24-Hour Anchorage Emergency Ransomware
Computer Malware Detection and Removal Experts

Ransomware : Your Worst IT Catastrophe
Ransomware has become an escalating cyber pandemic that presents an enterprise-level threat for organizations unprepared for an assault. Different iterations of ransomware like the CryptoLocker, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for many years and still inflict havoc. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, along with daily as yet unnamed viruses, not only encrypt online data but also infiltrate many accessible system protection mechanisms. Data synchronized to cloud environments can also be ransomed. In a poorly architected system, this can render automatic restore operations useless and effectively sets the datacenter back to zero.

Getting back online applications and information after a crypto-ransomware attack becomes a race against the clock as the targeted organization tries its best to stop lateral movement, cleanup the crypto-ransomware, and resume business-critical operations. Since ransomware takes time to move laterally, attacks are often launched during weekends and nights, when successful penetrations may take longer to identify. This compounds the difficulty of promptly mobilizing and coordinating an experienced response team.

Progent has a range of help services for protecting enterprises from ransomware penetrations. These include user training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of the latest generation security appliances with machine learning capabilities from SentinelOne to detect and extinguish day-zero cyber threats quickly. Progent in addition offers the services of veteran crypto-ransomware recovery consultants with the talent and commitment to restore a compromised system as quickly as possible.

Progent's Ransomware Restoration Help
Following a ransomware invasion, sending the ransom in cryptocurrency does not guarantee that cyber hackers will provide the needed codes to unencrypt any of your information. Kaspersky determined that 17% of ransomware victims never recovered their information even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The fallback is to re-install the mission-critical components of your Information Technology environment. Absent the availability of complete system backups, this calls for a wide complement of skills, well-coordinated team management, and the capability to work continuously until the task is done.

For two decades, Progent has offered expert IT services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained top industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP applications. This breadth of expertise affords Progent the capability to knowledgably identify important systems and re-organize the remaining components of your network system following a ransomware event and assemble them into a functioning system.

Progent's ransomware team uses powerful project management systems to orchestrate the complex recovery process. Progent appreciates the importance of working quickly and in unison with a client's management and IT team members to assign priority to tasks and to put key applications back on-line as soon as humanly possible.

Client Case Study: A Successful Ransomware Intrusion Restoration
A customer sought out Progent after their company was penetrated by the Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state sponsored criminal gangs, suspected of adopting strategies leaked from America's NSA organization. Ryuk targets specific organizations with little or no ability to sustain disruption and is one of the most profitable examples of ransomware. Major targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in the Chicago metro area and has around 500 employees. The Ryuk penetration had brought down all essential operations and manufacturing processes. The majority of the client's information backups had been online at the time of the intrusion and were destroyed. The client was pursuing financing for paying the ransom (more than two hundred thousand dollars) and hoping for good luck, but in the end called Progent.

Progent worked hand in hand the client to rapidly determine and assign priority to the essential applications that needed to be recovered in order to resume business operations:

• Microsoft Active Directory
• Microsoft Exchange Server
• Accounting/MRP

In less than 2 days, Progent was able to re-build Active Directory services to its pre-intrusion state. Progent then accomplished reinstallations and storage recovery of key systems. All Exchange Server data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to assemble intact OST data files (Outlook Email Offline Data Files) on various PCs and laptops to recover email data. A recent offline backup of the client's accounting/ERP systems made them able to return these essential applications back online. Although a lot of work was left to recover fully from the Ryuk damage, the most important systems were returned to operations quickly:

During the next couple of weeks important milestones in the recovery project were achieved in tight collaboration between Progent team members and the client:

• In-house web applications were brought back up without losing any data.
• The MailStore Server with over 4 million archived emails was brought online and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory Control modules were 100% operational.
• A new Palo Alto 850 security appliance was set up and programmed.
• Most of the user desktops were being used by staff.

Conclusion
A potential business-ending catastrophe was avoided with top-tier experts, a wide array of subject matter expertise, and close collaboration. Although in post mortem the ransomware penetration detailed here would have been stopped with up-to-date security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator education, and well designed incident response procedures for information protection and keeping systems up to date with security patches, the fact is that state-sponsored hackers from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware virus, remember that Progent's roster of professionals has substantial experience in ransomware virus blocking, remediation, and information systems disaster recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent can provide businesses in Anchorage a variety of remote monitoring and security evaluation services designed to help you to reduce your vulnerability to crypto-ransomware. These services incorporate modern AI technology to detect new strains of crypto-ransomware that can get past traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your network scales smoothly without holding you back. For a low and predictable monthly price, Progent's full-service IT team can be your dependable technology safety net. Basic packages include remote monitoring and management, cybersecurity, automatic monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to best-in-class solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses advanced remote monitoring and management techniques to keep your IT system running efficiently by tracking the health of critical assets that power your information system. When ProSight LAN Watch detects a problem, an alert is sent immediately to your specified IT management staff and your assigned Progent engineering consultant so any potential issues can be resolved before they can disrupt your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for monitoring and managing your client-server infrastructure by providing tools for streamlining common time-consuming tasks. These can include health checking, patch management, automated repairs, endpoint deployment, backup and recovery, anti-virus protection, remote access, built-in and custom scripts, asset inventory, endpoint status reports, and debugging support. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it sends an alert to your designated IT management personnel and your Progent consultant so that emerging problems can be taken care of before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it simple and inexpensive for smaller organizations to map out, monitor, reconfigure and troubleshoot their connectivity appliances such as routers and switches, firewalls, and access points as well as servers, printers, client computers and other devices. Using cutting-edge RMM technology, WAN Watch ensures that infrastructure topology maps are always updated, captures and manages the configuration of almost all devices on your network, tracks performance, and generates alerts when issues are detected. By automating tedious network management processes, ProSight WAN Watch can cut hours off ordinary tasks such as network mapping, reconfiguring your network, locating appliances that need important software patches, or identifying the cause of performance bottlenecks. Find out more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of in-depth management reporting tools designed to work with the leading ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with leading backup technology providers to produce ProSight Data Protection Services (DPS), a portfolio of management offerings that deliver backup-as-a-service. ProSight DPS services automate and track your backup processes and enable transparent backup and fast recovery of important files/folders, apps, images, and virtual machines. ProSight DPS helps you avoid data loss resulting from hardware breakdown, natural disasters, fire, cyber attacks like ransomware, human error, ill-intentioned insiders, or application bugs. Managed services available in the ProSight DPS product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading data security vendors to provide web-based management and comprehensive security for all your inbound and outbound email. The hybrid architecture of Progent's Email Guard integrates a Cloud Protection Layer with an on-premises gateway appliance to provide complete defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-based threats. The Cloud Protection Layer acts as a preliminary barricade and blocks most threats from reaching your network firewall. This reduces your vulnerability to inbound attacks and saves network bandwidth and storage space. Email Guard's onsite gateway appliance adds a further level of inspection for inbound email. For outgoing email, the on-premises security gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also help Microsoft Exchange Server to track and protect internal email that stays within your corporate firewall. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA services incorporate Cisco's Duo cloud technology to defend against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. With 2FA, when you sign into a secured online account and give your password you are requested to confirm your identity on a unit that only you have and that is accessed using a separate network channel. A wide range of devices can be utilized as this second form of authentication such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can register multiple validation devices. To find out more about ProSight Duo identity validation services, see Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Center: Call Center Managed Services
  Progent's Call Desk managed services permit your IT group to offload Help Desk services to Progent or divide activity for Service Desk support seamlessly between your in-house support group and Progent's extensive pool of certified IT support engineers and subject matter experts. Progent's Shared Service Desk offers a transparent extension of your in-house support staff. User interaction with the Service Desk, provision of support services, escalation, ticket creation and updates, efficiency metrics, and management of the service database are consistent regardless of whether issues are taken care of by your core support resources, by Progent, or both. Read more about Progent's outsourced/co-managed Service Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior machine learning technology to defend endpoints and physical and virtual servers against new malware assaults such as ransomware and email phishing, which routinely evade legacy signature-matching AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud-based resources and offers a unified platform to manage the complete threat lifecycle including blocking, identification, mitigation, cleanup, and post-attack forensics. Key features include single-click rollback using Windows VSS and automatic system-wide immunization against newly discovered threats. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, find and safeguard data about your IT infrastructure, procedures, business apps, and services. You can quickly find passwords or serial numbers and be warned automatically about impending expirations of SSL certificates ,domains or warranties. By cleaning up and organizing your network documentation, you can save up to half of time spent trying to find vital information about your network. ProSight IT Asset Management includes a centralized repository for storing and sharing all documents required for managing your network infrastructure like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're making improvements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the information you require when you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management offer businesses of any size a versatile and affordable alternative for evaluating, testing, scheduling, applying, and tracking updates to your ever-evolving IT system. In addition to maximizing the protection and functionality of your IT network, Progent's software/firmware update management services permit your IT staff to concentrate on line-of-business projects and tasks that derive the highest business value from your network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a protected Tier III data center on a high-performance virtual host configured and maintained by Progent's network support professionals. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the operating system software, and the apps. Because the environment is virtualized, it can be moved immediately to an alternate hosting solution without requiring a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoints against new malware assaults like ransomware and email phishing, which easily evade traditional signature-matching anti-virus products. ProSight Active Security Monitoring protects on-premises and cloud resources and provides a unified platform to manage the complete threat progression including filtering, detection, mitigation, cleanup, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection (ESP) services offer ultra-affordable in-depth security for physical servers and virtual machines, desktops, smartphones, and Microsoft Exchange. ProSight ESP utilizes adaptive security and advanced heuristics for continuously monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP provides two-way firewall protection, penetration alarms, endpoint control, and web filtering via cutting-edge tools incorporated within a single agent accessible from a single console. Progent's data protection and virtualization consultants can assist your business to plan and implement a ProSight ESP environment that addresses your organization's specific requirements and that helps you prove compliance with legal and industry information security standards. Progent will help you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that require urgent action. Progent's consultants can also assist your company to set up and test a backup and restore solution such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Exchange email filtering.