24/7 Uberlândia Critical Crypto
Malware Detection and Repair Help

Ransomware : Your Feared IT Nightmare
Ransomware has become a too-frequent cyber pandemic that represents an existential danger for businesses unprepared for an assault. Different iterations of ransomware like the Reveton, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and still inflict havoc. Modern versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, as well as additional unnamed viruses, not only encrypt online data but also infect all accessible system backup. Files synchronized to cloud environments can also be corrupted. In a poorly designed system, this can make automated recovery impossible and effectively knocks the entire system back to zero.

Retrieving services and information following a ransomware intrusion becomes a sprint against the clock as the victim fights to stop lateral movement, clear the crypto-ransomware, and resume business-critical activity. Due to the fact that ransomware takes time to move laterally, penetrations are frequently launched on weekends and holidays, when penetrations in many cases take more time to recognize. This multiplies the difficulty of quickly assembling and orchestrating a knowledgeable response team.

Progent offers an assortment of solutions for protecting organizations from ransomware attacks. These include user education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to deployment of next-generation security gateways with artificial intelligence capabilities from SentinelOne to identify and quarantine new threats quickly. Progent also provides the services of experienced ransomware recovery consultants with the talent and perseverance to rebuild a compromised environment as urgently as possible.

Progent's Ransomware Restoration Services
Following a crypto-ransomware attack, even paying the ransom in cryptocurrency does not guarantee that cyber criminals will provide the needed codes to unencrypt any of your information. Kaspersky determined that seventeen percent of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to piece back together the mission-critical elements of your Information Technology environment. Without access to complete information backups, this requires a wide complement of skills, professional project management, and the ability to work 24x7 until the recovery project is completed.

For two decades, Progent has provided certified expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned advanced certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in accounting and ERP applications. This breadth of expertise provides Progent the ability to knowledgably understand important systems and integrate the surviving parts of your Information Technology system after a ransomware penetration and configure them into a functioning system.

Progent's ransomware team of experts has state-of-the-art project management tools to orchestrate the sophisticated restoration process. Progent appreciates the urgency of working rapidly and in unison with a client's management and IT team members to assign priority to tasks and to put essential services back on-line as fast as possible.

Client Story: A Successful Ransomware Intrusion Recovery
A customer sought out Progent after their network was taken over by Ryuk ransomware. Ryuk is thought to have been launched by North Korean state cybercriminals, possibly using techniques exposed from America's NSA organization. Ryuk seeks specific businesses with limited tolerance for disruption and is among the most lucrative iterations of ransomware viruses. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in the Chicago metro area with about 500 workers. The Ryuk intrusion had disabled all company operations and manufacturing capabilities. Most of the client's backups had been directly accessible at the time of the attack and were destroyed. The client was actively seeking loans for paying the ransom (in excess of $200,000) and wishfully thinking for good luck, but in the end brought in Progent.

Progent worked with the client to rapidly identify and assign priority to the critical systems that needed to be addressed to make it possible to continue company functions:

• Active Directory (AD)
• Exchange Server
• Accounting/MRP

In less than 48 hours, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then helped perform setup and hard drive recovery on needed applications. All Microsoft Exchange Server ties and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to locate intact OST data files (Microsoft Outlook Offline Folder Files) on team PCs in order to recover email messages. A not too old off-line backup of the customer's manufacturing software made them able to return these required services back online for users. Although major work was left to recover totally from the Ryuk damage, essential services were restored quickly:

Throughout the next month critical milestones in the recovery project were accomplished in close cooperation between Progent engineers and the customer:

• Self-hosted web applications were brought back up with no loss of information.
• The MailStore Exchange Server exceeding four million historical emails was brought on-line and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory functions were 100 percent recovered.
• A new Palo Alto 850 security appliance was installed and configured.
• 90% of the user desktops and notebooks were back into operation.

Conclusion
A potential business-killing catastrophe was evaded with hard-working professionals, a wide array of technical expertise, and close collaboration. Although in analyzing the event afterwards the ransomware virus attack detailed here would have been shut down with up-to-date cyber security technology and NIST Cybersecurity Framework best practices, staff education, and well thought out incident response procedures for backup and keeping systems up to date with security patches, the reality remains that government-sponsored hackers from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware virus, remember that Progent's team of professionals has substantial experience in crypto-ransomware virus defense, cleanup, and file disaster recovery.

To review or download a PDF version of this customer case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Uberlândia a range of online monitoring and security assessment services designed to assist you to reduce your vulnerability to ransomware. These services include next-generation artificial intelligence technology to detect zero-day strains of ransomware that can evade legacy signature-based security solutions.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates state-of-the-art remote monitoring and management techniques to help keep your IT system running at peak levels by tracking the state of critical assets that drive your business network. When ProSight LAN Watch uncovers an issue, an alert is sent automatically to your designated IT management staff and your assigned Progent consultant so all potential problems can be resolved before they have a chance to disrupt productivity. Learn more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based solution for managing your network, server, and desktop devices by offering tools for streamlining common tedious jobs. These can include health checking, update management, automated repairs, endpoint deployment, backup and recovery, anti-virus response, secure remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it transmits an alert to your designated IT management personnel and your Progent technical consultant so that potential problems can be taken care of before they interfere with your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to map out, monitor, reconfigure and troubleshoot their networking hardware like routers, firewalls, and wireless controllers as well as servers, printers, endpoints and other networked devices. Incorporating cutting-edge RMM technology, WAN Watch makes sure that network diagrams are always current, copies and displays the configuration of virtually all devices on your network, monitors performance, and generates alerts when issues are discovered. By automating time-consuming network management activities, ProSight WAN Watch can knock hours off ordinary chores such as making network diagrams, expanding your network, finding devices that require important updates, or isolating performance issues. Find out more details about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time and in-depth reporting tools created to work with the industry's top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has worked with advanced backup software providers to produce ProSight Data Protection Services (DPS), a portfolio of offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and track your backup processes and enable transparent backup and rapid restoration of critical files/folders, applications, images, and virtual machines. ProSight DPS lets your business protect against data loss resulting from hardware failures, natural disasters, fire, cyber attacks like ransomware, human error, malicious insiders, or software glitches. Managed services available in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent expert can assist you to determine which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of top data security companies to deliver centralized management and world-class security for all your inbound and outbound email. The powerful architecture of Progent's Email Guard managed service integrates a Cloud Protection Layer with an on-premises gateway device to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The Cloud Protection Layer serves as a first line of defense and blocks the vast majority of unwanted email from reaching your network firewall. This decreases your exposure to external threats and conserves system bandwidth and storage space. Email Guard's on-premises gateway appliance provides a deeper level of inspection for incoming email. For outgoing email, the onsite gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also assist Exchange Server to track and safeguard internal email traffic that originates and ends within your security perimeter. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA services incorporate Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo supports single-tap identity verification on Apple iOS, Android, and other out-of-band devices. With Duo 2FA, whenever you log into a protected application and enter your password you are requested to verify your identity via a unit that only you have and that is accessed using a different network channel. A broad selection of devices can be utilized for this added means of ID validation such as a smartphone or wearable, a hardware token, a landline telephone, etc. You can designate multiple validation devices. For details about Duo identity validation services, refer to Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Service Desk: Support Desk Managed Services
  Progent's Call Center managed services enable your information technology team to outsource Call Center services to Progent or split activity for Help Desk services seamlessly between your in-house network support team and Progent's extensive pool of IT support technicians, engineers and subject matter experts. Progent's Co-managed Service Desk provides a smooth extension of your corporate network support staff. End user interaction with the Service Desk, delivery of support, escalation, ticket generation and updates, performance metrics, and maintenance of the support database are consistent whether incidents are resolved by your internal IT support staff, by Progent, or both. Read more about Progent's outsourced/shared Service Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates cutting edge behavior machine learning technology to defend endpoints as well as physical and virtual servers against modern malware assaults such as ransomware and email phishing, which routinely get by legacy signature-matching AV tools. Progent ASM services safeguard on-premises and cloud resources and offers a unified platform to address the complete malware attack lifecycle including filtering, detection, containment, remediation, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, find and safeguard information related to your network infrastructure, processes, applications, and services. You can instantly find passwords or serial numbers and be warned about impending expirations of SSL certificates ,domains or warranties. By cleaning up and managing your IT documentation, you can save as much as 50% of time wasted trying to find vital information about your IT network. ProSight IT Asset Management features a centralized location for storing and sharing all documents related to managing your network infrastructure such as recommended procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're planning enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the information you require as soon as you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer businesses of any size a versatile and cost-effective alternative for assessing, validating, scheduling, applying, and documenting updates to your dynamic IT network. In addition to optimizing the protection and reliability of your computer network, Progent's patch management services free up time for your in-house IT team to concentrate on line-of-business projects and activities that derive the highest business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and apps hosted in a protected Tier III data center on a fast virtual host set up and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the applications. Because the system is virtualized, it can be ported immediately to an alternate hosting environment without requiring a time-consuming and technically risky configuration process. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior-based analysis technology to defend physical and virtual endpoints against new malware attacks such as ransomware and file-less exploits, which routinely evade legacy signature-based anti-virus products. ProSight ASM safeguards on-premises and cloud resources and offers a single platform to manage the complete threat lifecycle including protection, detection, mitigation, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver affordable in-depth security for physical servers and virtual machines, desktops, smartphones, and Exchange email. ProSight ESP uses contextual security and advanced machine learning for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alarms, device management, and web filtering through leading-edge technologies packaged within one agent managed from a unified console. Progent's security and virtualization consultants can help your business to plan and implement a ProSight ESP deployment that addresses your company's unique needs and that helps you demonstrate compliance with legal and industry data protection standards. Progent will help you specify and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and respond to alarms that require urgent attention. Progent can also assist you to set up and test a backup and restore solution such as ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.