24x7 Lincoln Urgent Ransomware
Virus Assessment and Recovery Consulting

Ransomware : Your Crippling IT Disaster
Ransomware has become a too-frequent cyberplague that poses an extinction-level danger for businesses of all sizes poorly prepared for an assault. Multiple generations of ransomware like the Reveton, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been running rampant for years and continue to cause damage. Recent variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as additional as yet unnamed viruses, not only do encryption of online data but also infect all configured system backup. Files synched to off-site disaster recovery sites can also be ransomed. In a poorly architected data protection solution, this can make any restore operations hopeless and basically knocks the datacenter back to square one.

Recovering services and data after a ransomware attack becomes a race against the clock as the targeted organization fights to contain, eradicate the virus, and restore enterprise-critical operations. Because ransomware requires time to move laterally, attacks are often launched on weekends and holidays, when successful penetrations typically take more time to detect. This compounds the difficulty of promptly mobilizing and orchestrating an experienced mitigation team.

Progent offers an assortment of support services for protecting organizations from crypto-ransomware attacks. These include team education to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus setup and configuration of next-generation security solutions with artificial intelligence technology from SentinelOne to discover and suppress day-zero threats intelligently. Progent in addition provides the assistance of expert ransomware recovery consultants with the track record and perseverance to re-deploy a compromised network as rapidly as possible.

Progent's Ransomware Restoration Help
Following a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will provide the needed codes to decipher any of your information. Kaspersky ascertained that 17% of ransomware victims never restored their information even after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to re-install the critical components of your IT environment. Absent the availability of essential system backups, this requires a broad complement of skills, top notch project management, and the willingness to work continuously until the job is over.

For twenty years, Progent has provided certified expert IT services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have earned advanced certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have earned internationally-recognized industry certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial management and ERP applications. This breadth of experience gives Progent the skills to rapidly determine critical systems and organize the surviving pieces of your network system following a ransomware event and configure them into a functioning network.

Progent's ransomware group utilizes top notch project management tools to coordinate the complicated restoration process. Progent knows the urgency of acting swiftly and in unison with a client's management and Information Technology staff to assign priority to tasks and to get critical applications back on line as soon as humanly possible.

Client Case Study: A Successful Ransomware Attack Response
A client escalated to Progent after their organization was crashed by Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by Northern Korean government sponsored criminal gangs, suspected of using technology leaked from the U.S. NSA organization. Ryuk attacks specific companies with little or no tolerance for disruption and is among the most lucrative instances of crypto-ransomware. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a small manufacturing company based in the Chicago metro area with about 500 workers. The Ryuk penetration had brought down all company operations and manufacturing capabilities. Most of the client's information backups had been directly accessible at the time of the attack and were damaged. The client was evaluating paying the ransom demand (exceeding $200K) and praying for the best, but in the end called Progent.

Progent worked with the customer to quickly understand and prioritize the most important systems that had to be recovered to make it possible to restart departmental functions:

• Active Directory (AD)
• Electronic Mail
• Financials/MRP

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-virus state. Progent then assisted with rebuilding and storage recovery on the most important applications. All Exchange Server schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to assemble intact OST data files (Microsoft Outlook Off-Line Data Files) on various desktop computers in order to recover email information. A recent offline backup of the businesses manufacturing software made it possible to recover these vital services back on-line. Although a lot of work was left to recover completely from the Ryuk damage, the most important services were recovered quickly:

Throughout the next month critical milestones in the recovery project were made in close cooperation between Progent consultants and the client:

• In-house web applications were brought back up without losing any data.
• The MailStore Exchange Server exceeding four million historical emails was brought on-line and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable/AR/Inventory modules were completely recovered.
• A new Palo Alto 850 security appliance was installed and configured.
• Ninety percent of the user desktops and notebooks were functioning as before the incident.

Conclusion
A probable enterprise-killing catastrophe was evaded by hard-working experts, a wide range of subject matter expertise, and close collaboration. Although in retrospect the ransomware virus incident detailed here could have been identified and disabled with current security systems and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and well thought out security procedures for information protection and proper patching controls, the reality is that government-sponsored cyber criminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's team of professionals has a proven track record in crypto-ransomware virus blocking, removal, and information systems disaster recovery.

To review or download a PDF version of this customer story, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers businesses in Lincoln a range of remote monitoring and security assessment services to help you to minimize the threat from ransomware. These services incorporate next-generation machine learning technology to detect new strains of ransomware that are able to escape detection by legacy signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to achieve leading-edge network resilience. Progent takes care of the necessary monitoring and maintenance for you, so your system expands easily without becoming an obstacle. For a low and predictable monthly subscription, Progent's full-service IT group can be your complete technology safety net. Entry-level packages include remote monitoring and management (RMM), cybersecurity, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) technology to keep your network operating at peak levels by checking the health of critical computers that drive your information system. When ProSight LAN Watch uncovers a problem, an alert is sent automatically to your designated IT staff and your assigned Progent engineering consultant so that any potential issues can be resolved before they can impact your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based solution for monitoring and managing your network, server, and desktop devices by providing tools for performing common tedious tasks. These include health checking, patch management, automated remediation, endpoint deployment, backup and recovery, anti-virus defense, remote access, standard and custom scripts, resource inventory, endpoint profile reporting, and debugging help. If ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alarm to your specified IT staff and your Progent technical consultant so emerging problems can be taken care of before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to diagram, monitor, reconfigure and debug their connectivity hardware such as routers and switches, firewalls, and access points plus servers, printers, client computers and other devices. Using cutting-edge RMM technology, WAN Watch makes sure that network diagrams are always current, copies and displays the configuration information of virtually all devices connected to your network, tracks performance, and generates alerts when potential issues are detected. By automating tedious network management activities, WAN Watch can cut hours off common tasks like making network diagrams, reconfiguring your network, finding appliances that require critical software patches, or resolving performance issues. Find out more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of in-depth reporting tools created to work with the industry's top ticketing and network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize critical issues such as spotty support follow-up or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore technology companies to produce ProSight Data Protection Services (DPS), a selection of management outsourcing plans that provide backup-as-a-service. ProSight DPS services automate and track your backup processes and enable transparent backup and fast recovery of critical files, applications, system images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business protect against data loss caused by equipment failures, natural calamities, fire, cyber attacks like ransomware, human error, malicious insiders, or software bugs. Managed backup services in the ProSight DPS portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent consultant can assist you to determine which of these fully managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading data security vendors to deliver web-based control and world-class protection for your email traffic. The hybrid structure of Email Guard managed service combines cloud-based filtering with an on-premises security gateway device to provide advanced defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. The cloud filter acts as a preliminary barricade and keeps most threats from reaching your network firewall. This decreases your vulnerability to external attacks and conserves system bandwidth and storage space. Email Guard's on-premises gateway appliance provides a deeper level of analysis for incoming email. For outgoing email, the local security gateway provides anti-virus and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The on-premises gateway can also assist Exchange Server to monitor and protect internal email traffic that originates and ends inside your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA services utilize Cisco's Duo cloud technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo supports one-tap identity confirmation on Apple iOS, Android, and other personal devices. With 2FA, when you log into a secured online account and give your password you are asked to confirm your identity via a unit that only you possess and that uses a separate network channel. A broad selection of devices can be used for this second means of ID validation such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You may designate several validation devices. For details about ProSight Duo identity authentication services, refer to Duo MFA two-factor authentication services.

• Outsourced/Co-managed Service Center: Call Center Managed Services
  Progent's Call Desk services permit your IT staff to offload Support Desk services to Progent or split activity for Service Desk support seamlessly between your in-house support staff and Progent's extensive roster of certified IT support engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk provides a seamless extension of your core support resources. Client interaction with the Help Desk, delivery of technical assistance, escalation, ticket generation and updates, efficiency measurement, and maintenance of the service database are cohesive whether incidents are resolved by your in-house support organization, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Service Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes next generation behavior analysis tools to defend endpoint devices and servers and VMs against new malware assaults like ransomware and file-less exploits, which routinely evade legacy signature-based anti-virus products. Progent ASM services protect local and cloud-based resources and offers a unified platform to automate the complete threat lifecycle including protection, detection, mitigation, remediation, and post-attack forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered attacks. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and safeguard data related to your network infrastructure, processes, applications, and services. You can instantly locate passwords or IP addresses and be alerted about impending expirations of SSLs or domains. By cleaning up and managing your IT infrastructure documentation, you can save as much as 50% of time spent looking for critical information about your network. ProSight IT Asset Management features a common location for storing and collaborating on all documents required for managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT information. Whether you're making enhancements, doing maintenance, or responding to an emergency, ProSight IT Asset Management gets you the information you need the instant you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a versatile and affordable alternative for assessing, testing, scheduling, applying, and documenting updates to your dynamic IT system. In addition to optimizing the protection and reliability of your IT environment, Progent's patch management services free up time for your in-house IT staff to focus on line-of-business initiatives and activities that derive the highest business value from your information network. Learn more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a secure Tier III data center on a high-performance virtual machine host set up and managed by Progent's IT support experts. Under Progent's ProSight Virtual Hosting model, the customer owns the data, the operating system software, and the applications. Because the system is virtualized, it can be moved easily to an alternate hardware environment without a lengthy and technically risky reinstallation procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that incorporates SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoint devices against modern malware assaults like ransomware and email phishing, which easily evade legacy signature-matching AV tools. ProSight ASM protects local and cloud resources and provides a unified platform to automate the entire malware attack progression including protection, identification, mitigation, remediation, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer affordable in-depth security for physical servers and VMs, workstations, mobile devices, and Exchange Server. ProSight ESP utilizes adaptive security and modern behavior analysis for continuously monitoring and responding to cyber assaults from all vectors. ProSight ESP provides two-way firewall protection, penetration alarms, endpoint management, and web filtering through cutting-edge tools packaged within one agent accessible from a unified control. Progent's security and virtualization experts can assist your business to design and implement a ProSight ESP deployment that meets your company's unique needs and that allows you demonstrate compliance with government and industry information protection regulations. Progent will help you define and configure security policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that call for immediate attention. Progent can also help you to install and test a backup and restore solution like ProSight Data Protection Services so you can get back in business rapidly from a potentially disastrous cyber attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.