24-7 Ribeirão Preto Emergency Crypto
Computer Malware Identification and Removal Experts

Crypto-Ransomware : Your Worst IT Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level threat for organizations unprepared for an attack. Different iterations of crypto-ransomware like the CrySIS, WannaCry, Locky, SamSam and MongoLock cryptoworms have been running rampant for a long time and still cause destruction. Recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with more as yet unnamed malware, not only encrypt on-line files but also infiltrate any available system protection. Data synchronized to off-site disaster recovery sites can also be held hostage. In a poorly designed environment, this can make automated recovery hopeless and effectively knocks the network back to square one.

Retrieving services and data after a ransomware intrusion becomes a sprint against time as the victim tries its best to stop lateral movement, cleanup the virus, and restore business-critical operations. Due to the fact that ransomware needs time to move laterally, attacks are usually sprung during weekends and nights, when penetrations typically take more time to detect. This compounds the difficulty of rapidly marshalling and coordinating a capable response team.

Progent provides a range of solutions for securing businesses from ransomware attacks. Among these are team education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of the latest generation security solutions with artificial intelligence technology from SentinelOne to identify and extinguish new threats quickly. Progent also offers the assistance of experienced ransomware recovery professionals with the talent and perseverance to rebuild a compromised system as soon as possible.

Progent's Ransomware Restoration Support Services
Soon after a crypto-ransomware invasion, paying the ransom demands in cryptocurrency does not ensure that criminal gangs will provide the needed codes to unencrypt any or all of your data. Kaspersky determined that 17% of ransomware victims never recovered their data even after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can be in the millions. The fallback is to re-install the key components of your Information Technology environment. Absent the availability of essential data backups, this requires a broad complement of IT skills, top notch project management, and the willingness to work continuously until the task is completed.

For decades, Progent has provided certified expert IT services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded advanced certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial systems and ERP applications. This breadth of expertise affords Progent the skills to knowledgably understand necessary systems and re-organize the remaining pieces of your IT environment after a crypto-ransomware penetration and assemble them into a functioning network.

Progent's security group uses top notch project management systems to coordinate the complex recovery process. Progent understands the urgency of working rapidly and together with a customer's management and IT staff to prioritize tasks and to put the most important applications back online as fast as possible.

Client Story: A Successful Ransomware Attack Recovery
A business hired Progent after their organization was penetrated by the Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state criminal gangs, possibly adopting approaches exposed from America's National Security Agency. Ryuk goes after specific organizations with little tolerance for disruption and is among the most lucrative examples of ransomware. Headline organizations include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company based in Chicago and has around 500 staff members. The Ryuk event had disabled all business operations and manufacturing capabilities. Most of the client's data backups had been online at the start of the attack and were encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and hoping for the best, but in the end made the decision to use Progent.

Progent worked with the customer to rapidly understand and prioritize the key services that had to be recovered in order to resume business operations:

• Active Directory (AD)
• Exchange Server
• MRP System

Within 48 hours, Progent was able to recover Active Directory to its pre-intrusion state. Progent then accomplished rebuilding and hard drive recovery on essential servers. All Exchange data and configuration information were intact, which facilitated the rebuild of Exchange. Progent was able to collect non-encrypted OST files (Microsoft Outlook Off-Line Folder Files) on user PCs and laptops in order to recover mail messages. A recent offline backup of the customer's accounting/MRP software made it possible to restore these essential services back servicing users. Although significant work was left to recover fully from the Ryuk attack, the most important systems were restored rapidly:

During the following couple of weeks critical milestones in the restoration project were accomplished in close collaboration between Progent consultants and the client:

• Internal web applications were brought back up with no loss of information.
• The MailStore Exchange Server with over four million historical messages was brought online and available for users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were 100 percent operational.
• A new Palo Alto Networks 850 firewall was brought online.
• Most of the desktops and laptops were fully operational.

Conclusion
A potential enterprise-killing disaster was evaded with top-tier professionals, a wide array of knowledge, and close teamwork. Although in hindsight the ransomware virus penetration described here should have been disabled with modern cyber security solutions and NIST Cybersecurity Framework best practices, user education, and appropriate incident response procedures for backup and applying software patches, the reality remains that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a ransomware penetration, feel confident that Progent's roster of experts has substantial experience in crypto-ransomware virus defense, removal, and file restoration.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers companies in Ribeirão Preto a range of online monitoring and security assessment services designed to help you to minimize your vulnerability to crypto-ransomware. These services utilize next-generation machine learning capability to detect zero-day strains of ransomware that can escape detection by traditional signature-based security products.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management (RMM) technology to help keep your IT system operating at peak levels by tracking the state of critical computers that drive your business network. When ProSight LAN Watch uncovers a problem, an alarm is transmitted immediately to your designated IT management personnel and your Progent engineering consultant so that any potential problems can be addressed before they can impact your network. Learn more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for managing your network, server, and desktop devices by providing tools for streamlining common time-consuming jobs. These can include health monitoring, update management, automated repairs, endpoint deployment, backup and recovery, anti-virus defense, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it transmits an alarm to your designated IT staff and your assigned Progent consultant so emerging issues can be taken care of before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and affordable for smaller organizations to map out, monitor, reconfigure and debug their networking hardware like routers, firewalls, and load balancers as well as servers, endpoints and other networked devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch ensures that network maps are always updated, captures and manages the configuration information of virtually all devices connected to your network, monitors performance, and sends alerts when potential issues are discovered. By automating complex management and troubleshooting activities, WAN Watch can cut hours off common chores like network mapping, reconfiguring your network, finding devices that require critical updates, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time and in-depth management reporting tools designed to work with the leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize key issues such as inconsistent support follow-up or endpoints with out-of-date AVs. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore software companies to produce ProSight Data Protection Services (DPS), a selection of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS services manage and monitor your data backup processes and allow non-disruptive backup and fast recovery of critical files/folders, apps, images, and virtual machines. ProSight DPS lets your business protect against data loss caused by hardware failures, natural calamities, fire, malware like ransomware, human error, malicious employees, or software bugs. Managed services available in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these fully managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of leading data security vendors to provide centralized management and world-class security for all your inbound and outbound email. The powerful architecture of Email Guard integrates cloud-based filtering with an on-premises gateway device to offer advanced defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-based malware. The cloud filter serves as a preliminary barricade and blocks most threats from making it to your network firewall. This reduces your exposure to external threats and saves network bandwidth and storage space. Email Guard's onsite security gateway device adds a further layer of inspection for incoming email. For outbound email, the on-premises gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The onsite security gateway can also help Microsoft Exchange Server to track and protect internal email that stays within your security perimeter. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA managed services utilize Cisco's Duo technology to defend against compromised passwords by using two-factor authentication. Duo supports one-tap identity verification with iOS, Android, and other out-of-band devices. Using 2FA, whenever you log into a protected online account and give your password you are asked to verify your identity via a device that only you possess and that uses a different ("out-of-band") network channel. A wide range of out-of-band devices can be used as this added means of ID validation such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You may register several validation devices. For more information about Duo two-factor identity validation services, see Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Service Desk: Support Desk Managed Services
  Progent's Support Center services allow your information technology group to offload Call Center services to Progent or divide activity for support services seamlessly between your in-house support group and Progent's extensive pool of IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a smooth extension of your in-house IT support organization. Client interaction with the Service Desk, delivery of support, problem escalation, ticket creation and updates, performance measurement, and maintenance of the support database are consistent regardless of whether incidents are resolved by your in-house IT support group, by Progent, or a mix of the two. Learn more about Progent's outsourced/co-managed Call Center services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior-based machine learning tools to guard endpoints and servers and VMs against modern malware assaults like ransomware and file-less exploits, which easily escape legacy signature-based AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and offers a single platform to manage the entire threat lifecycle including blocking, infiltration detection, mitigation, cleanup, and forensics. Key features include one-click rollback with Windows VSS and automatic system-wide immunization against new attacks. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, find and safeguard data about your IT infrastructure, procedures, business apps, and services. You can quickly locate passwords or serial numbers and be alerted about upcoming expirations of SSL certificates or warranties. By updating and organizing your IT infrastructure documentation, you can eliminate as much as half of time wasted trying to find vital information about your network. ProSight IT Asset Management features a centralized location for storing and sharing all documents required for managing your network infrastructure such as standard operating procedures and How-To's. ProSight IT Asset Management also supports advanced automation for collecting and relating IT data. Whether you're making enhancements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the knowledge you require the instant you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide organizations of any size a flexible and cost-effective solution for evaluating, testing, scheduling, applying, and tracking software and firmware updates to your ever-evolving IT system. In addition to maximizing the protection and reliability of your IT network, Progent's software/firmware update management services allow your in-house IT team to focus on more strategic initiatives and activities that derive the highest business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a secure fault tolerant data center on a fast virtual machine host set up and managed by Progent's network support professionals. Under the ProSight Virtual Hosting model, the customer owns the data, the operating system platforms, and the apps. Because the environment is virtualized, it can be moved easily to a different hosting environment without a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, you are not tied one hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection service that utilizes SentinelOne's cutting edge behavior-based analysis technology to defend physical and virtual endpoints against new malware assaults such as ransomware and file-less exploits, which easily get by traditional signature-based AV tools. ProSight ASM safeguards local and cloud-based resources and provides a unified platform to address the entire threat lifecycle including protection, detection, containment, cleanup, and post-attack forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver affordable in-depth protection for physical and virtual servers, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes contextual security and advanced machine learning for continuously monitoring and reacting to cyber threats from all vectors. ProSight ESP offers firewall protection, penetration alerts, device management, and web filtering through leading-edge tools packaged within a single agent accessible from a unified control. Progent's data protection and virtualization experts can help you to plan and implement a ProSight ESP environment that addresses your company's unique needs and that helps you prove compliance with government and industry data security regulations. Progent will help you define and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that require immediate attention. Progent's consultants can also assist your company to set up and test a backup and disaster recovery system like ProSight Data Protection Services so you can recover quickly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Microsoft Exchange email filtering.