St. Paul 24-Hour Immediate CryptoLocker
Computer Virus Identification and Recovery Support

Ransomware : Your Crippling IT Nightmare
Ransomware has become an escalating cyber pandemic that presents an enterprise-level danger for businesses of all sizes vulnerable to an attack. Versions of crypto-ransomware such as Dharma, Fusob, Locky, Syskey and MongoLock cryptoworms have been replicating for years and continue to inflict havoc. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, as well as daily as yet unnamed malware, not only do encryption of on-line files but also infiltrate many configured system protection mechanisms. Data synchronized to the cloud can also be ransomed. In a vulnerable system, this can make any restore operations hopeless and effectively knocks the network back to square one.

Getting back online applications and information following a ransomware event becomes a sprint against the clock as the targeted business fights to contain, cleanup the crypto-ransomware, and resume business-critical activity. Because ransomware requires time to spread, attacks are often sprung at night, when attacks typically take more time to notice. This multiplies the difficulty of promptly assembling and organizing a qualified response team.

Progent has a range of solutions for securing businesses from ransomware events. These include team training to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to setup and configuration of modern security solutions with AI technology from SentinelOne to identify and quarantine zero-day threats quickly. Progent in addition can provide the assistance of seasoned ransomware recovery consultants with the talent and commitment to reconstruct a compromised network as soon as possible.

Progent's Crypto-Ransomware Restoration Help
After a ransomware invasion, paying the ransom in cryptocurrency does not guarantee that merciless criminals will provide the needed keys to unencrypt any of your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The fallback is to piece back together the mission-critical elements of your Information Technology environment. Absent access to complete system backups, this calls for a broad complement of skill sets, professional project management, and the willingness to work continuously until the recovery project is complete.

For twenty years, Progent has offered certified expert IT services for companies throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have attained advanced certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial systems and ERP software solutions. This breadth of experience gives Progent the skills to efficiently identify important systems and integrate the surviving parts of your Information Technology system after a ransomware attack and rebuild them into a functioning system.

Progent's recovery team of experts uses state-of-the-art project management applications to coordinate the sophisticated recovery process. Progent appreciates the urgency of working swiftly and in concert with a customer's management and Information Technology staff to assign priority to tasks and to get key systems back online as soon as possible.

Client Case Study: A Successful Crypto-Ransomware Virus Response
A small business contacted Progent after their company was attacked by Ryuk ransomware. Ryuk is generally considered to have been created by North Korean state criminal gangs, possibly using algorithms exposed from America's National Security Agency. Ryuk attacks specific companies with limited tolerance for operational disruption and is among the most profitable instances of ransomware viruses. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in Chicago and has about 500 staff members. The Ryuk event had frozen all company operations and manufacturing processes. The majority of the client's backups had been online at the start of the attack and were encrypted. The client considered paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but ultimately engaged Progent.

Progent worked hand in hand the customer to quickly get our arms around and prioritize the most important systems that had to be recovered in order to restart company functions:

• Windows Active Directory
• Email
• MRP System

In less than 48 hours, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then assisted with setup and storage recovery on key systems. All Exchange Server ties and attributes were intact, which facilitated the restore of Exchange. Progent was able to locate non-encrypted OST files (Microsoft Outlook Off-Line Folder Files) on team desktop computers and laptops to recover mail information. A recent off-line backup of the businesses accounting/ERP software made it possible to restore these required services back available to users. Although significant work remained to recover fully from the Ryuk damage, the most important systems were recovered rapidly:

Throughout the next month important milestones in the recovery project were made in close cooperation between Progent engineers and the client:

• Internal web sites were brought back up without losing any data.
• The MailStore Server exceeding four million historical messages was brought online and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory Control functions were 100 percent functional.
• A new Palo Alto 850 security appliance was set up and programmed.
• Nearly all of the desktops and laptops were being used by staff.

Conclusion
A possible business catastrophe was avoided with top-tier professionals, a broad array of subject matter expertise, and close collaboration. Although in hindsight the ransomware virus incident detailed here would have been identified and stopped with up-to-date cyber security solutions and NIST Cybersecurity Framework best practices, user education, and appropriate security procedures for backup and applying software patches, the reality remains that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and will continue. If you do fall victim to a ransomware incident, remember that Progent's team of professionals has extensive experience in ransomware virus blocking, removal, and file disaster recovery.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in St. Paul a range of online monitoring and security assessment services to assist you to reduce your vulnerability to crypto-ransomware. These services include next-generation machine learning technology to detect zero-day strains of crypto-ransomware that can evade legacy signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent handles the necessary monitoring and maintenance for you, so your system expands smoothly without becoming an obstacle. For a low and predictable monthly subscription, Progent's full-service IT team can be your complete technology safety net. Basic plans include RMM, cybersecurity, automatic monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management (RMM) techniques to help keep your IT system running at peak levels by tracking the health of vital assets that power your information system. When ProSight LAN Watch detects a problem, an alert is transmitted immediately to your designated IT management personnel and your assigned Progent engineering consultant so all looming problems can be resolved before they can impact your network. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven platform for managing your network, server, and desktop devices by providing tools for streamlining common tedious jobs. These can include health monitoring, update management, automated repairs, endpoint configuration, backup and restore, A/V defense, remote access, standard and custom scripts, resource inventory, endpoint status reports, and debugging support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alert to your designated IT staff and your Progent consultant so potential problems can be taken care of before they impact your network. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for smaller businesses to diagram, monitor, reconfigure and debug their connectivity appliances such as routers and switches, firewalls, and wireless controllers plus servers, client computers and other devices. Using state-of-the-art RMM technology, ProSight WAN Watch ensures that network maps are kept updated, captures and manages the configuration information of almost all devices on your network, monitors performance, and generates notices when problems are discovered. By automating complex management and troubleshooting processes, ProSight WAN Watch can knock hours off ordinary tasks such as network mapping, expanding your network, locating devices that require important updates, or isolating performance issues. Learn more details about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time and in-depth reporting utilities created to integrate with the top ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as inconsistent support follow-up or endpoints with missing patches. By identifying ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has worked with advanced backup/restore software companies to create ProSight Data Protection Services, a portfolio of management outsourcing plans that deliver backup-as-a-service. ProSight DPS products automate and monitor your backup processes and enable transparent backup and fast recovery of important files, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps you protect against data loss caused by hardware breakdown, natural calamities, fire, cyber attacks like ransomware, human error, malicious insiders, or application glitches. Managed backup services available in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to identify which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of leading information security vendors to provide web-based management and world-class protection for all your email traffic. The powerful architecture of Progent's Email Guard managed service combines a Cloud Protection Layer with a local gateway appliance to provide complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The Cloud Protection Layer acts as a preliminary barricade and keeps the vast majority of unwanted email from making it to your security perimeter. This reduces your exposure to inbound threats and saves network bandwidth and storage space. Email Guard's onsite security gateway appliance adds a further layer of inspection for inbound email. For outbound email, the on-premises security gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The on-premises security gateway can also help Exchange Server to track and safeguard internal email that stays within your security perimeter. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA service plans incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication. Duo supports one-tap identity verification with iOS, Google Android, and other personal devices. With Duo 2FA, when you sign into a protected online account and enter your password you are asked to confirm who you are via a unit that only you have and that is accessed using a different network channel. A broad selection of devices can be utilized as this added form of authentication such as a smartphone or wearable, a hardware token, a landline telephone, etc. You may register several validation devices. For more information about Duo two-factor identity authentication services, refer to Duo MFA two-factor authentication services for access security.

• Progent's Outsourced/Shared Service Center: Support Desk Managed Services
  Progent's Call Center services permit your IT staff to offload Call Center services to Progent or split activity for Service Desk support transparently between your in-house network support team and Progent's extensive roster of certified IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a seamless extension of your corporate network support organization. Client access to the Help Desk, provision of support services, issue escalation, ticket generation and tracking, performance metrics, and management of the support database are consistent whether incidents are taken care of by your core IT support group, by Progent's team, or by a combination. Find out more about Progent's outsourced/shared Call Desk services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection service that incorporates next generation behavior-based analysis technology to defend endpoints and servers and VMs against modern malware assaults such as ransomware and file-less exploits, which routinely evade traditional signature-based AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and provides a single platform to automate the complete threat lifecycle including filtering, detection, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Learn more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to create, update, find and protect information about your network infrastructure, processes, applications, and services. You can quickly find passwords or IP addresses and be alerted about impending expirations of SSLs ,domains or warranties. By updating and organizing your IT documentation, you can eliminate as much as 50% of time spent trying to find critical information about your network. ProSight IT Asset Management includes a centralized location for storing and sharing all documents related to managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers a high level of automation for collecting and relating IT information. Whether you're planning enhancements, performing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the information you need when you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management provide businesses of any size a versatile and cost-effective alternative for evaluating, validating, scheduling, applying, and documenting updates to your dynamic IT system. Besides optimizing the protection and functionality of your IT environment, Progent's patch management services allow your IT staff to focus on more strategic projects and activities that deliver the highest business value from your network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its critical servers and apps hosted in a protected fault tolerant data center on a high-performance virtual host configured and maintained by Progent's network support professionals. With the ProSight Virtual Hosting service model, the client owns the data, the operating system software, and the apps. Since the system is virtualized, it can be moved easily to a different hardware solution without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior-based machine learning technology to defend physical and virtual endpoint devices against modern malware attacks like ransomware and email phishing, which easily get by traditional signature-matching anti-virus tools. ProSight Active Security Monitoring protects on-premises and cloud resources and offers a unified platform to automate the complete malware attack lifecycle including blocking, infiltration detection, containment, remediation, and post-attack forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service and automatic system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services offer economical multi-layer security for physical servers and virtual machines, workstations, smartphones, and Exchange email. ProSight ESP uses adaptive security and modern behavior analysis for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP provides firewall protection, penetration alarms, endpoint control, and web filtering through leading-edge tools incorporated within a single agent managed from a single console. Progent's data protection and virtualization consultants can assist you to plan and configure a ProSight ESP environment that addresses your company's specific needs and that helps you demonstrate compliance with government and industry information security regulations. Progent will assist you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that require immediate action. Progent can also help you to install and verify a backup and restore system such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange filtering.