24x7x365 Minnetonka Emergency Ransomware
Virus Damage Assessment and Removal Services

Ransomware : Your Feared Information Technology Disaster
Ransomware has become an escalating cyberplague that presents an enterprise-level danger for businesses vulnerable to an assault. Multiple generations of ransomware such as Dharma, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for years and still cause destruction. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, along with frequent unnamed malware, not only do encryption of online data files but also infect any configured system protection. Data synchronized to the cloud can also be ransomed. In a poorly architected data protection solution, this can render automatic recovery useless and effectively knocks the network back to square one.

Retrieving services and data after a crypto-ransomware intrusion becomes a race against the clock as the targeted organization tries its best to contain the damage, remove the virus, and resume mission-critical operations. Because ransomware requires time to move laterally, penetrations are often sprung during nights and weekends, when attacks may take longer to uncover. This multiplies the difficulty of rapidly mobilizing and coordinating a capable mitigation team.

Progent offers a variety of support services for protecting businesses from ransomware events. These include user training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with setup and configuration of modern security gateways with artificial intelligence technology from SentinelOne to discover and disable zero-day cyber threats quickly. Progent also can provide the assistance of veteran ransomware recovery professionals with the track record and perseverance to re-deploy a compromised environment as quickly as possible.

Progent's Crypto-Ransomware Recovery Services
Following a ransomware attack, sending the ransom in cryptocurrency does not provide any assurance that cyber hackers will return the needed keys to unencrypt any or all of your files. Kaspersky determined that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to piece back together the essential parts of your IT environment. Without access to full information backups, this calls for a wide range of skills, top notch project management, and the willingness to work 24x7 until the job is finished.

For two decades, Progent has provided expert Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained top industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial systems and ERP software solutions. This breadth of experience affords Progent the skills to quickly understand necessary systems and organize the surviving parts of your Information Technology environment following a ransomware attack and assemble them into an operational network.

Progent's security group deploys best of breed project management tools to coordinate the sophisticated recovery process. Progent appreciates the urgency of acting quickly and in unison with a customer's management and Information Technology team members to prioritize tasks and to get essential services back online as soon as humanly possible.

Customer Case Study: A Successful Ransomware Intrusion Response
A client hired Progent after their network system was penetrated by Ryuk crypto-ransomware. Ryuk is believed to have been created by North Korean state criminal gangs, possibly using algorithms exposed from the U.S. NSA organization. Ryuk targets specific companies with limited ability to sustain operational disruption and is one of the most profitable examples of ransomware malware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in the Chicago metro area and has about 500 staff members. The Ryuk attack had shut down all company operations and manufacturing capabilities. Most of the client's data backups had been on-line at the start of the attack and were encrypted. The client was actively seeking loans for paying the ransom (exceeding $200K) and hoping for the best, but ultimately made the decision to use Progent.

Progent worked together with the customer to rapidly determine and prioritize the critical elements that needed to be restored in order to restart departmental operations:

• Active Directory (AD)
• Email
• Financials/MRP

In less than 2 days, Progent was able to re-build Active Directory to its pre-penetration state. Progent then helped perform reinstallations and storage recovery of critical applications. All Microsoft Exchange Server data and configuration information were usable, which facilitated the restore of Exchange. Progent was also able to collect intact OST data files (Outlook Offline Data Files) on various workstations and laptops to recover mail information. A not too old off-line backup of the businesses financials/MRP systems made it possible to return these essential applications back online for users. Although a large amount of work still had to be done to recover totally from the Ryuk damage, essential services were recovered rapidly:

During the following month important milestones in the restoration process were achieved in close cooperation between Progent consultants and the customer:

• Self-hosted web sites were brought back up without losing any data.
• The MailStore Exchange Server with over four million historical emails was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable (AP)/AR/Inventory functions were 100 percent restored.
• A new Palo Alto Networks 850 security appliance was brought on-line.
• Most of the user PCs were functioning as before the incident.

Conclusion
A probable company-ending disaster was avoided through the efforts of top-tier experts, a wide array of subject matter expertise, and tight teamwork. Although in post mortem the crypto-ransomware virus incident detailed here should have been identified and disabled with up-to-date security technology and NIST Cybersecurity Framework best practices, user training, and appropriate incident response procedures for data backup and applying software patches, the reality is that state-sponsored hackers from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware attack, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus blocking, removal, and file recovery.

To read or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Minnetonka a range of online monitoring and security evaluation services to help you to minimize the threat from ransomware. These services utilize next-generation artificial intelligence technology to detect zero-day strains of ransomware that can evade traditional signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve leading-edge network resilience. Progent takes care of the daily monitoring and maintenance for you, so your network scales readily without holding you back. For a low and predictable monthly price, Progent's full-service IT group can be your complete technology safety net. Basic plans include remote monitoring and management, cybersecurity, monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) techniques to keep your IT system running at peak levels by checking the state of critical computers that drive your business network. When ProSight LAN Watch uncovers an issue, an alert is transmitted immediately to your designated IT staff and your assigned Progent engineering consultant so all looming issues can be resolved before they have a chance to impact your network. Learn more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven solution for managing your network, server, and desktop devices by offering tools for performing common time-consuming jobs. These include health checking, patch management, automated repairs, endpoint deployment, backup and recovery, A/V protection, remote access, standard and custom scripts, asset inventory, endpoint profile reports, and troubleshooting help. If ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alert to your designated IT management staff and your assigned Progent consultant so that emerging issues can be taken care of before they interfere with your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized businesses to map out, monitor, reconfigure and debug their networking appliances such as routers, firewalls, and access points as well as servers, printers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network diagrams are kept current, captures and manages the configuration information of virtually all devices on your network, monitors performance, and generates notices when issues are detected. By automating time-consuming management processes, ProSight WAN Watch can cut hours off ordinary tasks such as network mapping, reconfiguring your network, finding devices that require critical software patches, or resolving performance problems. Find out more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding suite of real-time and in-depth management reporting utilities created to integrate with the industry's leading ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues such as inconsistent support follow-through or machines with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup/restore software companies to produce ProSight Data Protection Services, a family of offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and track your data backup processes and allow non-disruptive backup and fast restoration of vital files, apps, images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss resulting from hardware failures, natural disasters, fire, cyber attacks like ransomware, human mistakes, ill-intentioned employees, or application bugs. Managed services in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can help you to determine which of these fully managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of top information security companies to deliver centralized management and world-class protection for your inbound and outbound email. The hybrid architecture of Progent's Email Guard integrates cloud-based filtering with an on-premises gateway device to provide complete defense against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The cloud filter acts as a preliminary barricade and keeps most unwanted email from reaching your security perimeter. This decreases your vulnerability to inbound threats and saves network bandwidth and storage space. Email Guard's onsite gateway appliance adds a further level of analysis for inbound email. For outgoing email, the on-premises gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The on-premises gateway can also help Exchange Server to track and protect internal email that originates and ends inside your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication managed services utilize Cisco's Duo technology to defend against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. With 2FA, whenever you sign into a protected online account and give your password you are asked to verify who you are on a device that only you possess and that uses a different network channel. A broad selection of devices can be utilized as this second means of authentication including a smartphone or watch, a hardware/software token, a landline telephone, etc. You can register multiple validation devices. For more information about ProSight Duo identity authentication services, go to Duo MFA two-factor authentication services for access security.

• Outsourced/Co-managed Call Desk: Call Center Managed Services
  Progent's Support Center services enable your IT staff to offload Help Desk services to Progent or divide activity for support services transparently between your in-house support staff and Progent's nationwide pool of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a seamless supplement to your corporate support team. Client interaction with the Service Desk, provision of support, escalation, ticket generation and tracking, performance measurement, and management of the support database are consistent regardless of whether incidents are resolved by your corporate network support staff, by Progent, or by a combination. Learn more about Progent's outsourced/shared Service Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) service that incorporates cutting edge behavior-based analysis tools to defend endpoint devices as well as servers and VMs against new malware assaults such as ransomware and email phishing, which easily evade legacy signature-based AV products. Progent Active Security Monitoring services protect on-premises and cloud-based resources and offers a single platform to address the complete malware attack progression including blocking, identification, mitigation, cleanup, and forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, retrieve and protect information about your IT infrastructure, processes, applications, and services. You can quickly locate passwords or serial numbers and be alerted automatically about impending expirations of SSL certificates or domains. By updating and managing your IT documentation, you can eliminate as much as 50% of time spent trying to find critical information about your IT network. ProSight IT Asset Management includes a centralized repository for storing and sharing all documents related to managing your network infrastructure such as recommended procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT information. Whether you're making enhancements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management gets you the data you need when you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for patch management provide businesses of all sizes a versatile and cost-effective alternative for assessing, validating, scheduling, implementing, and tracking software and firmware updates to your dynamic information network. In addition to maximizing the security and reliability of your IT environment, Progent's patch management services free up time for your in-house IT staff to concentrate on more strategic projects and tasks that deliver maximum business value from your network. Learn more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its key servers and applications hosted in a secure Tier III data center on a fast virtual host configured and maintained by Progent's IT support professionals. With the ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system platforms, and the apps. Since the system is virtualized, it can be ported easily to a different hardware solution without requiring a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not locked into a single hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's cutting edge behavior-based machine learning tools to guard physical and virtual endpoints against new malware assaults like ransomware and file-less exploits, which easily evade traditional signature-based AV tools. ProSight ASM safeguards local and cloud-based resources and provides a single platform to address the entire threat lifecycle including protection, identification, mitigation, remediation, and forensics. Top capabilities include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services deliver affordable multi-layer protection for physical servers and VMs, desktops, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and advanced heuristics for round-the-clock monitoring and responding to cyber assaults from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alarms, endpoint management, and web filtering via leading-edge technologies packaged within a single agent accessible from a unified control. Progent's security and virtualization consultants can assist your business to design and configure a ProSight ESP deployment that meets your organization's unique needs and that helps you prove compliance with government and industry information security standards. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that require immediate attention. Progent's consultants can also help your company to install and test a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover rapidly from a potentially disastrous security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.