24-7 Bellevue Immediate Ransomware
Malware Identification and Restoration Support

Ransomware : Your Feared Information Technology Disaster
Ransomware has become a modern cyberplague that represents an extinction-level danger for businesses of all sizes poorly prepared for an attack. Multiple generations of ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been running rampant for many years and continue to cause havoc. The latest strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, along with additional unnamed newcomers, not only do encryption of on-line files but also infiltrate most configured system protection. Data synched to off-site disaster recovery sites can also be corrupted. In a vulnerable environment, this can make automated restoration hopeless and effectively knocks the datacenter back to square one.

Getting back online services and data following a ransomware event becomes a sprint against time as the victim tries its best to stop the spread, eradicate the ransomware, and resume mission-critical activity. Since crypto-ransomware needs time to replicate, assaults are often launched on weekends and holidays, when successful attacks tend to take more time to detect. This compounds the difficulty of rapidly marshalling and coordinating a knowledgeable mitigation team.

Progent makes available a variety of help services for protecting businesses from ransomware events. Among these are user education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of the latest generation security solutions with machine learning technology from SentinelOne to identify and quarantine new cyber attacks automatically. Progent in addition can provide the assistance of expert crypto-ransomware recovery consultants with the track record and perseverance to reconstruct a breached network as urgently as possible.

Progent's Ransomware Recovery Services
Following a ransomware invasion, paying the ransom in cryptocurrency does not guarantee that criminal gangs will provide the keys to decipher any of your information. Kaspersky Labs estimated that 17% of ransomware victims never recovered their files even after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The fallback is to piece back together the mission-critical components of your IT environment. Absent the availability of essential data backups, this requires a wide complement of IT skills, professional team management, and the capability to work 24x7 until the job is finished.

For decades, Progent has made available certified expert IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained advanced industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of experience provides Progent the ability to quickly ascertain critical systems and organize the surviving components of your computer network system following a ransomware event and assemble them into an operational network.

Progent's recovery team uses powerful project management systems to orchestrate the complex restoration process. Progent appreciates the importance of acting rapidly and in unison with a client's management and Information Technology staff to prioritize tasks and to get essential systems back on line as soon as humanly possible.

Business Case Study: A Successful Ransomware Penetration Recovery
A client engaged Progent after their company was attacked by the Ryuk crypto-ransomware. Ryuk is believed to have been developed by Northern Korean state sponsored criminal gangs, possibly adopting algorithms leaked from America's National Security Agency. Ryuk attacks specific businesses with little or no tolerance for operational disruption and is among the most lucrative instances of ransomware malware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in the Chicago metro area and has around 500 workers. The Ryuk intrusion had paralyzed all company operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the time of the attack and were encrypted. The client considered paying the ransom demand (in excess of $200K) and wishfully thinking for the best, but in the end brought in Progent.

Progent worked together with the customer to rapidly assess and assign priority to the most important areas that needed to be recovered to make it possible to restart business functions:

• Microsoft Active Directory
• Electronic Mail
• Accounting/MRP

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-intrusion state. Progent then completed setup and hard drive recovery on essential systems. All Exchange data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to locate local OST files (Microsoft Outlook Off-Line Folder Files) on user PCs to recover email messages. A not too old off-line backup of the customer's accounting software made it possible to recover these essential programs back on-line. Although significant work needed to be completed to recover totally from the Ryuk virus, essential services were restored quickly:

During the next couple of weeks key milestones in the recovery project were accomplished through close cooperation between Progent engineers and the client:

• In-house web applications were brought back up without losing any data.
• The MailStore Exchange Server exceeding 4 million historical messages was brought online and available for users.
• CRM/Customer Orders/Invoicing/AP/Accounts Receivables/Inventory modules were completely operational.
• A new Palo Alto 850 security appliance was installed and configured.
• Most of the user desktops and notebooks were functioning as before the incident.

Conclusion
A probable business-killing disaster was avoided through the efforts of dedicated professionals, a broad spectrum of knowledge, and tight teamwork. Although in post mortem the crypto-ransomware virus penetration detailed here would have been blocked with modern security technology solutions and best practices, user training, and appropriate incident response procedures for information backup and proper patching controls, the reality remains that state-sponsored criminal cyber gangs from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware virus, feel confident that Progent's roster of experts has a proven track record in crypto-ransomware virus defense, remediation, and file restoration.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Bellevue a range of online monitoring and security assessment services designed to help you to reduce your vulnerability to ransomware. These services utilize modern machine learning capability to uncover new strains of ransomware that can escape detection by legacy signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your network expands readily without holding you back. For a low and predictable monthly subscription, Progent's experienced IT team can be your complete technology safety net. Entry-level packages include RMM, security, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management (RMM) techniques to keep your network running efficiently by checking the state of vital assets that power your information system. When ProSight LAN Watch detects an issue, an alert is sent immediately to your specified IT management personnel and your assigned Progent consultant so that all potential problems can be addressed before they have a chance to disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for monitoring and managing your client-server infrastructure by providing an environment for streamlining common tedious tasks. These can include health checking, patch management, automated repairs, endpoint deployment, backup and recovery, anti-virus defense, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and debugging assistance. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alert to your designated IT management personnel and your assigned Progent technical consultant so that emerging problems can be fixed before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized organizations to map out, monitor, enhance and debug their connectivity appliances such as routers, firewalls, and wireless controllers as well as servers, printers, client computers and other networked devices. Using state-of-the-art RMM technology, ProSight WAN Watch ensures that infrastructure topology diagrams are always current, captures and displays the configuration of almost all devices connected to your network, monitors performance, and sends notices when problems are discovered. By automating complex management and troubleshooting activities, ProSight WAN Watch can knock hours off ordinary chores like making network diagrams, reconfiguring your network, locating appliances that need important updates, or resolving performance issues. Find out more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time and in-depth reporting tools designed to integrate with the industry's top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues like spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has worked with leading backup/restore software providers to create ProSight Data Protection Services, a portfolio of offerings that deliver backup-as-a-service. ProSight DPS services automate and monitor your data backup processes and allow non-disruptive backup and rapid recovery of important files/folders, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business protect against data loss resulting from equipment breakdown, natural disasters, fire, cyber attacks like ransomware, human mistakes, ill-intentioned employees, or application bugs. Managed backup services in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of leading information security companies to deliver centralized management and world-class security for all your inbound and outbound email. The powerful architecture of Progent's Email Guard integrates cloud-based filtering with a local gateway device to offer complete defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne malware. The Cloud Protection Layer serves as a first line of defense and blocks most threats from reaching your security perimeter. This decreases your vulnerability to inbound attacks and saves system bandwidth and storage space. Email Guard's on-premises gateway device provides a further layer of inspection for inbound email. For outgoing email, the onsite security gateway provides AV and anti-spam protection, DLP, and email encryption. The onsite security gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends within your security perimeter. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication services incorporate Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication. Duo enables single-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. With 2FA, when you log into a protected application and enter your password you are asked to confirm your identity via a device that only you possess and that uses a different ("out-of-band") network channel. A wide range of out-of-band devices can be utilized for this added form of authentication such as a smartphone or watch, a hardware token, a landline phone, etc. You can register multiple verification devices. For details about ProSight Duo identity validation services, see Cisco Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Help Center services enable your information technology staff to outsource Help Desk services to Progent or divide responsibilities for support services seamlessly between your in-house network support staff and Progent's extensive roster of IT support technicians, engineers and subject matter experts. Progent's Shared Help Desk Service provides a smooth extension of your core network support resources. End user interaction with the Help Desk, delivery of support services, issue escalation, ticket generation and updates, efficiency measurement, and maintenance of the support database are consistent whether incidents are resolved by your in-house support organization, by Progent's team, or both. Learn more about Progent's outsourced/shared Service Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection service that utilizes next generation behavior-based machine learning tools to defend endpoints and physical and virtual servers against modern malware assaults such as ransomware and file-less exploits, which easily escape legacy signature-based anti-virus tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and provides a unified platform to manage the complete threat lifecycle including blocking, detection, containment, cleanup, and post-attack forensics. Key capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against new attacks. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and safeguard information related to your IT infrastructure, procedures, business apps, and services. You can instantly locate passwords or serial numbers and be warned automatically about upcoming expirations of SSL certificates or warranties. By cleaning up and organizing your IT infrastructure documentation, you can eliminate as much as 50% of time wasted trying to find vital information about your IT network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents required for managing your network infrastructure such as recommended procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for gathering and relating IT information. Whether you're making improvements, doing regular maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the data you require when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for patch management offer organizations of all sizes a versatile and cost-effective alternative for assessing, testing, scheduling, implementing, and documenting software and firmware updates to your dynamic information network. Besides optimizing the security and functionality of your computer environment, Progent's patch management services allow your in-house IT team to focus on line-of-business initiatives and activities that derive the highest business value from your information network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a protected Tier III data center on a fast virtual host configured and maintained by Progent's network support experts. Under the ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the apps. Since the system is virtualized, it can be moved immediately to a different hosting environment without a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior-based machine learning tools to guard physical and virtual endpoint devices against modern malware assaults like ransomware and file-less exploits, which routinely get by traditional signature-based AV tools. ProSight ASM safeguards on-premises and cloud resources and offers a single platform to address the complete threat progression including protection, infiltration detection, containment, remediation, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer ultra-affordable multi-layer protection for physical servers and virtual machines, workstations, smartphones, and Exchange Server. ProSight ESP utilizes adaptive security and advanced machine learning for round-the-clock monitoring and responding to security assaults from all vectors. ProSight ESP provides firewall protection, intrusion alarms, endpoint control, and web filtering through cutting-edge technologies incorporated within a single agent accessible from a single console. Progent's security and virtualization experts can assist you to plan and configure a ProSight ESP deployment that meets your company's unique requirements and that helps you achieve and demonstrate compliance with government and industry information security regulations. Progent will assist you define and implement policies that ProSight ESP will enforce, and Progent will monitor your network and react to alerts that call for immediate attention. Progent can also assist you to set up and test a backup and disaster recovery system such as ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous cyber attack such as ransomware. Read more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange email filtering.