Eugene 24-7 Urgent Crypto-Ransomware
Computer Virus Identification and Removal Consultants

Ransomware : Your Worst IT Disaster
Crypto-Ransomware has become a modern cyberplague that presents an enterprise-level danger for organizations poorly prepared for an attack. Multiple generations of crypto-ransomware such as Dharma, Fusob, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and still cause destruction. The latest strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with additional unnamed malware, not only encrypt online information but also infiltrate most available system protection mechanisms. Files synched to the cloud can also be encrypted. In a poorly architected environment, this can render automatic recovery useless and basically sets the entire system back to zero.

Restoring applications and information following a ransomware event becomes a sprint against time as the targeted organization struggles to contain the damage, remove the ransomware, and restore enterprise-critical activity. Because ransomware requires time to spread, penetrations are frequently launched during weekends and nights, when successful attacks tend to take longer to identify. This multiplies the difficulty of quickly mobilizing and coordinating a qualified response team.

Progent provides a variety of help services for securing enterprises from ransomware penetrations. Among these are team member training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus installation of modern security solutions with AI technology from SentinelOne to identify and extinguish new threats quickly. Progent also provides the assistance of expert crypto-ransomware recovery engineers with the skills and commitment to restore a breached network as soon as possible.

Progent's Ransomware Recovery Support Services
After a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not provide any assurance that distant criminals will respond with the needed keys to decipher any or all of your data. Kaspersky estimated that 17% of crypto-ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The other path is to re-install the vital components of your IT environment. Absent the availability of full information backups, this calls for a wide range of skills, well-coordinated team management, and the ability to work 24x7 until the job is over.

For decades, Progent has offered expert Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have earned top certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial management and ERP applications. This breadth of expertise affords Progent the ability to quickly ascertain critical systems and re-organize the surviving parts of your Information Technology system following a ransomware event and configure them into a functioning system.

Progent's security team of experts deploys powerful project management systems to orchestrate the complicated restoration process. Progent appreciates the urgency of working swiftly and in unison with a client's management and IT staff to assign priority to tasks and to put critical systems back on-line as fast as humanly possible.

Customer Case Study: A Successful Ransomware Penetration Restoration
A business engaged Progent after their network system was crashed by Ryuk ransomware. Ryuk is believed to have been deployed by Northern Korean government sponsored criminal gangs, suspected of adopting technology exposed from America's NSA organization. Ryuk targets specific businesses with limited room for disruption and is among the most lucrative instances of ransomware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing business based in Chicago and has around 500 employees. The Ryuk penetration had shut down all company operations and manufacturing processes. Most of the client's backups had been online at the start of the intrusion and were damaged. The client was pursuing financing for paying the ransom demand (more than $200K) and praying for good luck, but ultimately engaged Progent.

Progent worked with the client to quickly understand and prioritize the most important elements that had to be restored to make it possible to restart company functions:

• Active Directory
• Microsoft Exchange Server
• MRP System

Within 48 hours, Progent was able to re-build Active Directory to its pre-intrusion state. Progent then initiated reinstallations and storage recovery on essential servers. All Exchange ties and attributes were usable, which greatly helped the restore of Exchange. Progent was also able to collect non-encrypted OST data files (Microsoft Outlook Off-Line Folder Files) on team desktop computers and laptops in order to recover mail data. A not too old offline backup of the businesses financials/MRP systems made them able to restore these essential programs back available to users. Although major work was left to recover completely from the Ryuk damage, the most important systems were recovered quickly:

During the next month key milestones in the restoration project were made through tight cooperation between Progent engineers and the customer:

• Internal web sites were brought back up without losing any information.
• The MailStore Microsoft Exchange Server containing more than four million historical emails was brought online and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory capabilities were fully functional.
• A new Palo Alto 850 firewall was set up.
• Ninety percent of the user desktops were functioning as before the incident.

Conclusion
A probable business catastrophe was evaded due to dedicated professionals, a broad array of subject matter expertise, and close teamwork. Although in retrospect the ransomware incident detailed here could have been disabled with up-to-date security technology solutions and best practices, user education, and well thought out incident response procedures for information protection and applying software patches, the fact is that state-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incursion, remember that Progent's roster of experts has extensive experience in crypto-ransomware virus defense, remediation, and information systems restoration.

To read or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Eugene a portfolio of remote monitoring and security assessment services to assist you to minimize your vulnerability to ransomware. These services include next-generation AI technology to uncover zero-day variants of crypto-ransomware that can evade traditional signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it feasible for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) solutions to create advanced IT resilience. Progent handles the necessary monitoring and management for you, so your network expands easily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's experienced IT group can be your complete technology safety net. Basic packages include remote monitoring and management (RMM), cybersecurity, automatic monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management (RMM) techniques to help keep your network operating efficiently by tracking the health of vital assets that power your information system. When ProSight LAN Watch detects an issue, an alert is sent automatically to your specified IT staff and your Progent engineering consultant so that all potential issues can be resolved before they can impact your network. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven solution for monitoring and managing your client-server infrastructure by offering an environment for streamlining common tedious jobs. These can include health checking, patch management, automated remediation, endpoint configuration, backup and restore, anti-virus response, secure remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and debugging support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your designated IT management staff and your assigned Progent consultant so potential issues can be fixed before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to diagram, monitor, enhance and debug their networking appliances like routers and switches, firewalls, and access points plus servers, printers, client computers and other networked devices. Incorporating cutting-edge RMM technology, ProSight WAN Watch ensures that infrastructure topology maps are kept current, captures and manages the configuration information of virtually all devices connected to your network, monitors performance, and sends alerts when issues are detected. By automating complex management and troubleshooting processes, WAN Watch can cut hours off ordinary tasks like making network diagrams, expanding your network, finding devices that require important software patches, or resolving performance issues. Learn more details about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of in-depth reporting utilities created to work with the industry's top ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize key issues such as spotty support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore software providers to produce ProSight Data Protection Services (DPS), a selection of offerings that deliver backup-as-a-service. ProSight DPS services manage and track your backup operations and enable non-disruptive backup and fast restoration of vital files/folders, applications, images, plus virtual machines. ProSight DPS lets you protect against data loss resulting from hardware breakdown, natural calamities, fire, malware like ransomware, user mistakes, malicious insiders, or application glitches. Managed backup services available in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to identify which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of leading data security vendors to deliver web-based control and world-class security for your inbound and outbound email. The hybrid architecture of Progent's Email Guard managed service combines cloud-based filtering with an on-premises security gateway appliance to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. The cloud filter acts as a first line of defense and keeps most threats from making it to your network firewall. This decreases your exposure to inbound attacks and saves network bandwidth and storage space. Email Guard's onsite gateway appliance provides a deeper layer of inspection for inbound email. For outgoing email, the onsite gateway offers anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also help Microsoft Exchange Server to monitor and protect internal email traffic that stays inside your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication service plans utilize Cisco's Duo technology to protect against stolen passwords through the use of two-factor authentication. Duo supports one-tap identity verification on Apple iOS, Google Android, and other personal devices. With 2FA, when you log into a secured online account and enter your password you are asked to confirm who you are via a device that only you possess and that uses a separate network channel. A wide range of devices can be utilized as this added means of authentication such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can designate multiple validation devices. To find out more about Duo two-factor identity validation services, go to Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Center: Help Desk Managed Services
  Progent's Support Desk managed services permit your IT group to offload Support Desk services to Progent or divide activity for Service Desk support transparently between your in-house support staff and Progent's nationwide roster of IT service engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a transparent extension of your core IT support group. User interaction with the Service Desk, provision of support services, escalation, ticket creation and tracking, performance metrics, and maintenance of the service database are consistent regardless of whether issues are resolved by your core IT support staff, by Progent, or by a combination. Find out more about Progent's outsourced/shared Call Desk services.

• Active Defense Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior machine learning technology to defend endpoint devices and physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which easily evade legacy signature-based anti-virus tools. Progent ASM services safeguard local and cloud resources and provides a single platform to automate the complete malware attack lifecycle including blocking, identification, mitigation, cleanup, and forensics. Top capabilities include single-click rollback with Windows VSS and automatic network-wide immunization against newly discovered threats. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, retrieve and protect data related to your network infrastructure, processes, applications, and services. You can instantly find passwords or serial numbers and be alerted automatically about impending expirations of SSLs or warranties. By updating and organizing your IT documentation, you can eliminate up to half of time thrown away searching for vital information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and collaborating on all documents related to managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're planning improvements, performing regular maintenance, or reacting to a crisis, ProSight IT Asset Management gets you the information you need the instant you need it. Read more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide businesses of all sizes a versatile and cost-effective alternative for assessing, testing, scheduling, implementing, and tracking updates to your dynamic IT network. In addition to maximizing the security and reliability of your computer environment, Progent's software/firmware update management services free up time for your in-house IT team to focus on line-of-business initiatives and tasks that deliver maximum business value from your network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a protected fault tolerant data center on a fast virtual host set up and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting service model, the customer retains ownership of the data, the operating system software, and the apps. Because the environment is virtualized, it can be ported immediately to a different hosting solution without a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, you are not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that utilizes SentinelOne's next generation behavior machine learning tools to guard physical and virtual endpoints against new malware assaults such as ransomware and file-less exploits, which routinely escape legacy signature-based anti-virus products. ProSight Active Security Monitoring safeguards local and cloud resources and provides a unified platform to address the entire threat progression including blocking, infiltration detection, containment, remediation, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Email Filtering
  ProSight Enhanced Security Protection managed services offer affordable in-depth protection for physical servers and virtual machines, workstations, mobile devices, and Microsoft Exchange. ProSight ESP uses adaptive security and advanced heuristics for round-the-clock monitoring and responding to security threats from all vectors. ProSight ESP delivers two-way firewall protection, penetration alerts, device management, and web filtering via leading-edge technologies packaged within one agent accessible from a single console. Progent's security and virtualization consultants can assist you to plan and implement a ProSight ESP deployment that meets your organization's specific needs and that allows you achieve and demonstrate compliance with government and industry data security standards. Progent will assist you define and implement policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that require urgent action. Progent can also assist your company to set up and test a backup and restore solution such as ProSight Data Protection Services so you can get back in business quickly from a destructive cyber attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange filtering.