24-Hour Seattle Urgent Crypto-Ransomware
Virus Detection and Remediation Experts

Ransomware : Your Crippling Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that presents an existential threat for businesses poorly prepared for an attack. Different versions of ransomware such as Reveton, Fusob, Locky, SamSam and MongoLock cryptoworms have been around for many years and continue to cause damage. Modern strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Nephilim, as well as daily unnamed viruses, not only encrypt online information but also infect many configured system protection. Data synched to off-site disaster recovery sites can also be corrupted. In a poorly designed system, it can render any restoration useless and basically sets the network back to square one.

Getting back online applications and information after a ransomware event becomes a race against the clock as the targeted organization struggles to contain, remove the crypto-ransomware, and resume mission-critical operations. Due to the fact that crypto-ransomware needs time to spread, attacks are often launched on weekends, when successful attacks may take longer to discover. This compounds the difficulty of rapidly assembling and organizing a knowledgeable response team.

Progent offers an assortment of solutions for protecting organizations from crypto-ransomware attacks. Among these are staff training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to deployment of modern security gateways with machine learning technology from SentinelOne to identify and suppress new threats quickly. Progent also provides the services of seasoned ransomware recovery consultants with the talent and commitment to restore a compromised environment as rapidly as possible.

Progent's Ransomware Recovery Help
After a ransomware event, sending the ransom demands in cryptocurrency does not guarantee that criminal gangs will provide the needed codes to decrypt any or all of your information. Kaspersky Labs determined that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The alternative is to setup from scratch the key parts of your IT environment. Absent access to essential information backups, this calls for a broad range of IT skills, well-coordinated project management, and the capability to work non-stop until the task is complete.

For decades, Progent has made available certified expert IT services for businesses throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have attained high-level certifications in leading technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with accounting and ERP software solutions. This breadth of expertise gives Progent the capability to rapidly determine critical systems and organize the remaining pieces of your network environment after a ransomware attack and rebuild them into a functioning system.

Progent's security team deploys state-of-the-art project management systems to orchestrate the complex recovery process. Progent knows the urgency of acting quickly and in concert with a customer's management and IT team members to assign priority to tasks and to put essential systems back on line as fast as humanly possible.

Case Study: A Successful Ransomware Incident Response
A small business contacted Progent after their network was crashed by the Ryuk crypto-ransomware. Ryuk is thought to have been launched by Northern Korean state sponsored criminal gangs, possibly adopting strategies leaked from the U.S. National Security Agency. Ryuk attacks specific businesses with limited ability to sustain disruption and is among the most profitable iterations of ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business headquartered in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had shut down all company operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the start of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and wishfully thinking for good luck, but ultimately called Progent.

Progent worked together with the customer to quickly assess and assign priority to the mission critical services that had to be recovered to make it possible to restart departmental operations:

• Active Directory
• Email
• Financials/MRP

In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then helped perform rebuilding and hard drive recovery of needed systems. All Exchange ties and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to assemble non-encrypted OST files (Microsoft Outlook Offline Data Files) on various workstations to recover email messages. A not too old offline backup of the businesses accounting/ERP systems made it possible to recover these required applications back on-line. Although major work remained to recover totally from the Ryuk event, the most important systems were returned to operations quickly:

During the next few weeks important milestones in the recovery project were completed in tight collaboration between Progent team members and the client:

• Self-hosted web sites were restored without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was spun up and accessible to users.
• CRM/Orders/Invoices/AP/Accounts Receivables/Inventory Control functions were 100 percent functional.
• A new Palo Alto Networks 850 firewall was deployed.
• Most of the user PCs were being used by staff.

Conclusion
A probable business extinction catastrophe was dodged with hard-working professionals, a broad array of IT skills, and tight collaboration. Although upon completion of forensics the crypto-ransomware virus incident detailed here should have been identified and prevented with up-to-date cyber security solutions and security best practices, user education, and appropriate security procedures for data protection and applying software patches, the fact is that government-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a ransomware attack, remember that Progent's team of professionals has proven experience in ransomware virus blocking, removal, and data recovery.

To review or download a PDF version of this customer story, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Seattle a portfolio of online monitoring and security assessment services to assist you to reduce the threat from ransomware. These services incorporate modern artificial intelligence technology to uncover zero-day strains of crypto-ransomware that are able to get past traditional signature-based anti-virus products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent handles the daily monitoring and maintenance for you, so your system scales smoothly without holding you back. For a low and predictable monthly price, Progent's full-service IT group can be your dependable technology safety net. Basic plans include RMM, cybersecurity, automatic monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) techniques to help keep your IT system running efficiently by tracking the state of vital assets that drive your information system. When ProSight LAN Watch uncovers an issue, an alert is transmitted immediately to your designated IT personnel and your assigned Progent engineering consultant so all looming problems can be resolved before they have a chance to impact your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-based platform for managing your network, server, and desktop devices by offering an environment for performing common time-consuming tasks. These include health monitoring, update management, automated remediation, endpoint configuration, backup and restore, anti-virus defense, remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and debugging support. When ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your designated IT management personnel and your assigned Progent consultant so that potential problems can be taken care of before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for small and mid-sized organizations to diagram, monitor, optimize and troubleshoot their networking appliances like routers, firewalls, and access points plus servers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management technology, WAN Watch ensures that infrastructure topology maps are kept current, captures and manages the configuration of almost all devices on your network, tracks performance, and sends notices when issues are discovered. By automating time-consuming management and troubleshooting activities, WAN Watch can knock hours off ordinary chores like network mapping, expanding your network, finding devices that need critical updates, or isolating performance bottlenecks. Find out more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of in-depth management reporting utilities created to integrate with the industry's leading ticketing and remote network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues such as inconsistent support follow-through or machines with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup technology companies to create ProSight Data Protection Services (DPS), a family of subscription-based management offerings that deliver backup-as-a-service. ProSight DPS services manage and monitor your data backup processes and allow non-disruptive backup and fast restoration of vital files, applications, system images, plus virtual machines. ProSight DPS helps you avoid data loss resulting from equipment failures, natural calamities, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned employees, or application bugs. Managed services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to identify which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the technology of top data security vendors to provide web-based management and comprehensive protection for all your inbound and outbound email. The hybrid architecture of Email Guard managed service integrates cloud-based filtering with a local security gateway device to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-borne threats. Email Guard's cloud filter acts as a first line of defense and keeps most unwanted email from making it to your security perimeter. This reduces your vulnerability to external threats and conserves system bandwidth and storage. Email Guard's onsite gateway appliance provides a deeper level of inspection for incoming email. For outbound email, the on-premises security gateway provides AV and anti-spam filtering, protection against data leaks, and email encryption. The local gateway can also help Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends within your security perimeter. For more information, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Remediation, and Protected Single Sign-on
  Progent's Duo authentication services incorporate Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication. Duo supports one-tap identity verification with iOS, Google Android, and other out-of-band devices. Using 2FA, whenever you sign into a protected online account and enter your password you are requested to confirm your identity on a unit that only you possess and that uses a different ("out-of-band") network channel. A broad selection of devices can be used as this second form of authentication including a smartphone or wearable, a hardware token, a landline telephone, etc. You can designate multiple validation devices. To find out more about Duo identity validation services, see Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Service Center: Help Desk Managed Services
  Progent's Support Desk managed services allow your IT team to offload Support Desk services to Progent or divide responsibilities for Service Desk support seamlessly between your internal support staff and Progent's extensive roster of IT service technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service provides a seamless supplement to your in-house support group. End user interaction with the Help Desk, provision of support, problem escalation, ticket creation and tracking, efficiency measurement, and management of the support database are consistent whether issues are taken care of by your in-house network support staff, by Progent's team, or by a combination. Read more about Progent's outsourced/shared Call Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that incorporates next generation behavior analysis tools to defend endpoint devices and physical and virtual servers against modern malware assaults such as ransomware and file-less exploits, which routinely get by traditional signature-matching AV tools. Progent ASM services protect local and cloud-based resources and offers a unified platform to automate the entire threat lifecycle including blocking, identification, containment, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, retrieve and safeguard information about your network infrastructure, procedures, business apps, and services. You can quickly find passwords or serial numbers and be alerted about upcoming expirations of SSL certificates or domains. By cleaning up and managing your IT documentation, you can eliminate as much as 50% of time spent looking for vital information about your IT network. ProSight IT Asset Management includes a centralized location for holding and collaborating on all documents required for managing your business network such as recommended procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for collecting and associating IT information. Whether you're planning enhancements, doing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the information you need the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a flexible and cost-effective solution for assessing, validating, scheduling, applying, and tracking updates to your ever-evolving IT network. Besides optimizing the security and reliability of your computer environment, Progent's patch management services free up time for your in-house IT team to concentrate on more strategic initiatives and tasks that derive the highest business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its key servers and apps hosted in a secure fault tolerant data center on a fast virtual host configured and managed by Progent's IT support experts. Under Progent's ProSight Virtual Hosting service model, the client owns the data, the operating system software, and the applications. Because the environment is virtualized, it can be ported easily to a different hardware environment without a time-consuming and difficult configuration process. With ProSight Virtual Hosting, you are not locked into one hosting provider. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoint devices against modern malware assaults like ransomware and file-less exploits, which routinely evade traditional signature-matching anti-virus tools. ProSight Active Security Monitoring protects on-premises and cloud-based resources and provides a single platform to manage the entire malware attack progression including protection, identification, containment, cleanup, and post-attack forensics. Key capabilities include one-click rollback using Windows VSS and automatic network-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer economical multi-layer protection for physical servers and VMs, desktops, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to cyber threats from all vectors. ProSight ESP offers two-way firewall protection, penetration alerts, device control, and web filtering through leading-edge technologies incorporated within one agent accessible from a single console. Progent's data protection and virtualization consultants can help you to plan and implement a ProSight ESP deployment that addresses your company's unique needs and that allows you achieve and demonstrate compliance with government and industry information protection standards. Progent will assist you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that call for immediate action. Progent's consultants can also assist you to set up and test a backup and restore solution such as ProSight Data Protection Services (DPS) so you can recover rapidly from a destructive security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Exchange email filtering.