Clearwater 24/7/365 Emergency Crypto
Malware Detection and Removal Help

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an existential danger for businesses of all sizes vulnerable to an assault. Multiple generations of ransomware such as CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for years and still inflict havoc. More recent strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, along with daily unnamed malware, not only encrypt online data but also infiltrate most available system restores and backups. Information synchronized to the cloud can also be encrypted. In a vulnerable environment, it can render automated recovery impossible and basically knocks the entire system back to zero.

Getting back on-line services and information after a ransomware outage becomes a race against the clock as the victim struggles to stop lateral movement, remove the virus, and resume mission-critical activity. Because crypto-ransomware needs time to spread, assaults are frequently launched during weekends and nights, when successful attacks in many cases take more time to discover. This compounds the difficulty of rapidly mobilizing and organizing a knowledgeable mitigation team.

Progent has a variety of support services for securing organizations from ransomware penetrations. These include staff training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, along with installation of next-generation security gateways with artificial intelligence technology from SentinelOne to identify and disable zero-day cyber attacks automatically. Progent in addition provides the assistance of expert ransomware recovery consultants with the talent and perseverance to re-deploy a breached environment as quickly as possible.

Progent's Ransomware Recovery Services
After a ransomware event, even paying the ransom in cryptocurrency does not guarantee that merciless criminals will return the needed codes to decipher any of your data. Kaspersky Labs estimated that 17% of ransomware victims never restored their files even after having paid the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to piece back together the essential components of your Information Technology environment. Absent access to complete system backups, this requires a broad complement of IT skills, top notch team management, and the capability to work non-stop until the job is over.

For twenty years, Progent has offered professional IT services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded top industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of experience gives Progent the ability to efficiently understand necessary systems and integrate the remaining parts of your IT system following a crypto-ransomware attack and configure them into an operational system.

Progent's ransomware group deploys top notch project management systems to coordinate the sophisticated recovery process. Progent knows the urgency of working swiftly and in concert with a client's management and IT team members to prioritize tasks and to put key services back on line as fast as possible.

Client Story: A Successful Ransomware Incident Recovery
A client contacted Progent after their company was penetrated by the Ryuk ransomware. Ryuk is thought to have been created by Northern Korean state sponsored criminal gangs, suspected of adopting strategies leaked from America's National Security Agency. Ryuk attacks specific companies with little or no room for operational disruption and is one of the most profitable incarnations of ransomware malware. Headline targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company based in the Chicago metro area with around 500 workers. The Ryuk intrusion had shut down all business operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the beginning of the intrusion and were eventually encrypted. The client was actively seeking loans for paying the ransom (more than $200,000) and wishfully thinking for good luck, but in the end made the decision to use Progent.

Progent worked together with the customer to quickly identify and assign priority to the mission critical applications that had to be recovered in order to restart departmental operations:

• Windows Active Directory
• Microsoft Exchange Server
• MRP System

Within two days, Progent was able to restore Windows Active Directory to its pre-attack state. Progent then charged ahead with setup and hard drive recovery on the most important applications. All Microsoft Exchange Server ties and attributes were intact, which facilitated the restore of Exchange. Progent was also able to collect intact OST files (Microsoft Outlook Offline Folder Files) on various desktop computers and laptops in order to recover mail information. A recent offline backup of the customer's financials/MRP systems made them able to return these required services back servicing users. Although major work remained to recover completely from the Ryuk damage, essential systems were restored rapidly:

Over the following few weeks important milestones in the recovery project were made in tight collaboration between Progent engineers and the customer:

• Internal web applications were returned to operation without losing any data.
• The MailStore Server with over 4 million archived emails was restored to operations and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control capabilities were 100% restored.
• A new Palo Alto Networks 850 security appliance was installed.
• Most of the user desktops were being used by staff.

Conclusion
A possible business-ending disaster was evaded by results-oriented professionals, a wide spectrum of subject matter expertise, and close collaboration. Although upon completion of forensics the ransomware virus incident described here could have been blocked with advanced security solutions and ISO/IEC 27001 best practices, staff training, and appropriate security procedures for backup and proper patching controls, the fact remains that government-sponsored hackers from Russia, China and elsewhere are relentless and represent an ongoing threat. If you do get hit by a crypto-ransomware incident, feel confident that Progent's roster of professionals has proven experience in ransomware virus blocking, mitigation, and file restoration.

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Clearwater a variety of remote monitoring and security evaluation services designed to help you to reduce the threat from crypto-ransomware. These services utilize next-generation artificial intelligence capability to detect zero-day variants of ransomware that are able to evade legacy signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management techniques to keep your network running efficiently by tracking the state of vital computers that drive your information system. When ProSight LAN Watch detects an issue, an alarm is sent automatically to your specified IT personnel and your assigned Progent consultant so all potential issues can be addressed before they have a chance to impact your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for monitoring and managing your client-server infrastructure by providing an environment for performing common tedious tasks. These can include health checking, update management, automated remediation, endpoint setup, backup and recovery, A/V protection, remote access, standard and custom scripts, asset inventory, endpoint status reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it transmits an alert to your specified IT management personnel and your assigned Progent technical consultant so emerging issues can be taken care of before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to map out, monitor, optimize and troubleshoot their networking hardware like switches, firewalls, and access points as well as servers, endpoints and other devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch ensures that infrastructure topology maps are always current, copies and manages the configuration of virtually all devices connected to your network, monitors performance, and sends alerts when potential issues are detected. By automating complex management and troubleshooting processes, ProSight WAN Watch can cut hours off ordinary chores such as making network diagrams, reconfiguring your network, finding appliances that require critical updates, or isolating performance issues. Find out more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of in-depth reporting tools created to integrate with the industry's top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize critical issues like spotty support follow-up or endpoints with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup software companies to produce ProSight Data Protection Services (DPS), a family of subscription-based management offerings that provide backup-as-a-service (BaaS). ProSight DPS products automate and monitor your data backup operations and enable transparent backup and rapid restoration of important files, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned employees, or application bugs. Managed services in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Hybrid Backup. Your Progent service representative can assist you to identify which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading information security vendors to deliver centralized control and world-class security for your inbound and outbound email. The hybrid structure of Email Guard combines a Cloud Protection Layer with an on-premises security gateway appliance to offer complete protection against spam, viruses, Dos Attacks, DHAs, and other email-based threats. Email Guard's Cloud Protection Layer serves as a preliminary barricade and blocks the vast majority of threats from making it to your network firewall. This reduces your exposure to inbound attacks and saves system bandwidth and storage space. Email Guard's on-premises gateway appliance adds a deeper level of analysis for incoming email. For outgoing email, the onsite security gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The local security gateway can also help Exchange Server to track and protect internal email traffic that stays inside your corporate firewall. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA services incorporate Cisco's Duo technology to defend against password theft through the use of two-factor authentication (2FA). Duo supports one-tap identity confirmation on Apple iOS, Android, and other personal devices. Using 2FA, when you log into a secured online account and enter your password you are asked to verify your identity via a unit that only you have and that is accessed using a different network channel. A wide selection of devices can be used as this added means of ID validation such as a smartphone or watch, a hardware token, a landline telephone, etc. You may designate several validation devices. For details about Duo two-factor identity authentication services, refer to Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Center: Call Center Managed Services
  Progent's Support Desk services allow your information technology staff to outsource Call Center services to Progent or split activity for Help Desk services transparently between your internal support resources and Progent's extensive roster of certified IT service technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a smooth extension of your internal support resources. User interaction with the Help Desk, delivery of support, escalation, trouble ticket creation and tracking, performance metrics, and maintenance of the support database are consistent regardless of whether issues are taken care of by your corporate network support staff, by Progent, or by a combination. Find out more about Progent's outsourced/co-managed Call Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection solution that incorporates cutting edge behavior-based analysis tools to guard endpoint devices and servers and VMs against modern malware assaults like ransomware and email phishing, which routinely evade traditional signature-matching anti-virus tools. Progent ASM services safeguard local and cloud resources and offers a unified platform to address the entire threat progression including filtering, detection, mitigation, remediation, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against new attacks. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and protect information about your IT infrastructure, processes, applications, and services. You can quickly locate passwords or serial numbers and be alerted automatically about impending expirations of SSLs or domains. By cleaning up and managing your network documentation, you can save as much as 50% of time thrown away looking for critical information about your network. ProSight IT Asset Management features a common repository for holding and collaborating on all documents related to managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT data. Whether you're planning improvements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you need as soon as you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management provide organizations of any size a flexible and cost-effective solution for evaluating, testing, scheduling, implementing, and tracking updates to your ever-evolving IT network. Besides maximizing the security and reliability of your IT network, Progent's patch management services free up time for your in-house IT staff to concentrate on line-of-business initiatives and activities that deliver the highest business value from your information network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a secure fault tolerant data center on a high-performance virtual host configured and managed by Progent's network support professionals. Under the ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the applications. Since the system is virtualized, it can be moved easily to an alternate hosting environment without a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not tied one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior analysis tools to guard physical and virtual endpoint devices against new malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-matching anti-virus tools. ProSight ASM protects local and cloud-based resources and offers a unified platform to address the entire malware attack lifecycle including protection, infiltration detection, containment, remediation, and post-attack forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection managed services offer economical multi-layer security for physical servers and virtual machines, workstations, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and advanced heuristics for round-the-clock monitoring and responding to security threats from all attack vectors. ProSight ESP provides firewall protection, penetration alarms, endpoint management, and web filtering through cutting-edge technologies incorporated within a single agent managed from a single console. Progent's data protection and virtualization experts can help your business to plan and configure a ProSight ESP deployment that meets your organization's specific requirements and that helps you demonstrate compliance with legal and industry data protection regulations. Progent will help you define and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alarms that call for immediate attention. Progent's consultants can also assist you to set up and verify a backup and restore system such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange filtering.