Houston 24-7 Urgent Crypto-Ransomware
Infection Identification and Repair Consulting

Ransomware : Your Feared IT Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that represents an existential threat for businesses of all sizes poorly prepared for an assault. Versions of ransomware like the CrySIS, Fusob, Locky, NotPetya and MongoLock cryptoworms have been around for many years and still inflict damage. Recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, plus daily unnamed malware, not only encrypt online critical data but also infiltrate all accessible system backup. Files synched to off-site disaster recovery sites can also be ransomed. In a vulnerable system, it can render any restore operations hopeless and basically knocks the datacenter back to square one.

Restoring applications and data following a ransomware intrusion becomes a race against time as the targeted business fights to stop lateral movement, eradicate the ransomware, and restore business-critical operations. Due to the fact that ransomware requires time to spread, attacks are often launched during nights and weekends, when penetrations may take more time to uncover. This multiplies the difficulty of quickly marshalling and coordinating an experienced response team.

Progent provides a range of solutions for securing businesses from ransomware attacks. These include team member education to help recognize and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of modern security gateways with machine learning capabilities from SentinelOne to detect and suppress new cyber attacks rapidly. Progent also offers the assistance of experienced ransomware recovery consultants with the skills and perseverance to restore a breached environment as quickly as possible.

Progent's Ransomware Restoration Support Services
After a crypto-ransomware invasion, sending the ransom in cryptocurrency does not ensure that criminal gangs will return the codes to unencrypt any or all of your files. Kaspersky determined that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to piece back together the critical elements of your Information Technology environment. Absent access to essential system backups, this requires a broad complement of IT skills, top notch team management, and the capability to work continuously until the task is completed.

For decades, Progent has provided professional Information Technology services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have earned high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with accounting and ERP applications. This breadth of expertise provides Progent the ability to rapidly determine important systems and integrate the surviving parts of your computer network system after a ransomware event and rebuild them into a functioning system.

Progent's recovery team deploys best of breed project management tools to coordinate the complicated restoration process. Progent understands the importance of working quickly and in unison with a client's management and IT resources to assign priority to tasks and to get key applications back online as fast as possible.

Client Case Study: A Successful Ransomware Intrusion Recovery
A client escalated to Progent after their organization was brought down by Ryuk ransomware. Ryuk is believed to have been launched by Northern Korean state sponsored criminal gangs, possibly adopting techniques exposed from the U.S. National Security Agency. Ryuk seeks specific businesses with little ability to sustain operational disruption and is among the most profitable iterations of ransomware malware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer located in Chicago with about 500 employees. The Ryuk intrusion had frozen all company operations and manufacturing capabilities. The majority of the client's backups had been online at the time of the attack and were encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200,000) and hoping for the best, but ultimately called Progent.

Progent worked together with the customer to quickly assess and prioritize the key services that needed to be addressed to make it possible to restart departmental operations:

• Active Directory (AD)
• Electronic Messaging
• Financials/MRP

Within two days, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then performed rebuilding and hard drive recovery of critical systems. All Microsoft Exchange Server ties and configuration information were intact, which facilitated the restore of Exchange. Progent was able to collect intact OST data files (Outlook Email Offline Folder Files) on team PCs and laptops in order to recover mail messages. A recent offline backup of the businesses accounting/ERP systems made it possible to return these essential programs back online for users. Although major work still had to be done to recover completely from the Ryuk attack, the most important services were recovered quickly:

Over the following month critical milestones in the recovery process were accomplished in close collaboration between Progent engineers and the client:

• Self-hosted web sites were restored with no loss of information.
• The MailStore Exchange Server containing more than 4 million historical messages was brought online and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory functions were fully functional.
• A new Palo Alto 850 security appliance was set up.
• Ninety percent of the desktop computers were back into operation.

Conclusion
A probable business extinction disaster was dodged with hard-working experts, a broad array of IT skills, and close collaboration. Although in post mortem the ransomware attack detailed here could have been prevented with modern cyber security solutions and security best practices, user training, and well designed incident response procedures for data backup and keeping systems up to date with security patches, the fact is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware penetration, feel confident that Progent's roster of professionals has proven experience in ransomware virus blocking, remediation, and data disaster recovery.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers companies in Houston a variety of remote monitoring and security evaluation services to help you to reduce the threat from ransomware. These services utilize modern artificial intelligence capability to uncover new variants of crypto-ransomware that are able to escape detection by legacy signature-based security solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) technology to help keep your IT system running efficiently by checking the health of vital computers that drive your business network. When ProSight LAN Watch detects an issue, an alert is sent automatically to your specified IT management staff and your assigned Progent engineering consultant so any looming issues can be addressed before they have a chance to impact your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for managing your client-server infrastructure by offering an environment for streamlining common tedious tasks. These can include health checking, patch management, automated remediation, endpoint setup, backup and restore, anti-virus response, remote access, built-in and custom scripts, asset inventory, endpoint profile reporting, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alarm to your specified IT management staff and your Progent technical consultant so that potential issues can be taken care of before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to diagram, monitor, reconfigure and troubleshoot their networking hardware such as routers and switches, firewalls, and wireless controllers as well as servers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network diagrams are always updated, captures and displays the configuration information of almost all devices on your network, monitors performance, and generates alerts when potential issues are discovered. By automating time-consuming management and troubleshooting processes, ProSight WAN Watch can cut hours off ordinary chores such as making network diagrams, reconfiguring your network, locating appliances that require critical software patches, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time reporting tools created to work with the industry's leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues like spotty support follow-up or endpoints with out-of-date AVs. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with leading backup technology providers to create ProSight Data Protection Services, a portfolio of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS products manage and monitor your data backup processes and enable transparent backup and fast restoration of critical files, apps, images, and Hyper-V and VMware virtual machines. ProSight DPS lets your business protect against data loss caused by hardware breakdown, natural disasters, fire, cyber attacks such as ransomware, user error, ill-intentioned employees, or application glitches. Managed backup services in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to determine which of these managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of top data security companies to provide centralized control and world-class security for your inbound and outbound email. The powerful structure of Progent's Email Guard managed service integrates cloud-based filtering with an on-premises gateway device to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's cloud filter acts as a preliminary barricade and blocks most threats from reaching your network firewall. This reduces your exposure to external threats and conserves system bandwidth and storage space. Email Guard's onsite gateway appliance adds a further layer of analysis for incoming email. For outbound email, the onsite gateway offers AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local gateway can also help Microsoft Exchange Server to track and safeguard internal email that stays inside your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA services incorporate Cisco's Duo cloud technology to defend against password theft by using two-factor authentication. Duo supports single-tap identity verification with Apple iOS, Android, and other out-of-band devices. Using 2FA, when you log into a secured online account and give your password you are requested to verify your identity on a device that only you have and that is accessed using a different network channel. A wide selection of devices can be used for this second means of authentication such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You may register several verification devices. For more information about ProSight Duo two-factor identity authentication services, visit Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Service Desk: Call Center Managed Services
  Progent's Support Center managed services permit your IT team to offload Support Desk services to Progent or split responsibilities for Service Desk support seamlessly between your in-house network support staff and Progent's nationwide pool of certified IT service engineers and subject matter experts (SMEs). Progent's Shared Service Desk offers a seamless supplement to your in-house support team. End user access to the Help Desk, delivery of support, escalation, trouble ticket generation and updates, performance metrics, and maintenance of the service database are consistent regardless of whether incidents are resolved by your in-house network support group, by Progent's team, or by a combination. Read more about Progent's outsourced/co-managed Help Center services.

• Progent Active Defense Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior analysis technology to guard endpoint devices as well as physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which routinely evade traditional signature-matching AV products. Progent ASM services protect on-premises and cloud resources and provides a single platform to address the entire malware attack progression including protection, identification, mitigation, cleanup, and post-attack forensics. Key features include single-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and protect information about your network infrastructure, procedures, applications, and services. You can instantly find passwords or IP addresses and be warned about upcoming expirations of SSL certificates or warranties. By cleaning up and managing your IT infrastructure documentation, you can eliminate as much as half of time thrown away looking for vital information about your network. ProSight IT Asset Management features a common repository for holding and collaborating on all documents required for managing your business network like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and relating IT data. Whether you're making enhancements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a flexible and cost-effective alternative for evaluating, validating, scheduling, applying, and tracking updates to your ever-evolving information network. Besides optimizing the security and reliability of your computer network, Progent's patch management services free up time for your IT team to concentrate on line-of-business projects and tasks that derive the highest business value from your information network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a secure Tier III data center on a high-performance virtual host configured and managed by Progent's network support experts. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system platforms, and the apps. Because the environment is virtualized, it can be moved easily to a different hosting solution without a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's cutting edge behavior machine learning tools to defend physical and virtual endpoint devices against modern malware assaults such as ransomware and email phishing, which routinely escape traditional signature-based AV tools. ProSight Active Security Monitoring safeguards local and cloud-based resources and offers a single platform to manage the complete malware attack progression including protection, infiltration detection, mitigation, cleanup, and post-attack forensics. Top capabilities include one-click rollback using Windows VSS and real-time network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer economical multi-layer protection for physical servers and virtual machines, desktops, mobile devices, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced heuristics for continuously monitoring and responding to security threats from all attack vectors. ProSight ESP provides two-way firewall protection, intrusion alerts, endpoint management, and web filtering through cutting-edge tools packaged within a single agent managed from a single control. Progent's data protection and virtualization experts can help you to plan and configure a ProSight ESP deployment that addresses your organization's unique needs and that helps you prove compliance with government and industry information protection regulations. Progent will help you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that call for immediate attention. Progent can also help your company to install and test a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous security attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.