although significant work remained to recover completely from the Ryuk attack, the most important services were recovered quickly:

During the next month key milestones in the restoration project were made through close collaboration between Progent team members and the customer:

• In-house web applications were returned to operation without losing any information.
• The MailStore Exchange Server with over four million historical emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable/AR/Inventory Control capabilities were fully operational.
• A new Palo Alto Networks 850 firewall was installed.
• 90% of the desktop computers were fully operational.

Conclusion
A probable company-ending disaster was evaded through the efforts of results-oriented experts, a wide spectrum of knowledge, and close collaboration. Although upon completion of forensics the ransomware virus incident described here would have been identified and disabled with advanced security technology solutions and recognized best practices, team education, and appropriate security procedures for backup and proper patching controls, the reality is that state-sponsored hackers from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware attack, remember that Progent's roster of professionals has substantial experience in crypto-ransomware virus blocking, removal, and information systems restoration.

To read or download a PDF version of this customer case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Hayward a range of remote monitoring and security evaluation services designed to help you to reduce your vulnerability to crypto-ransomware. These services include next-generation AI capability to uncover new strains of ransomware that can get past traditional signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management techniques to keep your IT system running at peak levels by tracking the state of critical computers that power your information system. When ProSight LAN Watch uncovers a problem, an alert is transmitted automatically to your specified IT staff and your assigned Progent engineering consultant so that any looming problems can be addressed before they have a chance to impact productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based solution for managing your client-server infrastructure by offering an environment for streamlining common tedious tasks. These include health monitoring, update management, automated repairs, endpoint deployment, backup and restore, A/V defense, remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it sends an alert to your specified IT staff and your assigned Progent technical consultant so potential issues can be fixed before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it simple and affordable for smaller organizations to map out, track, reconfigure and troubleshoot their connectivity hardware like routers and switches, firewalls, and wireless controllers plus servers, printers, endpoints and other devices. Using cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology diagrams are kept current, copies and manages the configuration information of virtually all devices connected to your network, tracks performance, and sends notices when issues are detected. By automating complex management and troubleshooting activities, ProSight WAN Watch can cut hours off ordinary tasks like making network diagrams, expanding your network, finding appliances that need important software patches, or isolating performance issues. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of in-depth reporting utilities designed to work with the industry's top ticketing and remote network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues like spotty support follow-through or endpoints with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with advanced backup/restore technology providers to create ProSight Data Protection Services, a selection of management offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and track your backup operations and allow transparent backup and fast recovery of critical files/folders, apps, system images, and virtual machines. ProSight DPS lets your business protect against data loss resulting from hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, user mistakes, malicious insiders, or application glitches. Managed backup services in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to determine which of these fully managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of leading information security vendors to deliver centralized management and world-class protection for all your inbound and outbound email. The hybrid structure of Email Guard combines cloud-based filtering with a local security gateway device to provide advanced defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-based threats. The Cloud Protection Layer serves as a first line of defense and keeps the vast majority of unwanted email from reaching your network firewall. This reduces your exposure to inbound threats and saves network bandwidth and storage. Email Guard's on-premises security gateway device provides a deeper level of inspection for incoming email. For outbound email, the on-premises gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The onsite security gateway can also help Exchange Server to monitor and safeguard internal email that stays within your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication services utilize Cisco's Duo cloud technology to protect against compromised passwords by using two-factor authentication. Duo supports one-tap identity verification with iOS, Google Android, and other out-of-band devices. With 2FA, whenever you sign into a protected online account and enter your password you are asked to verify your identity via a unit that only you have and that is accessed using a different network channel. A broad range of out-of-band devices can be used for this added form of ID validation such as an iPhone or Android or wearable, a hardware/software token, a landline phone, etc. You may designate several validation devices. To learn more about Duo two-factor identity validation services, refer to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Help Desk: Support Desk Managed Services
  Progent's Call Center services allow your IT group to offload Help Desk services to Progent or divide activity for support services seamlessly between your internal network support team and Progent's extensive roster of certified IT service engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a seamless supplement to your core IT support group. End user interaction with the Service Desk, delivery of technical assistance, issue escalation, ticket creation and updates, efficiency metrics, and management of the support database are cohesive regardless of whether incidents are resolved by your corporate IT support staff, by Progent, or both. Find out more about Progent's outsourced/co-managed Service Center services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior-based analysis technology to defend endpoints as well as servers and VMs against modern malware assaults such as ransomware and email phishing, which routinely escape traditional signature-based anti-virus tools. Progent Active Security Monitoring services safeguard local and cloud-based resources and offers a single platform to address the complete threat lifecycle including protection, infiltration detection, mitigation, remediation, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against new threats. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, find and safeguard data about your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or IP addresses and be warned automatically about impending expirations of SSLs or warranties. By cleaning up and organizing your IT infrastructure documentation, you can save up to 50% of time spent trying to find vital information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and sharing all documents required for managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for gathering and associating IT data. Whether you're making enhancements, doing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you need as soon as you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide businesses of all sizes a versatile and cost-effective solution for evaluating, testing, scheduling, implementing, and tracking updates to your dynamic information system. Besides optimizing the protection and reliability of your computer environment, Progent's software/firmware update management services permit your IT team to concentrate on more strategic initiatives and activities that deliver the highest business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual machine host set up and managed by Progent's IT support professionals. With Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system software, and the applications. Since the system is virtualized, it can be ported easily to an alternate hosting solution without requiring a lengthy and difficult configuration process. With ProSight Virtual Hosting, your business is not tied one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoint devices against new malware assaults like ransomware and file-less exploits, which routinely escape legacy signature-matching AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a single platform to automate the complete threat lifecycle including blocking, infiltration detection, mitigation, remediation, and post-attack forensics. Key capabilities include one-click rollback using Windows VSS and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection services deliver ultra-affordable in-depth security for physical servers and VMs, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and reacting to cyber assaults from all vectors. ProSight ESP delivers firewall protection, penetration alerts, device control, and web filtering via leading-edge technologies packaged within a single agent accessible from a single control. Progent's data protection and virtualization consultants can assist you to plan and configure a ProSight ESP deployment that addresses your company's specific requirements and that helps you prove compliance with government and industry information protection standards. Progent will help you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that require urgent action. Progent can also help your company to install and test a backup and restore solution like ProSight Data Protection Services so you can recover quickly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.