Ransomware Prevention and Recovery Services

Ransomware Hot Line: 800-462-8800

24x7 Remote Access to a Top-tier Ransomware Engineer
Ransomware needs time to steal its way through a network. Because of this, ransomware assaults are typically unleashed on weekends and late at night, when support staff may take longer to become aware of a penetration and are less able to organize a rapid and forceful defense. The more lateral movement ransomware is able to achieve inside a target's system, the more time it will require to recover basic IT services and damaged files and the more information can be stolen and posted to the dark web.

Progent's Ransomware Hot Line is designed to guide organizations to carry out the time-critical first steps in responding to a ransomware attack by putting out the fire. Progent's remote ransomware experts can help businesses to locate and quarantine infected devices and guard undamaged assets from being compromised.

If your system has been breached by any version of ransomware, act fast. Get help quickly by calling Progent's 24x7 Ransomware Hot Line at 800-462-8800.

Progent's Ransomware Recovery Expertise
Current strains of crypto-ransomware like Ryuk, Sodinokibi, DopplePaymer, and Egregor encrypt online files and attack any accessible backups. Data synched to the cloud can also be impacted. For a poorly defended environment, this can make automated recovery nearly impossible and effectively knocks the datacenter back to the beginning. So-called Threat Actors (TAs), the cybercriminals responsible for ransomware assault, demand a settlement fee for the decryption tools required to unlock scrambled data. Ransomware attacks also attempt to exfiltrate information and TAs demand an extra settlement for not publishing this data on the dark web. Even if you are able to rollback your system to an acceptable date in time, exfiltration can be a major problem according to the nature of the stolen information.

The recovery work after a ransomware attack has a number of crucial phases, the majority of which can be performed in parallel if the response workgroup has enough people with the required experience.

• Containment: This urgent first response involves blocking the sideways progress of ransomware within your IT system. The longer a ransomware attack is permitted to run unrestricted, the more complex and more costly the recovery effort. Because of this, Progent maintains a round-the-clock Ransomware Hotline monitored by veteran ransomware recovery engineers. Quarantine activities include isolating infected endpoint devices from the rest of network to block the spread, documenting the environment, and securing entry points.
• System continuity: This involves restoring the network to a minimal useful degree of capability with the least downtime. This process is usually at the highest level of urgency for the targets of the ransomware attack, who often see it as a life-or-death issue for their business. This activity also requires the widest range of technical skills that cover domain controllers, DHCP servers, physical and virtual servers, PCs, notebooks and smart phones, databases, productivity and line-of-business applications, network topology, and safe remote access management. Progent's ransomware recovery team uses advanced workgroup platforms to organize the multi-faceted restoration effort. Progent understands the importance of working rapidly, continuously, and in concert with a customer's managers and network support group to prioritize tasks and to put vital resources on line again as quickly as feasible.
• Data recovery: The effort required to restore files damaged by a ransomware assault varies according to the condition of the systems, the number of files that are encrypted, and which recovery methods are needed. Ransomware assaults can destroy pivotal databases which, if not carefully shut down, might have to be rebuilt from scratch. This can include DNS and Active Directory databases. Exchange and SQL Server rely on AD, and many ERP and other business-critical applications depend on Microsoft SQL Server. Often some detective work could be required to find undamaged data. For example, non-encrypted Outlook Email Offline Folder Files may have survived on employees' PCs and notebooks that were not connected at the time of the assault. Progent's ProSight Data Protection Services utilize Altaro VM Backup technology to defend against ransomware attacks by leveraging Immutable Cloud Storage. This creates tamper-proof data that cannot be erased or modified by any user including root users.
• Setting up advanced antivirus/ransomware protection: ProSight ASM incorporates SentinelOne's behavioral analysis technology to give small and mid-sized companies the advantages of the identical AV tools implemented by many of the world's biggest enterprises such as Netflix, Citi, and Salesforce. By providing real-time malware filtering, detection, mitigation, repair and forensics in one integrated platform, Progent's Active Security Monitoring lowers total cost of ownership, simplifies administration, and expedites operational continuity. SentinelOne's next-generation endpoint protection engine built into in Progent's Active Security Monitoring was listed by Gartner Group as the "most visionary Endpoint Protection Platform (EPP)." Progent is a SentinelOne Partner, reseller, and integrator. Learn about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery with SentinelOne technology.
• Negotiation with the threat actor (TA): Progent has experience negotiating settlements with hackers. This calls for close co-operation with the victim and the cyber insurance provider, if any. Services include establishing the kind of ransomware used in the assault; identifying and making contact with the hacker persona; testing decryption capabilities; budgeting a settlement with the ransomware victim and the cyber insurance provider; negotiating a settlement amount and schedule with the hacker; confirming compliance with anti-money laundering sanctions; carrying out the crypto-currency disbursement to the TA; receiving, learning, and operating the decryption utility; debugging failed files; building a clean environment; remapping and reconnecting drives to match precisely their pre-attack condition; and reprovisioning physical and virtual devices and software services.
• Forensic analysis: This activity involves learning the ransomware assault's storyline throughout the network from start to finish. This history of how a ransomware attack progressed within the network helps you to evaluate the damage and highlights shortcomings in policies or processes that should be rectified to avoid later break-ins. Forensics entails the examination of all logs, registry, Group Policy Object, AD, DNS, routers, firewalls, schedulers, and basic Windows systems to look for variations. Forensic analysis is usually assigned a high priority by the insurance provider. Because forensics can be time consuming, it is essential that other important recovery processes such as operational continuity are performed concurrently. Progent has a large roster of IT and data security experts with the skills needed to perform the work of containment, operational continuity, and data recovery without disrupting forensic analysis.

Download Datasheet: Progent's Ransomware Endpoint Detection and Response (EDR) Services
For a PDF datasheet describing Progent's ransomware endpoint detection and response (EDR) services, click:
Progent's Progent's Ransomware Endpoint Detection and Response (EDR) Services Datasheet. (PDF - 748 KB)

Contact Progent for Ransomware System Recovery Consulting Services
For ransomware system recovery consulting, call Progent at 800-462-8800 or see Contact Progent.