Fargo 24/7 Critical Ransomware
Infection Detection and Removal Support

Ransomware : Your Feared IT Disaster
Ransomware has become an escalating cyber pandemic that presents an extinction-level danger for businesses of all sizes unprepared for an assault. Multiple generations of ransomware such as CrySIS, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for a long time and still cause damage. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as daily as yet unnamed viruses, not only encrypt on-line data files but also infiltrate any available system restores and backups. Data synched to cloud environments can also be held hostage. In a poorly architected system, it can make automatic recovery impossible and basically knocks the entire system back to zero.

Getting back programs and data following a ransomware intrusion becomes a sprint against the clock as the targeted organization fights to stop lateral movement, remove the ransomware, and restore business-critical activity. Since crypto-ransomware needs time to spread, assaults are usually launched at night, when successful penetrations tend to take more time to recognize. This compounds the difficulty of quickly marshalling and coordinating an experienced response team.

Progent has a variety of services for securing organizations from ransomware attacks. Among these are team education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of next-generation security solutions with artificial intelligence capabilities from SentinelOne to detect and disable day-zero threats quickly. Progent also can provide the services of veteran crypto-ransomware recovery consultants with the skills and perseverance to re-deploy a compromised environment as quickly as possible.

Progent's Ransomware Recovery Support Services
Subsequent to a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not guarantee that distant criminals will return the keys to decrypt all your data. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their files after having paid the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The alternative is to setup from scratch the key parts of your IT environment. Without the availability of essential information backups, this requires a broad complement of IT skills, top notch project management, and the willingness to work continuously until the task is complete.

For two decades, Progent has provided expert Information Technology services for companies across the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP software solutions. This breadth of experience gives Progent the capability to knowledgably determine necessary systems and re-organize the surviving parts of your Information Technology environment following a ransomware event and configure them into a functioning system.

Progent's ransomware group utilizes best of breed project management applications to orchestrate the complex recovery process. Progent appreciates the urgency of working rapidly and in concert with a customer's management and IT resources to assign priority to tasks and to put essential services back on line as soon as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Attack Response
A customer hired Progent after their network system was taken over by the Ryuk ransomware. Ryuk is believed to have been created by North Korean government sponsored hackers, suspected of adopting algorithms exposed from the U.S. NSA organization. Ryuk seeks specific companies with little room for operational disruption and is among the most profitable versions of crypto-ransomware. Major targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing company located in the Chicago metro area and has around 500 workers. The Ryuk event had shut down all essential operations and manufacturing processes. The majority of the client's data backups had been online at the start of the intrusion and were damaged. The client was pursuing financing for paying the ransom (in excess of $200K) and hoping for good luck, but in the end called Progent.

Progent worked hand in hand the customer to quickly determine and assign priority to the most important services that had to be addressed to make it possible to resume departmental functions:

• Active Directory
• Electronic Messaging
• MRP System

In less than 2 days, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then assisted with rebuilding and storage recovery of essential applications. All Exchange Server ties and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to collect intact OST data files (Outlook Offline Data Files) on team PCs and laptops to recover email data. A recent offline backup of the customer's financials/MRP software made them able to return these essential programs back servicing users. Although a large amount of work still had to be done to recover completely from the Ryuk virus, essential services were recovered rapidly:

During the next couple of weeks critical milestones in the restoration project were achieved in tight cooperation between Progent team members and the client:

• Internal web sites were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server exceeding four million archived emails was restored to operations and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory modules were 100% restored.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Most of the desktops and laptops were fully operational.

Conclusion
A possible business-ending catastrophe was avoided through the efforts of results-oriented experts, a wide array of knowledge, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware attack detailed here would have been shut down with advanced cyber security systems and security best practices, staff training, and properly executed incident response procedures for information protection and applying software patches, the fact remains that government-sponsored criminal cyber gangs from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware virus, feel confident that Progent's roster of experts has proven experience in ransomware virus defense, remediation, and data recovery.

To review or download a PDF version of this case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide companies in Fargo a variety of remote monitoring and security evaluation services designed to assist you to reduce the threat from ransomware. These services utilize modern machine learning capability to uncover zero-day variants of crypto-ransomware that are able to escape detection by legacy signature-based anti-virus solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) solutions to create leading-edge IT resilience. Progent handles the necessary monitoring and maintenance for you, so your system scales easily without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT group can be your dependable technology safety net. Entry-level packages include remote monitoring and management (RMM), security, automatic monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management technology to help keep your network operating efficiently by checking the health of vital assets that drive your business network. When ProSight LAN Watch uncovers a problem, an alert is transmitted automatically to your specified IT staff and your assigned Progent engineering consultant so that any potential issues can be addressed before they can impact productivity. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for managing your network, server, and desktop devices by providing an environment for streamlining common tedious tasks. These include health checking, patch management, automated repairs, endpoint deployment, backup and recovery, A/V protection, remote access, built-in and custom scripts, asset inventory, endpoint status reports, and debugging help. When ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alert to your specified IT staff and your Progent technical consultant so potential issues can be taken care of before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized businesses to diagram, monitor, optimize and troubleshoot their connectivity hardware like routers and switches, firewalls, and wireless controllers plus servers, printers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that infrastructure topology maps are always current, captures and displays the configuration information of virtually all devices on your network, monitors performance, and generates alerts when problems are discovered. By automating complex management and troubleshooting activities, ProSight WAN Watch can knock hours off common chores such as network mapping, expanding your network, finding devices that require important software patches, or isolating performance problems. Find out more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing line of real-time reporting plug-ins created to integrate with the industry's leading ticketing and remote network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize key issues like inconsistent support follow-up or machines with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, lowers management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Recovery Services
  Progent has partnered with leading backup software providers to produce ProSight Data Protection Services (DPS), a family of management offerings that provide backup-as-a-service (BaaS). ProSight DPS services manage and monitor your backup processes and allow non-disruptive backup and fast restoration of important files/folders, apps, system images, and virtual machines. ProSight DPS lets you avoid data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks such as ransomware, human mistakes, malicious employees, or software bugs. Managed services available in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the technology of leading information security vendors to provide centralized control and comprehensive protection for your inbound and outbound email. The hybrid structure of Email Guard integrates a Cloud Protection Layer with a local security gateway appliance to offer advanced protection against spam, viruses, Denial of Service Attacks, Directory Harvest Attacks, and other email-based malware. Email Guard's Cloud Protection Layer serves as a first line of defense and keeps the vast majority of unwanted email from reaching your network firewall. This decreases your exposure to external threats and conserves network bandwidth and storage space. Email Guard's on-premises security gateway device adds a deeper level of analysis for inbound email. For outbound email, the local gateway provides anti-virus and anti-spam protection, protection against data leaks, and email encryption. The local gateway can also help Exchange Server to track and protect internal email traffic that originates and ends within your corporate firewall. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA service plans utilize Cisco's Duo technology to protect against compromised passwords by using two-factor authentication. Duo supports single-tap identity confirmation with iOS, Android, and other out-of-band devices. With 2FA, whenever you log into a protected application and enter your password you are asked to verify your identity via a unit that only you possess and that uses a different ("out-of-band") network channel. A broad range of devices can be used as this second means of authentication such as an iPhone or Android or watch, a hardware token, a landline phone, etc. You may register several validation devices. For more information about Duo identity validation services, go to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Call Center services enable your IT team to offload Help Desk services to Progent or divide activity for Help Desk services transparently between your in-house support staff and Progent's nationwide pool of IT support technicians, engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a smooth supplement to your corporate network support staff. End user interaction with the Help Desk, provision of technical assistance, issue escalation, ticket generation and updates, performance measurement, and maintenance of the support database are consistent regardless of whether incidents are taken care of by your internal network support organization, by Progent's team, or both. Read more about Progent's outsourced/shared Call Center services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes cutting edge behavior analysis technology to defend endpoints as well as servers and VMs against modern malware attacks such as ransomware and email phishing, which easily get by legacy signature-matching AV tools. Progent Active Security Monitoring services safeguard on-premises and cloud resources and provides a unified platform to automate the complete malware attack progression including filtering, identification, mitigation, cleanup, and post-attack forensics. Top capabilities include single-click rollback using Windows VSS and automatic network-wide immunization against new threats. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, maintain, find and safeguard information related to your network infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be alerted about impending expirations of SSL certificates ,domains or warranties. By cleaning up and managing your IT documentation, you can eliminate up to 50% of time spent searching for critical information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and collaborating on all documents required for managing your network infrastructure like standard operating procedures and How-To's. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT information. Whether you're planning improvements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you require the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide businesses of any size a flexible and affordable solution for evaluating, testing, scheduling, applying, and documenting software and firmware updates to your dynamic IT network. Besides maximizing the security and reliability of your computer environment, Progent's software/firmware update management services allow your in-house IT team to concentrate on line-of-business projects and activities that deliver maximum business value from your network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a secure Tier III data center on a fast virtual machine host set up and managed by Progent's network support experts. With the ProSight Virtual Hosting service model, the customer owns the data, the OS platforms, and the applications. Since the system is virtualized, it can be moved immediately to a different hosting solution without a time-consuming and technically risky configuration procedure. With ProSight Virtual Hosting, you are not locked into one hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior-based machine learning technology to defend physical and virtual endpoints against new malware assaults like ransomware and email phishing, which routinely evade legacy signature-based anti-virus products. ProSight Active Security Monitoring safeguards local and cloud resources and offers a unified platform to address the entire malware attack progression including filtering, infiltration detection, containment, remediation, and forensics. Key capabilities include single-click rollback using Windows VSS and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Exchange Filtering
  ProSight Enhanced Security Protection services offer ultra-affordable multi-layer protection for physical and virtual servers, workstations, mobile devices, and Exchange email. ProSight ESP uses adaptive security and advanced machine learning for round-the-clock monitoring and reacting to security assaults from all vectors. ProSight ESP offers firewall protection, intrusion alerts, device control, and web filtering through cutting-edge tools packaged within one agent accessible from a unified console. Progent's security and virtualization experts can assist you to design and configure a ProSight ESP deployment that meets your organization's unique requirements and that helps you prove compliance with legal and industry information protection regulations. Progent will help you specify and configure policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that call for immediate action. Progent's consultants can also help you to set up and test a backup and restore solution such as ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange filtering.