24x7x365 Tucson Immediate Crypto
Malware Damage Assessment and Repair Help

Ransomware : Your Crippling IT Disaster
Ransomware has become a modern cyberplague that represents an enterprise-level threat for businesses of all sizes unprepared for an assault. Different versions of ransomware like the Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been around for years and still cause damage. Recent versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, along with daily unnamed viruses, not only do encryption of on-line data files but also infiltrate all configured system protection mechanisms. Data synchronized to cloud environments can also be held hostage. In a vulnerable system, it can make any recovery impossible and basically knocks the network back to zero.

Restoring applications and information following a ransomware intrusion becomes a sprint against the clock as the victim fights to contain, eradicate the virus, and restore mission-critical operations. Because ransomware requires time to move laterally, penetrations are frequently launched on weekends, when successful penetrations may take more time to uncover. This multiplies the difficulty of rapidly assembling and coordinating a knowledgeable mitigation team.

Progent makes available a range of services for protecting businesses from crypto-ransomware events. These include user education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of the latest generation security appliances with machine learning capabilities from SentinelOne to detect and disable new threats automatically. Progent in addition provides the services of expert ransomware recovery consultants with the track record and commitment to rebuild a breached network as rapidly as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the codes to decrypt all your files. Kaspersky estimated that 17% of crypto-ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to setup from scratch the critical elements of your IT environment. Without access to complete data backups, this calls for a broad range of skills, top notch team management, and the willingness to work continuously until the task is complete.

For two decades, Progent has provided expert Information Technology services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have attained high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in accounting and ERP applications. This breadth of expertise affords Progent the capability to knowledgably ascertain important systems and integrate the surviving pieces of your Information Technology environment after a crypto-ransomware penetration and configure them into a functioning network.

Progent's security group uses state-of-the-art project management applications to coordinate the complex restoration process. Progent appreciates the urgency of working quickly and together with a customer's management and Information Technology staff to prioritize tasks and to put essential services back on line as fast as humanly possible.

Customer Story: A Successful Crypto-Ransomware Attack Restoration
A client engaged Progent after their network system was brought down by the Ryuk ransomware. Ryuk is believed to have been created by Northern Korean state hackers, suspected of adopting algorithms exposed from the United States National Security Agency. Ryuk targets specific businesses with little or no tolerance for disruption and is one of the most lucrative iterations of crypto-ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer located in Chicago with around 500 staff members. The Ryuk attack had disabled all essential operations and manufacturing processes. Most of the client's information backups had been online at the time of the attack and were damaged. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and hoping for good luck, but in the end called Progent.

Progent worked together with the customer to quickly identify and prioritize the essential systems that needed to be restored to make it possible to restart business functions:

• Windows Active Directory
• Electronic Messaging
• MRP System

In less than 2 days, Progent was able to restore Active Directory to its pre-attack state. Progent then accomplished setup and hard drive recovery of critical applications. All Exchange Server schema and attributes were intact, which facilitated the restore of Exchange. Progent was able to assemble intact OST files (Microsoft Outlook Offline Folder Files) on staff workstations to recover email data. A recent offline backup of the client's accounting/ERP software made them able to recover these required services back servicing users. Although a lot of work needed to be completed to recover completely from the Ryuk virus, core services were recovered rapidly:

During the next few weeks key milestones in the restoration project were accomplished in close cooperation between Progent consultants and the customer:

• Self-hosted web sites were brought back up with no loss of information.
• The MailStore Microsoft Exchange Server containing more than 4 million archived messages was spun up and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory Control capabilities were 100 percent functional.
• A new Palo Alto 850 security appliance was installed and configured.
• 90% of the desktops and laptops were functioning as before the incident.

Conclusion
A likely company-ending catastrophe was evaded through the efforts of results-oriented experts, a broad spectrum of technical expertise, and close collaboration. Although in retrospect the ransomware virus attack described here could have been identified and disabled with advanced security technology and recognized best practices, team training, and properly executed incident response procedures for information protection and proper patching controls, the fact is that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware incursion, feel confident that Progent's team of professionals has proven experience in crypto-ransomware virus blocking, cleanup, and information systems restoration.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers businesses in Tucson a range of remote monitoring and security assessment services to assist you to minimize your vulnerability to crypto-ransomware. These services utilize modern machine learning capability to detect zero-day variants of ransomware that are able to escape detection by legacy signature-based security solutions.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to help keep your IT system operating efficiently by checking the health of vital assets that drive your information system. When ProSight LAN Watch detects a problem, an alert is transmitted immediately to your designated IT management staff and your assigned Progent engineering consultant so any looming problems can be resolved before they have a chance to disrupt your network. Learn more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven platform for monitoring and managing your client-server infrastructure by offering an environment for performing common time-consuming tasks. These include health monitoring, update management, automated remediation, endpoint setup, backup and recovery, anti-virus defense, remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alert to your specified IT management personnel and your Progent consultant so that potential problems can be taken care of before they impact productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for smaller organizations to map, monitor, enhance and troubleshoot their connectivity hardware such as routers, firewalls, and access points as well as servers, client computers and other networked devices. Using cutting-edge RMM technology, ProSight WAN Watch makes sure that infrastructure topology diagrams are always current, copies and displays the configuration information of almost all devices connected to your network, monitors performance, and generates alerts when problems are detected. By automating time-consuming network management activities, ProSight WAN Watch can cut hours off common chores such as network mapping, expanding your network, locating appliances that need important software patches, or resolving performance problems. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time management reporting tools designed to work with the top ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues like inconsistent support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software providers to produce ProSight Data Protection Services (DPS), a family of subscription-based management offerings that provide backup-as-a-service. ProSight DPS products manage and track your data backup processes and enable transparent backup and rapid restoration of important files, applications, images, plus Hyper-V and VMware virtual machines. ProSight DPS helps you avoid data loss resulting from equipment breakdown, natural disasters, fire, malware such as ransomware, user mistakes, malicious insiders, or software bugs. Managed services in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to identify which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading data security companies to deliver web-based control and comprehensive security for all your email traffic. The powerful structure of Progent's Email Guard integrates a Cloud Protection Layer with a local security gateway appliance to provide complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The Cloud Protection Layer acts as a preliminary barricade and keeps most unwanted email from reaching your security perimeter. This reduces your vulnerability to inbound attacks and conserves system bandwidth and storage space. Email Guard's onsite security gateway appliance adds a deeper layer of inspection for inbound email. For outbound email, the local gateway provides AV and anti-spam protection, protection against data leaks, and email encryption. The on-premises gateway can also help Microsoft Exchange Server to track and protect internal email traffic that originates and ends within your corporate firewall. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA services utilize Cisco's Duo technology to protect against compromised passwords by using two-factor authentication (2FA). Duo enables single-tap identity verification on iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you log into a secured application and enter your password you are requested to confirm who you are on a device that only you have and that uses a separate network channel. A broad range of devices can be utilized as this added means of ID validation such as a smartphone or watch, a hardware token, a landline phone, etc. You can register multiple validation devices. To learn more about ProSight Duo identity validation services, see Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Desk: Support Desk Managed Services
  Progent's Support Desk services allow your information technology team to outsource Call Center services to Progent or split activity for support services seamlessly between your internal network support team and Progent's nationwide roster of IT service engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a seamless supplement to your core IT support staff. Client interaction with the Help Desk, provision of support, problem escalation, ticket generation and updates, efficiency metrics, and maintenance of the support database are consistent whether issues are taken care of by your corporate network support staff, by Progent, or by a combination. Learn more about Progent's outsourced/shared Service Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior-based analysis technology to defend endpoint devices and physical and virtual servers against modern malware assaults like ransomware and email phishing, which routinely evade legacy signature-matching anti-virus products. Progent ASM services protect local and cloud-based resources and offers a single platform to manage the complete malware attack lifecycle including blocking, detection, containment, remediation, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered attacks. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, update, retrieve and safeguard data related to your network infrastructure, processes, business apps, and services. You can instantly find passwords or serial numbers and be alerted automatically about upcoming expirations of SSLs or domains. By updating and managing your IT documentation, you can save as much as half of time thrown away trying to find critical information about your IT network. ProSight IT Asset Management includes a common location for storing and sharing all documents related to managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and associating IT information. Whether you're making enhancements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you need as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for patch management provide organizations of any size a flexible and cost-effective solution for evaluating, validating, scheduling, applying, and documenting software and firmware updates to your dynamic IT network. Besides optimizing the protection and reliability of your computer network, Progent's software/firmware update management services allow your in-house IT staff to focus on line-of-business projects and activities that derive maximum business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a protected fault tolerant data center on a fast virtual machine host configured and managed by Progent's network support professionals. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the apps. Since the system is virtualized, it can be ported immediately to an alternate hosting environment without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior-based analysis tools to defend physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which routinely escape traditional signature-based anti-virus products. ProSight ASM safeguards local and cloud resources and provides a single platform to manage the entire threat lifecycle including blocking, detection, mitigation, remediation, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer affordable in-depth security for physical and virtual servers, desktops, mobile devices, and Exchange email. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to cyber threats from all vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, endpoint control, and web filtering through cutting-edge tools incorporated within a single agent accessible from a single control. Progent's data protection and virtualization experts can help you to plan and implement a ProSight ESP deployment that addresses your organization's specific requirements and that allows you demonstrate compliance with government and industry information security regulations. Progent will assist you define and configure policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that require urgent action. Progent can also help you to set up and verify a backup and disaster recovery system such as ProSight Data Protection Services so you can recover quickly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange email filtering.