24x7x365 Dayton Immediate Ransomware
Virus Damage Assessment and Removal Help

Crypto-Ransomware : Your Worst IT Catastrophe
Ransomware has become an escalating cyber pandemic that represents an existential threat for organizations poorly prepared for an attack. Different iterations of crypto-ransomware such as CryptoLocker, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been circulating for years and still cause havoc. Modern versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, along with additional unnamed viruses, not only do encryption of on-line files but also infiltrate most configured system protection. Data synched to off-site disaster recovery sites can also be held hostage. In a poorly designed environment, it can make automatic recovery impossible and basically knocks the network back to zero.

Restoring services and data after a crypto-ransomware outage becomes a sprint against time as the victim tries its best to stop the spread, clear the ransomware, and resume enterprise-critical activity. Due to the fact that crypto-ransomware takes time to move laterally, attacks are frequently launched on weekends and holidays, when successful attacks in many cases take longer to identify. This compounds the difficulty of promptly assembling and coordinating a knowledgeable response team.

Progent makes available a range of services for securing businesses from crypto-ransomware events. These include user training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of the latest generation security appliances with AI technology from SentinelOne to discover and quarantine zero-day threats quickly. Progent also can provide the services of expert crypto-ransomware recovery engineers with the talent and commitment to restore a breached environment as quickly as possible.

Progent's Ransomware Restoration Help
Following a ransomware penetration, paying the ransom in cryptocurrency does not guarantee that merciless criminals will respond with the codes to decrypt any of your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to setup from scratch the key elements of your Information Technology environment. Without access to full system backups, this calls for a broad complement of skills, top notch project management, and the capability to work 24x7 until the recovery project is completed.

For twenty years, Progent has offered certified expert Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have earned high-level certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP application software. This breadth of experience affords Progent the skills to quickly understand critical systems and consolidate the remaining pieces of your Information Technology system following a crypto-ransomware penetration and rebuild them into a functioning system.

Progent's recovery team deploys state-of-the-art project management applications to orchestrate the complex restoration process. Progent knows the urgency of acting swiftly and in concert with a client's management and IT staff to prioritize tasks and to get essential services back on-line as fast as possible.

Client Story: A Successful Ransomware Intrusion Recovery
A customer contacted Progent after their company was brought down by the Ryuk crypto-ransomware. Ryuk is thought to have been created by North Korean state sponsored cybercriminals, possibly using approaches exposed from the U.S. National Security Agency. Ryuk attacks specific businesses with little or no room for disruption and is among the most lucrative versions of crypto-ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business based in the Chicago metro area and has around 500 staff members. The Ryuk intrusion had paralyzed all essential operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the start of the attack and were damaged. The client considered paying the ransom demand (exceeding two hundred thousand dollars) and hoping for the best, but in the end made the decision to use Progent.

Progent worked together with the customer to rapidly understand and prioritize the mission critical systems that had to be recovered in order to continue business operations:

• Microsoft Active Directory
• Email
• Accounting/MRP

Within 48 hours, Progent was able to rebuild Windows Active Directory to its pre-attack state. Progent then helped perform rebuilding and storage recovery on critical servers. All Exchange schema and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to collect local OST files (Outlook Email Off-Line Folder Files) on user workstations and laptops in order to recover email information. A not too old off-line backup of the businesses manufacturing systems made them able to return these required programs back online for users. Although a large amount of work remained to recover fully from the Ryuk damage, critical systems were recovered rapidly:

During the following few weeks important milestones in the restoration process were achieved in tight collaboration between Progent team members and the customer:

• Self-hosted web sites were restored with no loss of information.
• The MailStore Exchange Server containing more than 4 million archived messages was brought online and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control modules were 100 percent recovered.
• A new Palo Alto Networks 850 security appliance was set up and programmed.
• Nearly all of the desktop computers were functioning as before the incident.

Conclusion
A probable business-killing catastrophe was dodged with top-tier professionals, a broad array of subject matter expertise, and tight teamwork. Although in retrospect the ransomware attack described here would have been shut down with up-to-date cyber security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and well thought out incident response procedures for information protection and keeping systems up to date with security patches, the reality is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware penetration, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, removal, and information systems disaster recovery.

To review or download a PDF version of this customer story, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Dayton a portfolio of remote monitoring and security assessment services to assist you to reduce your vulnerability to crypto-ransomware. These services include modern machine learning capability to detect new variants of crypto-ransomware that are able to get past legacy signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) technology to keep your network operating at peak levels by tracking the health of critical assets that power your information system. When ProSight LAN Watch uncovers an issue, an alert is sent automatically to your designated IT management personnel and your Progent engineering consultant so all looming issues can be resolved before they can disrupt your network. Find out more about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for managing your client-server infrastructure by providing tools for streamlining common tedious jobs. These include health monitoring, update management, automated repairs, endpoint deployment, backup and restore, A/V protection, remote access, built-in and custom scripts, resource inventory, endpoint status reporting, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alert to your specified IT management staff and your Progent consultant so emerging problems can be fixed before they interfere with productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for small and mid-sized organizations to map out, track, enhance and troubleshoot their networking hardware such as switches, firewalls, and load balancers as well as servers, endpoints and other devices. Using state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that infrastructure topology maps are always current, copies and displays the configuration information of almost all devices on your network, monitors performance, and generates alerts when problems are detected. By automating tedious management processes, ProSight WAN Watch can knock hours off common chores like network mapping, expanding your network, locating devices that require critical updates, or isolating performance problems. Find out more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of real-time reporting tools designed to work with the industry's top ticketing and remote network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-through or machines with out-of-date AVs. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has partnered with advanced backup technology companies to produce ProSight Data Protection Services (DPS), a family of offerings that deliver backup-as-a-service (BaaS). ProSight DPS services manage and monitor your data backup operations and allow transparent backup and fast recovery of vital files/folders, applications, images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss resulting from equipment breakdown, natural disasters, fire, cyber attacks like ransomware, user error, ill-intentioned insiders, or application bugs. Managed backup services available in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that uses the infrastructure of leading data security companies to deliver centralized management and world-class security for all your email traffic. The hybrid architecture of Email Guard combines cloud-based filtering with a local security gateway device to offer advanced defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's Cloud Protection Layer serves as a first line of defense and blocks most unwanted email from reaching your network firewall. This decreases your exposure to inbound attacks and saves system bandwidth and storage. Email Guard's on-premises gateway appliance provides a deeper level of analysis for inbound email. For outgoing email, the local security gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises security gateway can also help Exchange Server to monitor and protect internal email that originates and ends within your security perimeter. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA managed services utilize Cisco's Duo technology to defend against stolen passwords through the use of two-factor authentication. Duo supports single-tap identity verification on iOS, Google Android, and other out-of-band devices. With 2FA, whenever you log into a protected online account and enter your password you are requested to verify your identity on a device that only you have and that is accessed using a separate network channel. A wide selection of devices can be used as this added form of ID validation such as a smartphone or wearable, a hardware token, a landline phone, etc. You can designate multiple verification devices. For more information about ProSight Duo identity authentication services, see Duo MFA two-factor authentication services.

• Progent's Outsourced/Shared Service Desk: Call Center Managed Services
  Progent's Help Center managed services permit your information technology staff to offload Help Desk services to Progent or split activity for Service Desk support seamlessly between your in-house network support resources and Progent's nationwide pool of IT service engineers and subject matter experts. Progent's Co-managed Service Desk offers a transparent supplement to your in-house support staff. End user access to the Help Desk, provision of support services, issue escalation, ticket generation and updates, performance measurement, and management of the service database are cohesive whether incidents are taken care of by your in-house support organization, by Progent, or both. Learn more about Progent's outsourced/shared Help Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection solution that incorporates cutting edge behavior machine learning technology to guard endpoint devices as well as physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which easily escape legacy signature-based anti-virus tools. Progent Active Security Monitoring services safeguard local and cloud resources and offers a single platform to manage the complete threat lifecycle including blocking, detection, containment, remediation, and forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new threats. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and safeguard information related to your network infrastructure, processes, business apps, and services. You can quickly find passwords or IP addresses and be alerted about upcoming expirations of SSL certificates or warranties. By cleaning up and managing your IT documentation, you can save as much as 50% of time spent looking for critical information about your IT network. ProSight IT Asset Management features a common repository for storing and collaborating on all documents related to managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports advanced automation for gathering and associating IT data. Whether you're planning enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you require when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer businesses of all sizes a versatile and cost-effective solution for evaluating, testing, scheduling, applying, and documenting software and firmware updates to your dynamic IT network. Besides maximizing the protection and functionality of your IT environment, Progent's software/firmware update management services free up time for your in-house IT team to focus on line-of-business initiatives and tasks that derive maximum business value from your network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and apps hosted in a protected fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's network support experts. Under Progent's ProSight Virtual Hosting model, the customer owns the data, the operating system platforms, and the apps. Because the system is virtualized, it can be moved immediately to an alternate hardware solution without a lengthy and technically risky configuration process. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior-based machine learning tools to guard physical and virtual endpoint devices against new malware assaults such as ransomware and email phishing, which routinely evade traditional signature-based anti-virus tools. ProSight ASM protects on-premises and cloud-based resources and offers a single platform to automate the complete malware attack progression including blocking, identification, mitigation, cleanup, and post-attack forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection managed services offer economical multi-layer protection for physical servers and virtual machines, workstations, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and modern behavior analysis for round-the-clock monitoring and reacting to cyber assaults from all vectors. ProSight ESP offers firewall protection, intrusion alarms, endpoint management, and web filtering through leading-edge technologies incorporated within a single agent accessible from a single control. Progent's security and virtualization experts can help you to design and configure a ProSight ESP environment that addresses your organization's unique requirements and that allows you achieve and demonstrate compliance with government and industry information protection regulations. Progent will help you define and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that call for urgent attention. Progent's consultants can also help you to install and verify a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous security attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Microsoft Exchange filtering.