Southfield 24/7 Urgent Crypto-Ransomware
Infection Identification and Recovery Consultants

Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a modern cyberplague that presents an extinction-level danger for businesses unprepared for an attack. Multiple generations of ransomware like the CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for many years and continue to inflict damage. Recent versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, plus more unnamed newcomers, not only encrypt on-line data but also infiltrate most accessible system protection. Information replicated to the cloud can also be encrypted. In a vulnerable environment, this can render any restore operations hopeless and basically sets the network back to zero.

Getting back programs and information following a ransomware outage becomes a race against time as the targeted organization struggles to stop the spread, clear the virus, and restore enterprise-critical operations. Due to the fact that ransomware takes time to replicate, penetrations are frequently launched at night, when successful penetrations tend to take more time to recognize. This multiplies the difficulty of promptly mobilizing and coordinating a capable response team.

Progent makes available a range of help services for securing enterprises from ransomware penetrations. Among these are staff training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of the latest generation security solutions with artificial intelligence technology from SentinelOne to discover and suppress day-zero threats quickly. Progent in addition offers the services of seasoned ransomware recovery engineers with the talent and perseverance to re-deploy a breached network as soon as possible.

Progent's Ransomware Recovery Support Services
Following a crypto-ransomware event, even paying the ransom in cryptocurrency does not guarantee that criminal gangs will respond with the codes to unencrypt any of your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can reach millions. The alternative is to setup from scratch the mission-critical elements of your Information Technology environment. Without the availability of full information backups, this calls for a wide range of skills, professional project management, and the willingness to work non-stop until the job is completed.

For twenty years, Progent has provided professional Information Technology services for companies throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded high-level certifications in foundation technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise in financial systems and ERP applications. This breadth of experience gives Progent the skills to rapidly identify critical systems and re-organize the remaining parts of your network system after a crypto-ransomware attack and rebuild them into an operational system.

Progent's ransomware team of experts utilizes state-of-the-art project management systems to coordinate the complex restoration process. Progent appreciates the urgency of working rapidly and in unison with a customer's management and IT team members to prioritize tasks and to put the most important applications back on-line as fast as possible.

Case Study: A Successful Ransomware Virus Recovery
A customer engaged Progent after their network was taken over by the Ryuk ransomware. Ryuk is thought to have been developed by Northern Korean government sponsored hackers, suspected of using techniques leaked from the U.S. NSA organization. Ryuk targets specific companies with little or no tolerance for operational disruption and is one of the most lucrative versions of ransomware malware. Major victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business located in Chicago with around 500 employees. The Ryuk event had disabled all business operations and manufacturing processes. The majority of the client's backups had been online at the time of the attack and were damaged. The client was taking steps for paying the ransom (more than $200,000) and hoping for good luck, but ultimately reached out to Progent.

Progent worked hand in hand the client to quickly get our arms around and assign priority to the key services that had to be restored to make it possible to continue business functions:

• Active Directory (AD)
• Electronic Mail
• Financials/MRP

In less than two days, Progent was able to restore Windows Active Directory to its pre-penetration state. Progent then completed rebuilding and hard drive recovery of mission critical servers. All Microsoft Exchange Server data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was also able to assemble non-encrypted OST files (Outlook Off-Line Data Files) on staff PCs and laptops in order to recover email messages. A not too old offline backup of the client's accounting/ERP software made them able to recover these vital applications back on-line. Although a lot of work still had to be done to recover totally from the Ryuk damage, the most important systems were returned to operations quickly:

During the following few weeks important milestones in the restoration project were accomplished in tight collaboration between Progent engineers and the customer:

• In-house web sites were brought back up without losing any information.
• The MailStore Microsoft Exchange Server exceeding 4 million archived messages was restored to operations and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory capabilities were 100% functional.
• A new Palo Alto Networks 850 firewall was installed.
• 90% of the user desktops and notebooks were fully operational.

Conclusion
A probable company-ending catastrophe was dodged with hard-working experts, a broad array of technical expertise, and close collaboration. Although in hindsight the ransomware virus attack described here would have been identified and stopped with modern security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and well thought out incident response procedures for information backup and proper patching controls, the reality is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware attack, feel confident that Progent's team of experts has proven experience in ransomware virus defense, mitigation, and data restoration.

To review or download a PDF version of this customer case study, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Southfield a portfolio of remote monitoring and security evaluation services to assist you to reduce your vulnerability to ransomware. These services incorporate next-generation AI capability to uncover zero-day strains of ransomware that are able to get past legacy signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates state-of-the-art remote monitoring and management techniques to keep your network running at peak levels by tracking the health of critical assets that drive your business network. When ProSight LAN Watch detects an issue, an alarm is transmitted automatically to your specified IT management personnel and your Progent engineering consultant so that any potential problems can be resolved before they can disrupt your network. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for managing your network, server, and desktop devices by providing tools for performing common time-consuming jobs. These include health monitoring, update management, automated repairs, endpoint configuration, backup and restore, A/V response, remote access, built-in and custom scripts, asset inventory, endpoint status reporting, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it transmits an alarm to your designated IT management staff and your Progent consultant so emerging issues can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to map out, track, reconfigure and troubleshoot their connectivity hardware such as routers and switches, firewalls, and load balancers plus servers, printers, client computers and other devices. Incorporating state-of-the-art RMM technology, ProSight WAN Watch makes sure that infrastructure topology maps are kept updated, captures and displays the configuration information of almost all devices on your network, monitors performance, and sends notices when potential issues are discovered. By automating complex network management activities, ProSight WAN Watch can knock hours off ordinary tasks like making network diagrams, reconfiguring your network, finding appliances that need important software patches, or identifying the cause of performance issues. Find out more details about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of real-time and in-depth management reporting tools designed to integrate with the industry's leading ticketing and remote network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues such as spotty support follow-up or machines with out-of-date AVs. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, reduces management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore technology companies to produce ProSight Data Protection Services, a selection of offerings that deliver backup-as-a-service. ProSight DPS services manage and track your backup processes and allow non-disruptive backup and rapid recovery of critical files/folders, applications, system images, and VMs. ProSight DPS helps you avoid data loss caused by hardware failures, natural disasters, fire, cyber attacks such as ransomware, human mistakes, malicious employees, or application bugs. Managed backup services in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the infrastructure of top information security vendors to deliver centralized management and world-class protection for your email traffic. The hybrid architecture of Progent's Email Guard managed service combines a Cloud Protection Layer with an on-premises gateway device to offer complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's cloud filter acts as a first line of defense and blocks the vast majority of threats from making it to your network firewall. This reduces your vulnerability to external attacks and saves system bandwidth and storage. Email Guard's onsite security gateway device provides a deeper level of analysis for incoming email. For outgoing email, the onsite security gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email that stays within your corporate firewall. For more details, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo MFA service plans utilize Cisco's Duo cloud technology to protect against password theft through the use of two-factor authentication (2FA). Duo enables single-tap identity verification on Apple iOS, Android, and other out-of-band devices. Using Duo 2FA, when you sign into a secured online account and enter your password you are asked to confirm who you are on a device that only you have and that uses a different network channel. A broad selection of devices can be used as this added means of authentication including a smartphone or wearable, a hardware token, a landline telephone, etc. You may register multiple validation devices. To find out more about ProSight Duo identity validation services, go to Cisco Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Service Center: Help Desk Managed Services
  Progent's Help Center services enable your IT staff to outsource Help Desk services to Progent or split responsibilities for support services seamlessly between your in-house support team and Progent's nationwide roster of certified IT support technicians, engineers and subject matter experts. Progent's Co-managed Service Desk provides a transparent extension of your in-house IT support group. End user access to the Service Desk, provision of support services, escalation, trouble ticket generation and updates, performance measurement, and management of the support database are cohesive whether issues are taken care of by your corporate IT support organization, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/co-managed Help Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that incorporates next generation behavior-based machine learning technology to guard endpoints as well as servers and VMs against modern malware assaults like ransomware and email phishing, which easily evade traditional signature-matching anti-virus products. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and provides a single platform to manage the complete threat lifecycle including protection, infiltration detection, containment, cleanup, and post-attack forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, retrieve and safeguard data about your IT infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be alerted automatically about impending expirations of SSL certificates or domains. By cleaning up and organizing your IT documentation, you can eliminate as much as 50% of time spent trying to find critical information about your IT network. ProSight IT Asset Management features a centralized location for holding and sharing all documents related to managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether you're planning improvements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the data you need as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of all sizes a versatile and cost-effective alternative for assessing, testing, scheduling, applying, and documenting software and firmware updates to your dynamic information system. Besides maximizing the protection and reliability of your computer environment, Progent's software/firmware update management services allow your IT staff to focus on line-of-business initiatives and activities that deliver maximum business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and apps hosted in a secure Tier III data center on a fast virtual host configured and maintained by Progent's network support experts. Under the ProSight Virtual Hosting service model, the customer owns the data, the operating system platforms, and the apps. Because the system is virtualized, it can be moved immediately to an alternate hardware solution without a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior analysis technology to guard physical and virtual endpoints against modern malware assaults like ransomware and file-less exploits, which routinely escape traditional signature-matching AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and provides a unified platform to address the entire malware attack lifecycle including blocking, identification, mitigation, cleanup, and post-attack forensics. Top features include single-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver ultra-affordable multi-layer protection for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and reacting to cyber assaults from all vectors. ProSight ESP offers firewall protection, intrusion alerts, endpoint control, and web filtering via leading-edge technologies incorporated within a single agent managed from a unified console. Progent's data protection and virtualization experts can help your business to design and implement a ProSight ESP deployment that meets your organization's specific needs and that allows you achieve and demonstrate compliance with legal and industry data security regulations. Progent will assist you define and implement security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alerts that require urgent attention. Progent's consultants can also assist you to set up and verify a backup and restore system such as ProSight Data Protection Services so you can get back in business rapidly from a destructive security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.