24/7/365 Des Moines Urgent Crypto-Ransomware
Infection Detection and Restoration Experts

Ransomware : Your Feared IT Catastrophe
Ransomware has become a modern cyber pandemic that presents an enterprise-level danger for businesses vulnerable to an attack. Multiple generations of crypto-ransomware like the CrySIS, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been around for years and continue to inflict destruction. The latest strains of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Nephilim, along with more as yet unnamed malware, not only encrypt on-line critical data but also infiltrate all available system protection. Files replicated to cloud environments can also be corrupted. In a vulnerable system, it can render automated restore operations impossible and effectively knocks the network back to square one.

Getting back on-line applications and information following a crypto-ransomware intrusion becomes a sprint against the clock as the victim tries its best to contain the damage, clear the ransomware, and restore enterprise-critical operations. Since ransomware takes time to move laterally, assaults are frequently launched on weekends and holidays, when successful attacks tend to take more time to discover. This compounds the difficulty of rapidly assembling and orchestrating a knowledgeable mitigation team.

Progent provides a variety of support services for securing enterprises from ransomware penetrations. These include team member education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus setup and configuration of next-generation security appliances with artificial intelligence technology from SentinelOne to identify and extinguish new cyber attacks intelligently. Progent in addition offers the assistance of seasoned crypto-ransomware recovery engineers with the skills and perseverance to re-deploy a breached environment as quickly as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that cyber hackers will respond with the needed codes to decipher any of your information. Kaspersky ascertained that 17% of ransomware victims never restored their data after having paid the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The fallback is to piece back together the mission-critical components of your IT environment. Absent access to full information backups, this requires a wide range of IT skills, professional team management, and the willingness to work continuously until the job is complete.

For decades, Progent has offered professional Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have been awarded advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-recognized certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in financial systems and ERP software solutions. This breadth of expertise affords Progent the capability to efficiently determine important systems and re-organize the remaining parts of your IT environment following a crypto-ransomware event and assemble them into an operational system.

Progent's security team uses best of breed project management systems to orchestrate the complicated recovery process. Progent understands the urgency of acting rapidly and in unison with a client's management and IT resources to prioritize tasks and to put critical services back on-line as fast as possible.

Client Case Study: A Successful Crypto-Ransomware Intrusion Response
A business sought out Progent after their company was brought down by the Ryuk ransomware virus. Ryuk is thought to have been created by Northern Korean state hackers, possibly adopting strategies leaked from America's National Security Agency. Ryuk targets specific businesses with little room for disruption and is among the most profitable iterations of ransomware malware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company located in the Chicago metro area with around 500 employees. The Ryuk intrusion had frozen all business operations and manufacturing processes. The majority of the client's information backups had been on-line at the time of the attack and were damaged. The client was pursuing financing for paying the ransom (in excess of $200K) and wishfully thinking for good luck, but in the end utilized Progent.

Progent worked together with the customer to rapidly identify and prioritize the most important elements that needed to be addressed to make it possible to resume departmental functions:

• Microsoft Active Directory
• Electronic Mail
• Accounting/MRP

Within 2 days, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then performed reinstallations and hard drive recovery on key servers. All Exchange Server data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to locate intact OST data files (Outlook Email Offline Folder Files) on staff workstations and laptops to recover mail data. A not too old offline backup of the customer's accounting/ERP software made it possible to recover these required applications back servicing users. Although significant work still had to be done to recover totally from the Ryuk attack, essential services were recovered rapidly:

Over the next month important milestones in the recovery process were completed in close collaboration between Progent consultants and the customer:

• In-house web sites were restored with no loss of data.
• The MailStore Exchange Server with over four million historical messages was brought on-line and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were completely functional.
• A new Palo Alto 850 security appliance was brought online.
• Nearly all of the user PCs were operational.

Conclusion
A probable enterprise-killing catastrophe was averted with hard-working experts, a broad range of technical expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware incident described here could have been shut down with modern security technology and ISO/IEC 27001 best practices, team education, and properly executed security procedures for data backup and keeping systems up to date with security patches, the reality remains that government-sponsored cybercriminals from China, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware virus, remember that Progent's team of professionals has a proven track record in crypto-ransomware virus defense, removal, and data recovery.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Des Moines a variety of online monitoring and security evaluation services designed to assist you to minimize your vulnerability to ransomware. These services utilize next-generation artificial intelligence technology to uncover new variants of crypto-ransomware that are able to evade traditional signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it possible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to create advanced IT resilience. Progent handles the daily monitoring and maintenance for you, so your network expands smoothly without becoming an obstacle. For a low and predictable monthly price, Progent's experienced IT group can be your complete technology safety net. Basic plans include remote monitoring and management (RMM), security, monthly patching, and reporting. As your needs expand, you can add low-cost subscriptions to advanced solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management (RMM) techniques to keep your network operating at peak levels by checking the health of vital computers that power your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your specified IT management staff and your assigned Progent engineering consultant so that all potential problems can be resolved before they can disrupt your network. Learn more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your network, server, and desktop devices by offering an environment for streamlining common time-consuming jobs. These include health monitoring, patch management, automated repairs, endpoint deployment, backup and recovery, anti-virus response, secure remote access, standard and custom scripts, asset inventory, endpoint profile reports, and debugging help. If ProSight LAN Watch with NinjaOne RMM spots a serious issue, it sends an alarm to your specified IT management personnel and your assigned Progent consultant so emerging issues can be taken care of before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to diagram, track, optimize and troubleshoot their connectivity hardware such as routers and switches, firewalls, and wireless controllers plus servers, printers, client computers and other networked devices. Incorporating state-of-the-art Remote Monitoring and Management technology, ProSight WAN Watch makes sure that infrastructure topology maps are always updated, copies and displays the configuration of virtually all devices on your network, monitors performance, and generates alerts when problems are discovered. By automating time-consuming network management processes, WAN Watch can cut hours off common tasks like making network diagrams, expanding your network, finding devices that require critical software patches, or resolving performance bottlenecks. Learn more about ProSight WAN Watch infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time and in-depth reporting plug-ins designed to integrate with the top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues like spotty support follow-through or machines with missing patches. By identifying ticketing or network health problems clearly and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has partnered with leading backup/restore software companies to create ProSight Data Protection Services, a family of management offerings that provide backup-as-a-service (BaaS). ProSight DPS services automate and monitor your data backup operations and allow transparent backup and rapid restoration of important files, applications, system images, plus Hyper-V and VMware virtual machines. ProSight DPS helps your business protect against data loss caused by hardware failures, natural disasters, fire, cyber attacks like ransomware, user error, ill-intentioned insiders, or software glitches. Managed backup services available in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can help you to determine which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that incorporates the infrastructure of leading data security companies to provide centralized management and comprehensive protection for your inbound and outbound email. The hybrid architecture of Progent's Email Guard integrates cloud-based filtering with a local security gateway device to offer advanced defense against spam, viruses, Denial of Service Attacks, DHAs, and other email-borne threats. The Cloud Protection Layer acts as a preliminary barricade and keeps most unwanted email from making it to your network firewall. This decreases your vulnerability to external threats and conserves network bandwidth and storage space. Email Guard's on-premises gateway device adds a further level of inspection for inbound email. For outgoing email, the on-premises security gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The on-premises security gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email that originates and ends inside your corporate firewall. For more information, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo authentication services utilize Cisco's Duo technology to defend against stolen passwords by using two-factor authentication (2FA). Duo enables single-tap identity confirmation with iOS, Google Android, and other personal devices. Using 2FA, when you log into a secured online account and enter your password you are asked to confirm your identity via a unit that only you possess and that uses a different network channel. A wide range of out-of-band devices can be utilized for this added means of ID validation including an iPhone or Android or wearable, a hardware token, a landline phone, etc. You may register several verification devices. To learn more about Duo two-factor identity validation services, visit Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Call Center: Call Center Managed Services
  Progent's Support Desk services enable your information technology team to offload Support Desk services to Progent or split activity for Help Desk services transparently between your internal support team and Progent's extensive roster of certified IT support technicians, engineers and subject matter experts (SMEs). Progent's Shared Service Desk provides a transparent supplement to your in-house network support team. Client access to the Help Desk, provision of support services, problem escalation, trouble ticket creation and updates, performance measurement, and maintenance of the support database are cohesive whether issues are taken care of by your internal IT support resources, by Progent, or a mix of the two. Find out more about Progent's outsourced/shared Call Desk services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that utilizes cutting edge behavior-based analysis technology to guard endpoints as well as servers and VMs against new malware attacks such as ransomware and file-less exploits, which routinely evade traditional signature-matching AV tools. Progent Active Security Monitoring services protect local and cloud resources and offers a unified platform to manage the complete threat lifecycle including blocking, identification, mitigation, cleanup, and forensics. Key capabilities include one-click rollback with Windows VSS and automatic system-wide immunization against new attacks. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, find and protect information related to your network infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be warned about upcoming expirations of SSLs ,domains or warranties. By cleaning up and managing your IT infrastructure documentation, you can eliminate up to half of time wasted looking for critical information about your network. ProSight IT Asset Management features a centralized location for holding and sharing all documents related to managing your business network like recommended procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and relating IT information. Whether you're planning enhancements, performing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the knowledge you require when you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a flexible and cost-effective solution for assessing, testing, scheduling, applying, and tracking software and firmware updates to your dynamic information system. Besides optimizing the protection and functionality of your IT network, Progent's patch management services permit your in-house IT staff to concentrate on more strategic projects and activities that deliver the highest business value from your information network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual host configured and managed by Progent's IT support professionals. With Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the OS platforms, and the applications. Because the system is virtualized, it can be ported immediately to a different hosting environment without a time-consuming and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into a single hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection solution that incorporates SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoint devices against new malware attacks like ransomware and email phishing, which easily evade legacy signature-based AV tools. ProSight ASM safeguards local and cloud-based resources and offers a single platform to automate the entire malware attack progression including filtering, identification, mitigation, cleanup, and post-attack forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  Progent's ProSight Enhanced Security Protection services deliver affordable in-depth protection for physical servers and VMs, workstations, smartphones, and Exchange Server. ProSight ESP uses contextual security and advanced machine learning for continuously monitoring and reacting to security threats from all vectors. ProSight ESP offers firewall protection, penetration alarms, endpoint management, and web filtering via leading-edge technologies incorporated within one agent accessible from a unified control. Progent's security and virtualization experts can help you to design and implement a ProSight ESP environment that addresses your organization's specific requirements and that allows you prove compliance with government and industry data security regulations. Progent will help you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that require immediate action. Progent's consultants can also assist you to install and verify a backup and disaster recovery solution like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange email filtering.