Alexandria 24-7 Emergency Crypto-Ransomware
Virus Detection and Restoration Experts

Ransomware : Your Crippling IT Disaster
Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Different versions of crypto-ransomware like the Dharma, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been around for many years and continue to cause harm. The latest strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, along with frequent as yet unnamed newcomers, not only encrypt on-line critical data but also infiltrate any configured system restores and backups. Data synched to the cloud can also be corrupted. In a poorly designed data protection solution, this can render automated restore operations useless and basically sets the network back to zero.

Restoring programs and information after a ransomware event becomes a sprint against the clock as the victim tries its best to stop the spread, eradicate the ransomware, and resume business-critical operations. Since crypto-ransomware takes time to replicate, attacks are often launched during nights and weekends, when attacks are likely to take more time to uncover. This compounds the difficulty of rapidly assembling and coordinating a capable mitigation team.

Progent makes available an assortment of services for securing businesses from ransomware events. Among these are team member training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of next-generation security gateways with AI technology from SentinelOne to discover and disable day-zero cyber threats rapidly. Progent in addition can provide the assistance of seasoned ransomware recovery professionals with the track record and commitment to reconstruct a breached system as quickly as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a ransomware attack, sending the ransom demands in cryptocurrency does not ensure that distant criminals will provide the needed codes to unencrypt any or all of your information. Kaspersky ascertained that seventeen percent of ransomware victims never restored their data even after having paid the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to setup from scratch the key components of your IT environment. Without the availability of essential system backups, this calls for a wide range of skill sets, top notch project management, and the capability to work non-stop until the job is over.

For decades, Progent has made available professional IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP software solutions. This breadth of experience provides Progent the skills to efficiently ascertain important systems and consolidate the surviving pieces of your IT system after a ransomware attack and configure them into a functioning network.

Progent's recovery team uses best of breed project management systems to orchestrate the complex recovery process. Progent understands the urgency of acting rapidly and in concert with a client's management and IT resources to prioritize tasks and to put essential services back on-line as soon as possible.

Customer Story: A Successful Ransomware Intrusion Response
A customer escalated to Progent after their network was taken over by Ryuk ransomware. Ryuk is believed to have been developed by North Korean government sponsored criminal gangs, suspected of adopting algorithms leaked from America's NSA organization. Ryuk attacks specific companies with limited tolerance for disruption and is among the most profitable examples of crypto-ransomware. Major victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing business headquartered in the Chicago metro area with around 500 workers. The Ryuk event had paralyzed all essential operations and manufacturing processes. Most of the client's data backups had been on-line at the time of the attack and were destroyed. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but in the end brought in Progent.

Progent worked with the customer to rapidly determine and prioritize the most important systems that needed to be recovered in order to resume departmental functions:

• Microsoft Active Directory
• Exchange Server
• MRP System

Within 2 days, Progent was able to rebuild Active Directory services to its pre-penetration state. Progent then completed reinstallations and storage recovery of key servers. All Exchange schema and attributes were intact, which facilitated the restore of Exchange. Progent was also able to locate local OST data files (Microsoft Outlook Offline Data Files) on team PCs to recover mail data. A not too old offline backup of the businesses accounting/MRP software made it possible to recover these essential programs back online for users. Although a lot of work still had to be done to recover totally from the Ryuk attack, core services were restored rapidly:

During the next few weeks important milestones in the recovery project were achieved in tight cooperation between Progent team members and the client:

• Internal web sites were returned to operation with no loss of data.
• The MailStore Exchange Server containing more than four million historical emails was brought on-line and available for users.
• CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control capabilities were 100% restored.
• A new Palo Alto 850 security appliance was brought online.
• Nearly all of the user desktops and notebooks were operational.

Conclusion
A possible company-ending catastrophe was avoided through the efforts of results-oriented experts, a wide spectrum of IT skills, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration described here could have been identified and stopped with current cyber security technology and security best practices, staff education, and appropriate incident response procedures for backup and applying software patches, the reality remains that government-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's team of experts has a proven track record in ransomware virus blocking, removal, and information systems recovery.

To read or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Alexandria a variety of online monitoring and security assessment services to help you to reduce the threat from ransomware. These services incorporate modern artificial intelligence capability to uncover new variants of ransomware that can get past legacy signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management technology to keep your network operating efficiently by checking the state of vital assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alarm is transmitted immediately to your designated IT staff and your assigned Progent consultant so any looming issues can be resolved before they can disrupt productivity. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based solution for managing your client-server infrastructure by offering an environment for streamlining common tedious tasks. These can include health checking, update management, automated remediation, endpoint setup, backup and recovery, A/V response, remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and debugging help. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alarm to your specified IT management personnel and your Progent technical consultant so that potential problems can be taken care of before they interfere with your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for smaller organizations to map out, track, reconfigure and debug their connectivity hardware such as routers and switches, firewalls, and access points as well as servers, endpoints and other networked devices. Incorporating state-of-the-art RMM technology, WAN Watch ensures that infrastructure topology maps are always current, copies and manages the configuration information of almost all devices connected to your network, monitors performance, and generates alerts when problems are detected. By automating tedious network management processes, ProSight WAN Watch can cut hours off ordinary tasks such as making network diagrams, expanding your network, locating appliances that require critical updates, or resolving performance issues. Find out more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of in-depth reporting plug-ins designed to work with the industry's leading ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues like inconsistent support follow-up or machines with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup software providers to create ProSight Data Protection Services (DPS), a portfolio of offerings that provide backup-as-a-service. ProSight DPS products manage and monitor your backup processes and enable non-disruptive backup and fast recovery of critical files, apps, system images, and virtual machines. ProSight DPS lets your business protect against data loss resulting from equipment breakdown, natural calamities, fire, cyber attacks such as ransomware, human mistakes, ill-intentioned insiders, or software bugs. Managed backup services available in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of top data security companies to deliver centralized management and world-class protection for your email traffic. The hybrid structure of Progent's Email Guard managed service combines cloud-based filtering with a local security gateway device to offer complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The cloud filter acts as a first line of defense and keeps most threats from making it to your security perimeter. This reduces your vulnerability to external attacks and saves system bandwidth and storage space. Email Guard's onsite security gateway appliance adds a deeper level of inspection for inbound email. For outgoing email, the onsite security gateway offers anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The local gateway can also assist Exchange Server to monitor and safeguard internal email traffic that originates and ends within your security perimeter. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans incorporate Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo enables one-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. With 2FA, when you log into a protected application and enter your password you are requested to confirm your identity via a device that only you have and that is accessed using a different ("out-of-band") network channel. A wide range of out-of-band devices can be utilized as this added form of authentication including an iPhone or Android or watch, a hardware token, a landline phone, etc. You may register several verification devices. For details about Duo identity authentication services, refer to Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Support Desk services allow your IT staff to offload Help Desk services to Progent or divide responsibilities for support services transparently between your internal network support resources and Progent's extensive roster of IT support engineers and subject matter experts. Progent's Shared Service Desk offers a smooth supplement to your corporate support team. End user interaction with the Service Desk, provision of technical assistance, escalation, trouble ticket creation and tracking, efficiency metrics, and maintenance of the service database are consistent regardless of whether incidents are taken care of by your corporate support staff, by Progent, or both. Read more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates next generation behavior-based analysis technology to guard endpoint devices as well as servers and VMs against modern malware assaults such as ransomware and file-less exploits, which routinely get by legacy signature-based anti-virus tools. Progent ASM services safeguard on-premises and cloud-based resources and offers a unified platform to automate the complete malware attack progression including protection, infiltration detection, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and safeguard information about your network infrastructure, processes, applications, and services. You can quickly locate passwords or serial numbers and be warned automatically about upcoming expirations of SSLs or warranties. By updating and organizing your IT infrastructure documentation, you can save up to half of time wasted looking for critical information about your IT network. ProSight IT Asset Management features a centralized repository for holding and collaborating on all documents required for managing your network infrastructure like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and associating IT information. Whether you're planning enhancements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you require the instant you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a flexible and cost-effective solution for assessing, testing, scheduling, applying, and documenting updates to your ever-evolving IT system. In addition to optimizing the security and reliability of your computer environment, Progent's patch management services free up time for your in-house IT staff to focus on line-of-business initiatives and tasks that deliver the highest business value from your information network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a secure fault tolerant data center on a high-performance virtual host configured and maintained by Progent's IT support experts. With the ProSight Virtual Hosting service model, the client owns the data, the OS platforms, and the applications. Because the environment is virtualized, it can be moved easily to an alternate hosting solution without requiring a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, you are not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which easily evade traditional signature-based AV products. ProSight Active Security Monitoring protects on-premises and cloud-based resources and provides a single platform to manage the entire threat lifecycle including blocking, infiltration detection, containment, remediation, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection services deliver ultra-affordable in-depth protection for physical servers and VMs, desktops, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to security threats from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, endpoint management, and web filtering via cutting-edge tools incorporated within a single agent accessible from a single control. Progent's data protection and virtualization experts can assist your business to plan and implement a ProSight ESP deployment that meets your organization's unique needs and that allows you achieve and demonstrate compliance with government and industry data protection standards. Progent will help you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that require immediate attention. Progent's consultants can also help your company to install and verify a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover rapidly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Microsoft Exchange email filtering.