Lawrence 24-Hour Urgent Ransomware
Computer Malware Detection and Restoration Support

Crypto-Ransomware : Your Worst IT Disaster
Ransomware has become an escalating cyberplague that presents an existential danger for businesses unprepared for an attack. Different iterations of crypto-ransomware like the CrySIS, Fusob, Locky, SamSam and MongoLock cryptoworms have been replicating for years and still inflict damage. Recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, along with additional as yet unnamed newcomers, not only encrypt online files but also infiltrate any configured system protection. Files synchronized to off-site disaster recovery sites can also be ransomed. In a vulnerable system, this can make any restore operations useless and effectively sets the datacenter back to square one.

Retrieving services and information following a crypto-ransomware intrusion becomes a sprint against time as the targeted organization struggles to contain the damage, remove the ransomware, and restore business-critical activity. Since crypto-ransomware needs time to move laterally, penetrations are usually launched during weekends and nights, when successful penetrations typically take longer to discover. This multiplies the difficulty of quickly marshalling and coordinating a capable response team.

Progent has a range of help services for protecting enterprises from ransomware events. Among these are team member training to help identify and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of the latest generation security appliances with machine learning capabilities from SentinelOne to detect and disable new cyber attacks rapidly. Progent in addition offers the services of seasoned ransomware recovery consultants with the track record and perseverance to restore a breached system as quickly as possible.

Progent's Ransomware Restoration Support Services
Soon after a crypto-ransomware penetration, even paying the ransom in cryptocurrency does not guarantee that distant criminals will provide the keys to decipher any of your data. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their information after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to re-install the essential elements of your IT environment. Without access to complete data backups, this calls for a broad complement of skill sets, top notch team management, and the capability to work 24x7 until the task is completed.

For decades, Progent has provided professional IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have attained top industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-recognized certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with accounting and ERP application software. This breadth of experience affords Progent the skills to quickly understand critical systems and integrate the surviving parts of your computer network environment after a crypto-ransomware attack and assemble them into a functioning network.

Progent's security team uses powerful project management systems to orchestrate the complicated restoration process. Progent appreciates the importance of working rapidly and together with a client's management and IT resources to assign priority to tasks and to get key applications back on line as soon as humanly possible.

Client Story: A Successful Ransomware Incident Response
A client sought out Progent after their network system was taken over by the Ryuk ransomware. Ryuk is thought to have been developed by Northern Korean government sponsored hackers, possibly adopting algorithms exposed from the U.S. National Security Agency. Ryuk attacks specific companies with little room for operational disruption and is among the most lucrative examples of ransomware malware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer headquartered in the Chicago metro area with around 500 staff members. The Ryuk event had paralyzed all company operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the start of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but in the end called Progent.

Progent worked hand in hand the customer to quickly understand and assign priority to the essential applications that had to be addressed to make it possible to continue company functions:

• Windows Active Directory
• Microsoft Exchange Email
• MRP System

Within 2 days, Progent was able to restore Windows Active Directory to its pre-attack state. Progent then accomplished reinstallations and hard drive recovery on essential systems. All Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Microsoft Outlook Offline Data Files) on staff workstations and laptops in order to recover mail messages. A not too old offline backup of the businesses accounting/ERP software made it possible to return these essential services back online for users. Although a large amount of work needed to be completed to recover completely from the Ryuk attack, critical systems were recovered quickly:

During the following month important milestones in the restoration project were completed through close collaboration between Progent engineers and the client:

• In-house web sites were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server with over four million historical messages was brought online and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/AR/Inventory Control modules were fully operational.
• A new Palo Alto 850 security appliance was set up and programmed.
• 90% of the user workstations were fully operational.

Conclusion
A likely business-killing disaster was avoided due to top-tier experts, a broad spectrum of technical expertise, and tight teamwork. Although in hindsight the ransomware incident detailed here would have been disabled with up-to-date cyber security technology solutions and security best practices, user training, and appropriate security procedures for information protection and proper patching controls, the fact is that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a crypto-ransomware attack, remember that Progent's team of professionals has extensive experience in ransomware virus defense, remediation, and information systems disaster recovery.

To read or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide companies in Lawrence a range of online monitoring and security assessment services to help you to minimize the threat from ransomware. These services include modern machine learning technology to uncover zero-day variants of crypto-ransomware that can evade legacy signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management techniques to help keep your IT system operating efficiently by tracking the state of vital computers that drive your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted immediately to your specified IT staff and your Progent engineering consultant so any looming issues can be addressed before they can disrupt productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for monitoring and managing your network, server, and desktop devices by offering an environment for performing common time-consuming jobs. These can include health checking, patch management, automated repairs, endpoint deployment, backup and recovery, anti-virus protection, remote access, standard and custom scripts, resource inventory, endpoint status reporting, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious incident, it transmits an alert to your designated IT management personnel and your assigned Progent technical consultant so emerging problems can be fixed before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for small and mid-sized organizations to map, track, optimize and troubleshoot their connectivity hardware such as switches, firewalls, and access points as well as servers, printers, client computers and other networked devices. Incorporating state-of-the-art RMM technology, WAN Watch ensures that network maps are always updated, copies and displays the configuration of virtually all devices connected to your network, monitors performance, and generates alerts when issues are detected. By automating time-consuming management activities, WAN Watch can knock hours off ordinary tasks such as network mapping, reconfiguring your network, finding devices that require critical updates, or resolving performance bottlenecks. Learn more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of real-time and in-depth management reporting plug-ins created to work with the industry's leading ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues such as inconsistent support follow-through or machines with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore software providers to produce ProSight Data Protection Services (DPS), a portfolio of subscription-based management offerings that provide backup-as-a-service. ProSight DPS products automate and monitor your data backup operations and allow non-disruptive backup and rapid restoration of critical files/folders, applications, system images, and VMs. ProSight DPS helps you avoid data loss resulting from hardware breakdown, natural disasters, fire, cyber attacks like ransomware, human mistakes, malicious employees, or software bugs. Managed services available in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Hybrid Backup. Your Progent consultant can assist you to determine which of these managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of leading data security companies to deliver web-based control and comprehensive protection for all your inbound and outbound email. The powerful structure of Progent's Email Guard integrates a Cloud Protection Layer with a local security gateway device to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's Cloud Protection Layer acts as a preliminary barricade and keeps the vast majority of unwanted email from reaching your network firewall. This reduces your vulnerability to inbound attacks and saves system bandwidth and storage space. Email Guard's onsite security gateway appliance adds a deeper level of analysis for inbound email. For outgoing email, the local gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also assist Exchange Server to track and protect internal email that originates and ends inside your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA services utilize Cisco's Duo cloud technology to protect against stolen passwords through the use of two-factor authentication. Duo supports single-tap identity confirmation on Apple iOS, Android, and other personal devices. Using 2FA, when you log into a secured application and enter your password you are requested to confirm your identity via a device that only you possess and that is accessed using a different ("out-of-band") network channel. A broad selection of devices can be used as this second means of ID validation such as an iPhone or Android or watch, a hardware token, a landline telephone, etc. You can designate multiple verification devices. To learn more about ProSight Duo identity validation services, visit Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Service Center: Help Desk Managed Services
  Progent's Help Desk managed services allow your IT group to outsource Call Center services to Progent or split activity for Service Desk support transparently between your internal network support staff and Progent's extensive roster of certified IT support engineers and subject matter experts. Progent's Shared Service Desk provides a smooth extension of your corporate network support team. Client interaction with the Service Desk, provision of technical assistance, issue escalation, ticket creation and updates, efficiency metrics, and management of the service database are cohesive regardless of whether issues are taken care of by your corporate network support staff, by Progent, or both. Find out more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that utilizes cutting edge behavior-based analysis technology to defend endpoint devices and physical and virtual servers against new malware attacks such as ransomware and file-less exploits, which routinely escape traditional signature-based anti-virus tools. Progent Active Security Monitoring services protect on-premises and cloud resources and provides a unified platform to automate the entire malware attack lifecycle including protection, identification, containment, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against new threats. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, find and safeguard data about your IT infrastructure, procedures, business apps, and services. You can instantly find passwords or IP addresses and be alerted about upcoming expirations of SSLs or warranties. By cleaning up and managing your IT documentation, you can eliminate as much as half of time thrown away looking for critical information about your IT network. ProSight IT Asset Management includes a common repository for holding and collaborating on all documents required for managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're planning enhancements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you require as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide organizations of all sizes a flexible and affordable solution for assessing, validating, scheduling, implementing, and tracking updates to your dynamic IT network. Besides optimizing the security and reliability of your IT environment, Progent's software/firmware update management services free up time for your in-house IT team to focus on more strategic initiatives and tasks that derive maximum business value from your information network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host set up and managed by Progent's IT support experts. With the ProSight Virtual Hosting model, the client retains ownership of the data, the operating system software, and the applications. Because the environment is virtualized, it can be ported immediately to a different hosting environment without a time-consuming and difficult configuration process. With ProSight Virtual Hosting, your business is not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's next generation behavior-based machine learning tools to guard physical and virtual endpoints against modern malware assaults such as ransomware and email phishing, which routinely evade legacy signature-based anti-virus tools. ProSight Active Security Monitoring protects local and cloud-based resources and provides a single platform to manage the entire malware attack lifecycle including filtering, identification, mitigation, cleanup, and post-attack forensics. Key capabilities include single-click rollback with Windows VSS and real-time network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver affordable in-depth protection for physical servers and VMs, workstations, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP delivers firewall protection, penetration alarms, device control, and web filtering via cutting-edge tools packaged within a single agent managed from a unified control. Progent's security and virtualization consultants can help your business to plan and configure a ProSight ESP environment that meets your organization's specific needs and that allows you achieve and demonstrate compliance with government and industry data protection standards. Progent will assist you define and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that call for urgent action. Progent's consultants can also assist you to set up and verify a backup and restore solution such as ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange filtering.