Santiago 24-7 Urgent Crypto-Ransomware
Virus Assessment and Repair Consultants

Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level danger for organizations unprepared for an assault. Multiple generations of ransomware like the CryptoLocker, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for many years and still inflict destruction. Recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, plus daily as yet unnamed viruses, not only encrypt on-line data files but also infect all available system protection. Files replicated to cloud environments can also be held hostage. In a poorly architected system, it can render automatic restoration hopeless and effectively sets the datacenter back to zero.

Getting back online services and data after a crypto-ransomware intrusion becomes a race against the clock as the targeted organization tries its best to stop lateral movement, eradicate the virus, and resume mission-critical activity. Due to the fact that ransomware takes time to spread, attacks are usually sprung on weekends and holidays, when penetrations may take more time to discover. This compounds the difficulty of promptly mobilizing and coordinating a qualified response team.

Progent offers a range of solutions for securing businesses from ransomware events. Among these are user training to help identify and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus setup and configuration of next-generation security gateways with machine learning capabilities from SentinelOne to discover and extinguish zero-day threats intelligently. Progent in addition can provide the services of veteran ransomware recovery professionals with the talent and commitment to rebuild a compromised network as soon as possible.

Progent's Ransomware Recovery Help
After a ransomware attack, paying the ransom in cryptocurrency does not guarantee that criminal gangs will provide the needed codes to unencrypt any or all of your information. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to re-install the vital components of your Information Technology environment. Absent the availability of complete system backups, this calls for a wide range of skill sets, professional project management, and the ability to work non-stop until the job is completed.

For two decades, Progent has provided professional IT services for businesses throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have earned advanced certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise in financial management and ERP software solutions. This breadth of experience affords Progent the capability to quickly ascertain important systems and organize the remaining pieces of your Information Technology system following a ransomware event and configure them into an operational system.

Progent's security team of experts deploys top notch project management applications to orchestrate the sophisticated restoration process. Progent understands the urgency of acting quickly and in concert with a customer's management and Information Technology resources to prioritize tasks and to get critical systems back on line as soon as possible.

Case Study: A Successful Ransomware Penetration Restoration
A small business escalated to Progent after their company was brought down by the Ryuk ransomware. Ryuk is believed to have been deployed by North Korean government sponsored hackers, possibly adopting strategies exposed from America's National Security Agency. Ryuk targets specific organizations with little ability to sustain disruption and is among the most profitable incarnations of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in Chicago and has around 500 workers. The Ryuk penetration had disabled all business operations and manufacturing processes. Most of the client's system backups had been online at the beginning of the intrusion and were eventually encrypted. The client was pursuing financing for paying the ransom demand (exceeding $200,000) and wishfully thinking for good luck, but in the end called Progent.

Progent worked with the client to rapidly assess and prioritize the essential applications that had to be addressed in order to resume business functions:

• Microsoft Active Directory
• Electronic Messaging
• Financials/MRP

Within two days, Progent was able to rebuild Active Directory to its pre-attack state. Progent then performed reinstallations and hard drive recovery of needed applications. All Microsoft Exchange Server data and attributes were usable, which facilitated the rebuild of Exchange. Progent was able to collect non-encrypted OST data files (Outlook Offline Folder Files) on staff desktop computers to recover email messages. A recent off-line backup of the businesses accounting systems made it possible to recover these required services back available to users. Although major work remained to recover totally from the Ryuk event, the most important systems were recovered quickly:

Throughout the next few weeks important milestones in the restoration project were completed in tight cooperation between Progent team members and the customer:

• In-house web sites were returned to operation with no loss of data.
• The MailStore Microsoft Exchange Server exceeding 4 million archived emails was brought on-line and available for users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory modules were fully recovered.
• A new Palo Alto Networks 850 firewall was installed and configured.
• 90% of the user PCs were fully operational.

Conclusion
A potential enterprise-killing catastrophe was avoided through the efforts of dedicated experts, a broad spectrum of subject matter expertise, and close collaboration. Although in post mortem the crypto-ransomware virus attack detailed here should have been identified and disabled with advanced security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and properly executed security procedures for data protection and keeping systems up to date with security patches, the fact is that state-sponsored hackers from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware attack, feel confident that Progent's team of experts has substantial experience in ransomware virus blocking, cleanup, and data restoration.

To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers businesses in Santiago a variety of online monitoring and security assessment services to assist you to reduce the threat from crypto-ransomware. These services incorporate next-generation AI capability to detect new variants of ransomware that can evade traditional signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management techniques to help keep your IT system operating at peak levels by tracking the state of critical assets that power your information system. When ProSight LAN Watch detects a problem, an alert is transmitted automatically to your specified IT management personnel and your assigned Progent consultant so that any potential problems can be resolved before they have a chance to disrupt your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for monitoring and managing your client-server infrastructure by offering tools for performing common time-consuming tasks. These can include health monitoring, update management, automated repairs, endpoint setup, backup and recovery, A/V response, secure remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alert to your designated IT personnel and your Progent technical consultant so that emerging problems can be taken care of before they interfere with productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for smaller businesses to map out, track, reconfigure and debug their networking hardware like switches, firewalls, and wireless controllers as well as servers, endpoints and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology maps are kept current, copies and manages the configuration information of virtually all devices on your network, monitors performance, and generates notices when potential issues are detected. By automating time-consuming network management activities, ProSight WAN Watch can knock hours off common chores like network mapping, reconfiguring your network, locating appliances that require important software patches, or isolating performance bottlenecks. Find out more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of real-time and in-depth reporting plug-ins designed to integrate with the top ticketing and network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues like spotty support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has partnered with advanced backup/restore technology companies to produce ProSight Data Protection Services (DPS), a portfolio of management offerings that provide backup-as-a-service. ProSight DPS services manage and monitor your backup operations and enable transparent backup and fast restoration of critical files/folders, apps, images, plus virtual machines. ProSight DPS helps you recover from data loss caused by hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, user error, ill-intentioned insiders, or application bugs. Managed services in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the infrastructure of leading data security vendors to deliver web-based management and comprehensive security for all your email traffic. The hybrid architecture of Progent's Email Guard combines a Cloud Protection Layer with an on-premises gateway appliance to offer advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-based malware. The cloud filter serves as a preliminary barricade and keeps the vast majority of threats from reaching your network firewall. This reduces your vulnerability to external attacks and conserves network bandwidth and storage space. Email Guard's on-premises gateway appliance provides a deeper level of analysis for inbound email. For outgoing email, the on-premises security gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also help Exchange Server to track and protect internal email traffic that stays inside your security perimeter. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on (SSO)
  Progent's Duo MFA managed services utilize Cisco's Duo cloud technology to protect against password theft by using two-factor authentication. Duo supports one-tap identity confirmation with Apple iOS, Android, and other out-of-band devices. Using 2FA, when you log into a protected application and enter your password you are requested to verify your identity via a device that only you have and that uses a separate network channel. A broad range of devices can be used for this second means of ID validation such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can designate multiple verification devices. For details about ProSight Duo identity authentication services, refer to Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Call Desk services permit your IT group to outsource Call Center services to Progent or divide responsibilities for support services seamlessly between your internal support group and Progent's extensive pool of certified IT service technicians, engineers and subject matter experts. Progent's Shared Service Desk provides a seamless extension of your internal IT support group. End user access to the Service Desk, provision of technical assistance, problem escalation, ticket creation and tracking, performance metrics, and maintenance of the support database are cohesive whether incidents are resolved by your corporate IT support resources, by Progent, or both. Learn more about Progent's outsourced/shared Service Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates next generation behavior-based machine learning tools to guard endpoints as well as physical and virtual servers against new malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-based anti-virus products. Progent ASM services safeguard on-premises and cloud-based resources and provides a unified platform to address the complete malware attack progression including blocking, infiltration detection, mitigation, remediation, and post-attack forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered attacks. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, retrieve and safeguard information about your network infrastructure, procedures, applications, and services. You can quickly locate passwords or serial numbers and be alerted about impending expirations of SSLs or warranties. By cleaning up and organizing your IT documentation, you can save as much as 50% of time thrown away looking for vital information about your IT network. ProSight IT Asset Management includes a common repository for storing and sharing all documents related to managing your business network like standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and associating IT data. Whether you're planning improvements, performing regular maintenance, or responding to an emergency, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for software and firmware patch management provide organizations of all sizes a versatile and affordable alternative for assessing, testing, scheduling, implementing, and tracking software and firmware updates to your ever-evolving information system. Besides maximizing the security and functionality of your computer environment, Progent's software/firmware update management services free up time for your IT team to focus on more strategic initiatives and activities that deliver the highest business value from your information network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a protected fault tolerant data center on a high-performance virtual host configured and maintained by Progent's network support experts. Under Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the OS software, and the applications. Since the system is virtualized, it can be ported immediately to a different hardware environment without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoints against new malware assaults such as ransomware and email phishing, which routinely evade traditional signature-based anti-virus tools. ProSight ASM protects local and cloud-based resources and offers a single platform to address the entire threat lifecycle including protection, identification, containment, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection services deliver affordable in-depth protection for physical servers and virtual machines, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and responding to security threats from all vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, endpoint control, and web filtering through cutting-edge technologies incorporated within one agent managed from a unified control. Progent's security and virtualization consultants can assist your business to plan and configure a ProSight ESP deployment that addresses your organization's specific requirements and that helps you demonstrate compliance with government and industry data security standards. Progent will help you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that require urgent attention. Progent can also help your company to install and test a backup and restore solution such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange filtering.