Southlake 24/7 Urgent Ransomware
Computer Virus Assessment and Repair Support

Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that represents an existential threat for businesses of all sizes unprepared for an attack. Different iterations of ransomware such as Reveton, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for years and continue to inflict havoc. Newer strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, as well as more unnamed newcomers, not only do encryption of on-line data files but also infect most available system protection mechanisms. Data synched to the cloud can also be ransomed. In a vulnerable system, it can make automatic restoration impossible and effectively knocks the datacenter back to zero.

Getting back online services and data following a ransomware intrusion becomes a race against the clock as the targeted business tries its best to contain the damage, remove the crypto-ransomware, and restore business-critical activity. Due to the fact that ransomware needs time to move laterally, penetrations are frequently launched on weekends and holidays, when successful penetrations in many cases take longer to detect. This multiplies the difficulty of promptly mobilizing and coordinating a knowledgeable response team.

Progent has a variety of solutions for securing businesses from ransomware attacks. Among these are team member education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of the latest generation security gateways with machine learning technology from SentinelOne to discover and extinguish zero-day cyber threats rapidly. Progent also provides the assistance of expert ransomware recovery professionals with the talent and perseverance to rebuild a compromised network as soon as possible.

Progent's Ransomware Recovery Services
Following a ransomware invasion, sending the ransom in cryptocurrency does not guarantee that merciless criminals will respond with the codes to decrypt all your files. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The alternative is to piece back together the vital components of your Information Technology environment. Without the availability of complete data backups, this requires a broad range of skills, professional team management, and the capability to work 24x7 until the recovery project is completed.

For two decades, Progent has made available certified expert IT services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained high-level industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in financial management and ERP applications. This breadth of expertise provides Progent the capability to efficiently determine important systems and integrate the surviving parts of your IT system after a ransomware attack and assemble them into a functioning system.

Progent's recovery team of experts has best of breed project management tools to orchestrate the complex restoration process. Progent knows the importance of working swiftly and together with a client's management and Information Technology team members to assign priority to tasks and to put essential services back on-line as fast as possible.

Customer Story: A Successful Ransomware Incident Restoration
A small business contacted Progent after their network system was crashed by the Ryuk ransomware. Ryuk is thought to have been launched by Northern Korean government sponsored criminal gangs, possibly using approaches exposed from the United States National Security Agency. Ryuk seeks specific businesses with limited room for operational disruption and is among the most lucrative examples of ransomware viruses. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer located in the Chicago metro area and has about 500 staff members. The Ryuk attack had brought down all essential operations and manufacturing processes. The majority of the client's information backups had been on-line at the time of the intrusion and were destroyed. The client was evaluating paying the ransom (more than $200,000) and praying for good luck, but ultimately brought in Progent.

Progent worked together with the customer to quickly assess and prioritize the most important areas that had to be restored to make it possible to resume business operations:

• Windows Active Directory
• Microsoft Exchange
• MRP System

In less than 48 hours, Progent was able to rebuild Active Directory to its pre-attack state. Progent then accomplished setup and hard drive recovery on mission critical servers. All Exchange Server schema and attributes were usable, which accelerated the restore of Exchange. Progent was able to find local OST files (Outlook Offline Data Files) on team workstations to recover mail messages. A recent off-line backup of the customer's accounting systems made them able to recover these essential applications back online for users. Although a lot of work needed to be completed to recover completely from the Ryuk event, critical systems were returned to operations quickly:

Throughout the next month important milestones in the restoration project were completed in tight cooperation between Progent consultants and the customer:

• Self-hosted web applications were brought back up with no loss of data.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory modules were 100% functional.
• A new Palo Alto 850 firewall was brought on-line.
• Ninety percent of the user desktops and notebooks were back into operation.

Conclusion
A probable business extinction disaster was evaded through the efforts of top-tier experts, a wide spectrum of IT skills, and close collaboration. Although in post mortem the ransomware incident described here would have been prevented with modern security systems and NIST Cybersecurity Framework best practices, staff training, and appropriate security procedures for information backup and applying software patches, the fact remains that state-sponsored hackers from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, remember that Progent's team of professionals has substantial experience in ransomware virus blocking, remediation, and information systems recovery.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Southlake a range of remote monitoring and security evaluation services to assist you to reduce the threat from crypto-ransomware. These services include next-generation artificial intelligence capability to uncover zero-day variants of ransomware that can evade traditional signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management technology to help keep your network operating at peak levels by tracking the state of critical computers that drive your business network. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your designated IT management personnel and your assigned Progent consultant so that all looming issues can be resolved before they have a chance to disrupt your network. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for monitoring and managing your client-server infrastructure by offering tools for streamlining common tedious tasks. These include health monitoring, update management, automated repairs, endpoint configuration, backup and recovery, A/V defense, secure remote access, standard and custom scripts, asset inventory, endpoint status reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alarm to your specified IT management personnel and your assigned Progent consultant so that emerging issues can be fixed before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to map out, monitor, optimize and troubleshoot their networking appliances such as routers and switches, firewalls, and access points as well as servers, printers, endpoints and other networked devices. Using cutting-edge RMM technology, WAN Watch ensures that infrastructure topology maps are always updated, copies and displays the configuration information of virtually all devices on your network, monitors performance, and sends notices when issues are discovered. By automating time-consuming network management activities, ProSight WAN Watch can cut hours off ordinary chores such as network mapping, expanding your network, locating appliances that require important software patches, or resolving performance problems. Learn more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing suite of real-time reporting tools designed to work with the industry's top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize key issues like inconsistent support follow-up or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with advanced backup/restore technology providers to create ProSight Data Protection Services, a portfolio of offerings that deliver backup-as-a-service (BaaS). ProSight DPS products manage and track your backup operations and allow non-disruptive backup and fast restoration of critical files, applications, images, plus VMs. ProSight DPS lets you avoid data loss caused by hardware breakdown, natural disasters, fire, malware like ransomware, user error, ill-intentioned employees, or software bugs. Managed backup services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of top data security companies to deliver centralized control and comprehensive protection for all your email traffic. The hybrid architecture of Email Guard managed service integrates a Cloud Protection Layer with a local gateway device to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The cloud filter acts as a first line of defense and keeps most threats from making it to your network firewall. This reduces your vulnerability to inbound attacks and saves system bandwidth and storage. Email Guard's onsite security gateway device provides a deeper level of inspection for incoming email. For outgoing email, the onsite gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The on-premises gateway can also help Exchange Server to track and safeguard internal email that stays within your security perimeter. For more details, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo MFA managed services utilize Cisco's Duo technology to defend against compromised passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity verification with Apple iOS, Android, and other personal devices. Using Duo 2FA, whenever you sign into a secured application and give your password you are asked to verify your identity via a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A broad range of out-of-band devices can be used for this second means of authentication such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can designate multiple verification devices. For more information about Duo two-factor identity validation services, go to Cisco Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Service Center: Support Desk Managed Services
  Progent's Support Desk managed services enable your information technology group to outsource Call Center services to Progent or divide responsibilities for support services transparently between your in-house network support staff and Progent's extensive roster of certified IT service engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a smooth supplement to your in-house network support group. User access to the Service Desk, delivery of support, issue escalation, trouble ticket generation and updates, efficiency metrics, and management of the service database are cohesive regardless of whether incidents are resolved by your core network support resources, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Help Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior-based machine learning tools to guard endpoint devices as well as servers and VMs against new malware assaults such as ransomware and file-less exploits, which routinely escape traditional signature-based AV products. Progent Active Security Monitoring services safeguard on-premises and cloud resources and offers a unified platform to automate the complete threat lifecycle including filtering, infiltration detection, containment, cleanup, and forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, maintain, retrieve and protect data about your network infrastructure, processes, business apps, and services. You can instantly find passwords or IP addresses and be alerted about upcoming expirations of SSLs ,domains or warranties. By updating and managing your IT infrastructure documentation, you can save as much as half of time thrown away trying to find critical information about your network. ProSight IT Asset Management features a common location for storing and collaborating on all documents related to managing your network infrastructure like recommended procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and associating IT data. Whether you're planning enhancements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the knowledge you need as soon as you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a flexible and cost-effective solution for assessing, validating, scheduling, implementing, and tracking software and firmware updates to your dynamic IT system. Besides optimizing the security and functionality of your IT environment, Progent's software/firmware update management services permit your in-house IT team to concentrate on more strategic projects and tasks that deliver the highest business value from your network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and applications hosted in a protected Tier III data center on a fast virtual machine host configured and managed by Progent's IT support experts. With the ProSight Virtual Hosting model, the customer owns the data, the OS software, and the applications. Since the environment is virtualized, it can be ported immediately to a different hosting solution without a time-consuming and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior-based machine learning technology to guard physical and virtual endpoint devices against new malware assaults such as ransomware and email phishing, which easily escape legacy signature-based anti-virus tools. ProSight ASM protects local and cloud-based resources and offers a single platform to address the complete malware attack lifecycle including filtering, identification, mitigation, remediation, and forensics. Top features include single-click rollback using Windows VSS and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) services offer affordable multi-layer security for physical servers and VMs, workstations, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced heuristics for continuously monitoring and responding to cyber assaults from all attack vectors. ProSight ESP delivers firewall protection, intrusion alarms, endpoint control, and web filtering via leading-edge tools packaged within a single agent managed from a unified console. Progent's security and virtualization experts can help your business to design and configure a ProSight ESP deployment that addresses your company's unique requirements and that allows you achieve and demonstrate compliance with government and industry information security regulations. Progent will help you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that call for immediate action. Progent's consultants can also assist your company to set up and verify a backup and disaster recovery solution such as ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified endpoint security and Microsoft Exchange filtering.