24x7x365 Scottsdale Urgent Crypto
Malware Identification and Removal Experts

Crypto-Ransomware : Your Worst Information Technology Catastrophe
Ransomware has become an escalating cyberplague that presents an enterprise-level danger for organizations unprepared for an assault. Different iterations of ransomware like the CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been circulating for years and continue to inflict damage. The latest strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Egregor, plus more as yet unnamed viruses, not only encrypt online files but also infiltrate all available system backups. Information replicated to the cloud can also be ransomed. In a vulnerable system, this can make any restoration useless and effectively sets the entire system back to square one.

Getting back online applications and information after a ransomware attack becomes a race against the clock as the targeted organization tries its best to contain, eradicate the crypto-ransomware, and resume mission-critical operations. Due to the fact that crypto-ransomware requires time to spread, attacks are frequently launched on weekends and holidays, when successful penetrations tend to take more time to uncover. This compounds the difficulty of promptly marshalling and organizing a capable mitigation team.

Progent makes available a variety of services for protecting enterprises from crypto-ransomware events. These include staff training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of the latest generation security gateways with AI technology from SentinelOne to identify and suppress new cyber threats automatically. Progent in addition provides the assistance of expert crypto-ransomware recovery professionals with the talent and perseverance to re-deploy a compromised environment as quickly as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that criminal gangs will return the codes to decrypt any or all of your information. Kaspersky estimated that seventeen percent of ransomware victims never recovered their data after having paid the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to piece back together the critical elements of your IT environment. Without access to full data backups, this calls for a wide complement of skill sets, professional team management, and the capability to work continuously until the job is complete.

For decades, Progent has offered expert Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have earned high-level certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in financial management and ERP software solutions. This breadth of expertise affords Progent the ability to quickly understand important systems and integrate the surviving parts of your network environment following a ransomware penetration and assemble them into a functioning system.

Progent's recovery team uses top notch project management tools to coordinate the sophisticated recovery process. Progent appreciates the importance of acting rapidly and in unison with a customer's management and Information Technology team members to prioritize tasks and to put key services back on-line as fast as possible.

Business Case Study: A Successful Ransomware Virus Response
A client contacted Progent after their network system was penetrated by the Ryuk ransomware. Ryuk is believed to have been deployed by Northern Korean state cybercriminals, possibly adopting strategies leaked from the United States NSA organization. Ryuk attacks specific businesses with little room for disruption and is one of the most profitable versions of ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturer located in Chicago and has around 500 employees. The Ryuk intrusion had brought down all business operations and manufacturing processes. The majority of the client's data protection had been directly accessible at the beginning of the attack and were damaged. The client considered paying the ransom (more than two hundred thousand dollars) and wishfully thinking for good luck, but in the end engaged Progent.

Progent worked hand in hand the customer to rapidly understand and prioritize the most important applications that needed to be restored in order to restart company operations:

• Windows Active Directory
• Microsoft Exchange Server
• MRP System

In less than two days, Progent was able to re-build Active Directory to its pre-attack state. Progent then performed setup and hard drive recovery on key systems. All Exchange Server ties and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to find intact OST data files (Microsoft Outlook Offline Folder Files) on team PCs and laptops in order to recover mail information. A not too old off-line backup of the customer's accounting systems made it possible to restore these vital services back available to users. Although major work needed to be completed to recover fully from the Ryuk virus, essential services were recovered rapidly:

Over the next few weeks important milestones in the restoration process were made in tight collaboration between Progent team members and the customer:

• Self-hosted web sites were returned to operation without losing any data.
• The MailStore Exchange Server containing more than 4 million historical messages was spun up and available for users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control capabilities were 100% operational.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Ninety percent of the user desktops and notebooks were back into operation.

Conclusion
A probable enterprise-killing disaster was evaded by results-oriented experts, a broad range of IT skills, and close collaboration. Although in hindsight the ransomware attack described here would have been shut down with advanced security technology solutions and recognized best practices, team training, and well designed incident response procedures for data backup and proper patching controls, the reality is that government-sponsored cyber criminals from Russia, China and elsewhere are relentless and are not going away. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has a proven track record in ransomware virus blocking, mitigation, and data restoration.

To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Scottsdale a variety of online monitoring and security evaluation services designed to help you to reduce the threat from crypto-ransomware. These services include modern artificial intelligence capability to detect new strains of ransomware that can escape detection by traditional signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses state-of-the-art remote monitoring and management techniques to keep your IT system running efficiently by checking the state of critical computers that drive your business network. When ProSight LAN Watch detects an issue, an alert is sent immediately to your specified IT staff and your Progent consultant so any potential issues can be addressed before they can impact productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven solution for managing your client-server infrastructure by offering an environment for streamlining common time-consuming tasks. These include health checking, update management, automated remediation, endpoint deployment, backup and recovery, anti-virus defense, secure remote access, standard and custom scripts, asset inventory, endpoint status reporting, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your specified IT personnel and your assigned Progent consultant so emerging problems can be fixed before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for smaller organizations to map, track, reconfigure and debug their networking appliances like routers, firewalls, and access points plus servers, printers, endpoints and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology maps are kept current, captures and displays the configuration information of virtually all devices on your network, tracks performance, and sends notices when potential issues are discovered. By automating complex management and troubleshooting processes, ProSight WAN Watch can knock hours off common chores such as making network diagrams, reconfiguring your network, locating appliances that need important software patches, or identifying the cause of performance problems. Learn more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding family of real-time reporting tools created to work with the industry's leading ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues such as spotty support follow-through or machines with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with leading backup technology providers to create ProSight Data Protection Services (DPS), a selection of management offerings that deliver backup-as-a-service. ProSight DPS products automate and track your data backup operations and allow transparent backup and rapid recovery of vital files/folders, applications, images, plus VMs. ProSight DPS lets your business avoid data loss resulting from equipment failures, natural disasters, fire, malware like ransomware, user mistakes, ill-intentioned employees, or application bugs. Managed services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can help you to identify which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading data security vendors to provide centralized management and comprehensive protection for your email traffic. The powerful architecture of Progent's Email Guard managed service integrates cloud-based filtering with an on-premises security gateway appliance to provide complete protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The Cloud Protection Layer serves as a preliminary barricade and blocks most unwanted email from reaching your network firewall. This reduces your vulnerability to inbound threats and saves network bandwidth and storage. Email Guard's on-premises gateway device adds a further layer of analysis for incoming email. For outbound email, the onsite security gateway provides AV and anti-spam protection, DLP, and email encryption. The onsite gateway can also assist Exchange Server to track and safeguard internal email that stays within your security perimeter. For more information, see Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication services incorporate Cisco's Duo technology to defend against compromised passwords through the use of two-factor authentication. Duo supports one-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. Using Duo 2FA, whenever you sign into a secured online account and enter your password you are requested to verify your identity on a unit that only you have and that uses a separate network channel. A wide selection of out-of-band devices can be utilized for this second means of ID validation including a smartphone or watch, a hardware token, a landline phone, etc. You may designate several validation devices. To find out more about Duo identity validation services, visit Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Help Desk managed services permit your IT team to offload Support Desk services to Progent or split responsibilities for Help Desk services seamlessly between your in-house support staff and Progent's extensive pool of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a seamless supplement to your corporate IT support resources. End user access to the Help Desk, delivery of technical assistance, escalation, trouble ticket generation and tracking, efficiency metrics, and maintenance of the service database are cohesive whether issues are taken care of by your in-house IT support group, by Progent's team, or both. Learn more about Progent's outsourced/shared Service Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that utilizes next generation behavior machine learning technology to guard endpoints and servers and VMs against modern malware attacks such as ransomware and file-less exploits, which easily escape legacy signature-matching AV tools. Progent Active Security Monitoring services safeguard local and cloud-based resources and provides a unified platform to manage the complete malware attack progression including protection, infiltration detection, mitigation, remediation, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against new threats. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, retrieve and protect data related to your IT infrastructure, procedures, applications, and services. You can quickly find passwords or IP addresses and be warned about upcoming expirations of SSL certificates or domains. By updating and managing your IT infrastructure documentation, you can save up to half of time spent trying to find vital information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and collaborating on all documents required for managing your business network like recommended procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT data. Whether you're making enhancements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you need when you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of all sizes a versatile and affordable solution for assessing, testing, scheduling, applying, and tracking software and firmware updates to your dynamic information network. In addition to maximizing the security and reliability of your IT network, Progent's software/firmware update management services allow your in-house IT staff to focus on more strategic projects and activities that derive maximum business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a secure fault tolerant data center on a fast virtual host set up and managed by Progent's IT support experts. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the apps. Because the system is virtualized, it can be ported immediately to an alternate hardware solution without requiring a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's next generation behavior analysis tools to guard physical and virtual endpoints against modern malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-matching AV products. ProSight Active Security Monitoring protects on-premises and cloud-based resources and offers a single platform to automate the entire threat lifecycle including blocking, identification, containment, cleanup, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services offer economical in-depth security for physical servers and VMs, workstations, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and responding to cyber threats from all attack vectors. ProSight ESP offers two-way firewall protection, intrusion alerts, device control, and web filtering via leading-edge technologies incorporated within a single agent accessible from a single console. Progent's data protection and virtualization experts can assist you to design and implement a ProSight ESP environment that addresses your organization's specific requirements and that helps you demonstrate compliance with legal and industry data security regulations. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that require urgent attention. Progent's consultants can also help your company to set up and test a backup and disaster recovery solution such as ProSight Data Protection Services so you can recover rapidly from a destructive security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange filtering.