24/7 Scottsdale Immediate Ransomware
Computer Malware Identification and Recovery Help

Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a modern cyberplague that represents an existential danger for organizations unprepared for an attack. Versions of ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for years and continue to cause damage. Modern strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, plus additional unnamed newcomers, not only do encryption of on-line data files but also infect most accessible system backup. Files replicated to off-site disaster recovery sites can also be corrupted. In a poorly architected system, this can make automatic restoration impossible and basically sets the datacenter back to square one.

Getting back online services and data following a ransomware intrusion becomes a race against time as the targeted business fights to contain, eradicate the crypto-ransomware, and resume business-critical activity. Because ransomware takes time to replicate, attacks are frequently launched at night, when successful penetrations typically take more time to discover. This multiplies the difficulty of quickly mobilizing and coordinating a qualified response team.

Progent has a range of services for protecting organizations from ransomware penetrations. These include staff education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of next-generation security appliances with AI technology from SentinelOne to identify and quarantine new threats rapidly. Progent also can provide the services of experienced ransomware recovery engineers with the talent and commitment to rebuild a compromised environment as rapidly as possible.

Progent's Ransomware Restoration Help
Following a ransomware penetration, paying the ransom demands in cryptocurrency does not ensure that criminal gangs will respond with the codes to unencrypt any of your information. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never restored their information even after having paid the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to setup from scratch the vital components of your Information Technology environment. Without access to essential data backups, this calls for a wide complement of skill sets, top notch project management, and the capability to work non-stop until the job is over.

For decades, Progent has made available professional Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded advanced industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of expertise provides Progent the capability to quickly ascertain critical systems and consolidate the remaining parts of your Information Technology system following a ransomware penetration and rebuild them into a functioning network.

Progent's recovery group deploys state-of-the-art project management applications to orchestrate the complicated recovery process. Progent knows the importance of working swiftly and in concert with a client's management and Information Technology resources to assign priority to tasks and to put critical systems back on-line as fast as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Attack Response
A client contacted Progent after their network system was taken over by Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean state hackers, suspected of using approaches leaked from the United States NSA organization. Ryuk seeks specific organizations with little ability to sustain operational disruption and is one of the most lucrative examples of ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had frozen all essential operations and manufacturing processes. The majority of the client's backups had been online at the time of the attack and were destroyed. The client was pursuing financing for paying the ransom demand (exceeding $200K) and praying for the best, but in the end reached out to Progent.

Progent worked together with the client to rapidly assess and prioritize the critical systems that had to be recovered to make it possible to restart business functions:

• Active Directory
• Exchange Server
• Financials/MRP

In less than two days, Progent was able to restore Windows Active Directory to its pre-penetration state. Progent then assisted with rebuilding and hard drive recovery of the most important applications. All Microsoft Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to collect intact OST data files (Microsoft Outlook Offline Folder Files) on staff desktop computers and laptops in order to recover email information. A not too old offline backup of the customer's accounting software made them able to return these essential programs back online. Although a lot of work still had to be done to recover totally from the Ryuk damage, the most important services were returned to operations rapidly:

Over the following few weeks important milestones in the restoration process were made through close collaboration between Progent engineers and the customer:

• In-house web applications were returned to operation with no loss of data.
• The MailStore Exchange Server containing more than 4 million historical messages was brought on-line and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control capabilities were 100 percent operational.
• A new Palo Alto Networks 850 security appliance was deployed.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A probable company-ending disaster was dodged due to top-tier experts, a wide spectrum of subject matter expertise, and tight collaboration. Although in post mortem the ransomware incident described here should have been stopped with advanced security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and appropriate incident response procedures for backup and proper patching controls, the reality is that state-sponsored hackers from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware attack, remember that Progent's roster of professionals has extensive experience in crypto-ransomware virus blocking, removal, and data restoration.

To review or download a PDF version of this customer case study, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide businesses in Scottsdale a variety of online monitoring and security evaluation services to help you to minimize your vulnerability to ransomware. These services utilize next-generation machine learning capability to detect new variants of ransomware that are able to evade traditional signature-based security products.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that uses advanced remote monitoring and management (RMM) technology to keep your network running efficiently by checking the health of vital computers that drive your business network. When ProSight LAN Watch detects a problem, an alarm is sent automatically to your specified IT management personnel and your assigned Progent consultant so that any looming issues can be addressed before they can disrupt productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven platform for monitoring and managing your client-server infrastructure by providing an environment for streamlining common time-consuming jobs. These include health monitoring, patch management, automated remediation, endpoint setup, backup and recovery, anti-virus defense, remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alert to your designated IT personnel and your Progent technical consultant so potential issues can be fixed before they impact productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for smaller businesses to map, monitor, enhance and troubleshoot their networking hardware like routers, firewalls, and wireless controllers plus servers, client computers and other networked devices. Using cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch ensures that network diagrams are kept updated, captures and displays the configuration of almost all devices connected to your network, monitors performance, and sends notices when problems are discovered. By automating complex management activities, WAN Watch can knock hours off ordinary chores such as making network diagrams, expanding your network, finding devices that need important updates, or isolating performance bottlenecks. Learn more details about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time management reporting tools designed to work with the top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues like inconsistent support follow-up or machines with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore software providers to create ProSight Data Protection Services (DPS), a family of subscription-based management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS services manage and monitor your backup operations and allow transparent backup and fast recovery of critical files/folders, applications, system images, and virtual machines. ProSight DPS lets you recover from data loss resulting from equipment breakdown, natural calamities, fire, cyber attacks like ransomware, human mistakes, malicious employees, or software bugs. Managed services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can help you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of leading information security vendors to deliver centralized management and comprehensive protection for your inbound and outbound email. The powerful architecture of Progent's Email Guard combines a Cloud Protection Layer with an on-premises security gateway device to provide advanced protection against spam, viruses, Dos Attacks, DHAs, and other email-borne malware. Email Guard's cloud filter acts as a first line of defense and blocks the vast majority of unwanted email from reaching your network firewall. This reduces your exposure to inbound attacks and saves system bandwidth and storage. Email Guard's on-premises gateway appliance adds a further layer of inspection for incoming email. For outgoing email, the on-premises security gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The local security gateway can also assist Exchange Server to monitor and safeguard internal email that originates and ends within your corporate firewall. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans utilize Cisco's Duo cloud technology to defend against compromised passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity verification with Apple iOS, Google Android, and other out-of-band devices. Using 2FA, when you sign into a protected online account and enter your password you are asked to verify who you are via a unit that only you possess and that is accessed using a separate network channel. A broad selection of devices can be utilized for this added form of ID validation such as an iPhone or Android or wearable, a hardware token, a landline phone, etc. You may designate multiple verification devices. To find out more about Duo identity validation services, visit Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Help Desk: Call Center Managed Services
  Progent's Support Center managed services allow your information technology team to outsource Call Center services to Progent or split activity for support services transparently between your internal support staff and Progent's nationwide roster of certified IT support engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a seamless supplement to your internal support staff. Client access to the Help Desk, provision of support, issue escalation, ticket generation and tracking, performance metrics, and management of the support database are consistent whether incidents are taken care of by your corporate network support group, by Progent's team, or both. Find out more about Progent's outsourced/shared Service Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior analysis technology to guard endpoints and servers and VMs against modern malware assaults such as ransomware and email phishing, which easily evade legacy signature-based anti-virus products. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and provides a single platform to address the entire threat progression including protection, identification, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows VSS and automatic system-wide immunization against newly discovered threats. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, find and protect data about your IT infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be alerted about upcoming expirations of SSLs or domains. By updating and organizing your IT infrastructure documentation, you can save up to 50% of time spent looking for vital information about your network. ProSight IT Asset Management features a common location for holding and sharing all documents required for managing your network infrastructure like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and relating IT information. Whether you're making improvements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the knowledge you require the instant you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a versatile and cost-effective alternative for assessing, testing, scheduling, implementing, and documenting updates to your ever-evolving IT network. In addition to maximizing the security and functionality of your computer network, Progent's software/firmware update management services permit your in-house IT staff to focus on more strategic projects and activities that deliver maximum business value from your network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and applications hosted in a protected fault tolerant data center on a high-performance virtual host configured and maintained by Progent's IT support experts. Under the ProSight Virtual Hosting service model, the client retains ownership of the data, the operating system platforms, and the applications. Because the environment is virtualized, it can be moved easily to an alternate hardware solution without requiring a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior-based analysis tools to guard physical and virtual endpoint devices against new malware assaults such as ransomware and file-less exploits, which routinely evade legacy signature-based AV tools. ProSight ASM safeguards local and cloud-based resources and offers a unified platform to manage the complete threat lifecycle including blocking, identification, containment, cleanup, and forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer economical in-depth protection for physical servers and VMs, workstations, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and reacting to security threats from all vectors. ProSight ESP offers two-way firewall protection, penetration alerts, device management, and web filtering through cutting-edge technologies packaged within one agent managed from a unified console. Progent's data protection and virtualization consultants can assist you to design and implement a ProSight ESP deployment that meets your company's specific requirements and that helps you demonstrate compliance with legal and industry data security standards. Progent will assist you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that require immediate action. Progent can also assist your company to install and test a backup and restore system like ProSight Data Protection Services so you can get back in business quickly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange filtering.