Lynnwood 24-Hour Critical Ransomware
Computer Virus Assessment and Restoration Consulting

Ransomware : Your Feared Information Technology Nightmare
Ransomware has become a too-frequent cyber pandemic that poses an extinction-level threat for organizations poorly prepared for an attack. Different versions of ransomware like the CryptoLocker, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for many years and continue to inflict harm. More recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, along with frequent unnamed newcomers, not only do encryption of online critical data but also infect many available system restores and backups. Files synchronized to cloud environments can also be corrupted. In a vulnerable data protection solution, it can render any restore operations useless and effectively knocks the datacenter back to zero.

Restoring applications and information following a ransomware outage becomes a race against the clock as the targeted business struggles to stop lateral movement, remove the crypto-ransomware, and restore business-critical operations. Since ransomware takes time to move laterally, penetrations are usually sprung at night, when penetrations typically take longer to discover. This multiplies the difficulty of promptly marshalling and coordinating a knowledgeable response team.

Progent makes available a variety of services for protecting businesses from crypto-ransomware attacks. Among these are team training to help recognize and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to deployment of modern security gateways with AI technology from SentinelOne to discover and quarantine zero-day cyber attacks intelligently. Progent in addition offers the assistance of experienced ransomware recovery professionals with the talent and commitment to reconstruct a breached system as rapidly as possible.

Progent's Ransomware Recovery Help
Following a ransomware invasion, even paying the ransom demands in cryptocurrency does not ensure that merciless criminals will provide the keys to decipher all your information. Kaspersky determined that 17% of crypto-ransomware victims never restored their information even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The alternative is to setup from scratch the vital components of your IT environment. Absent access to essential information backups, this requires a wide range of skill sets, top notch team management, and the capability to work non-stop until the job is finished.

For decades, Progent has provided professional IT services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have been awarded top certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial management and ERP applications. This breadth of expertise provides Progent the skills to quickly determine necessary systems and organize the remaining components of your Information Technology environment following a ransomware penetration and rebuild them into a functioning system.

Progent's ransomware team of experts has best of breed project management applications to orchestrate the complicated recovery process. Progent appreciates the urgency of working quickly and together with a customer's management and IT team members to assign priority to tasks and to get key applications back on-line as soon as possible.

Client Story: A Successful Ransomware Intrusion Response
A customer sought out Progent after their organization was attacked by the Ryuk ransomware. Ryuk is believed to have been created by North Korean state criminal gangs, possibly using strategies leaked from the United States NSA organization. Ryuk attacks specific organizations with little or no room for disruption and is one of the most lucrative instances of ransomware. Well Known targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing company located in the Chicago metro area with around 500 staff members. The Ryuk intrusion had disabled all company operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the time of the intrusion and were eventually encrypted. The client was pursuing financing for paying the ransom demand (exceeding $200K) and praying for good luck, but ultimately brought in Progent.

Progent worked with the client to quickly identify and prioritize the critical systems that had to be restored in order to resume departmental operations:

• Active Directory (AD)
• Electronic Messaging
• MRP System

In less than 2 days, Progent was able to rebuild Active Directory to its pre-virus state. Progent then charged ahead with rebuilding and storage recovery of mission critical servers. All Exchange data and attributes were intact, which accelerated the restore of Exchange. Progent was able to find intact OST files (Microsoft Outlook Offline Data Files) on user desktop computers and laptops to recover email messages. A recent offline backup of the client's financials/ERP software made them able to recover these required applications back online. Although a large amount of work was left to recover fully from the Ryuk virus, essential systems were returned to operations rapidly:

Over the following couple of weeks important milestones in the restoration project were achieved in close cooperation between Progent team members and the customer:

• In-house web applications were returned to operation with no loss of information.
• The MailStore Server containing more than four million historical messages was brought on-line and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory modules were fully recovered.
• A new Palo Alto Networks 850 security appliance was installed.
• Most of the user PCs were operational.

Conclusion
A potential business extinction disaster was evaded through the efforts of hard-working professionals, a broad spectrum of knowledge, and tight collaboration. Although in post mortem the crypto-ransomware attack detailed here should have been prevented with modern cyber security systems and NIST Cybersecurity Framework best practices, staff training, and appropriate incident response procedures for information backup and keeping systems up to date with security patches, the reality is that government-sponsored criminal cyber gangs from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware incursion, remember that Progent's roster of experts has a proven track record in ransomware virus blocking, removal, and file disaster recovery.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Lynnwood a portfolio of online monitoring and security assessment services to help you to minimize the threat from ransomware. These services include next-generation artificial intelligence capability to detect new variants of ransomware that are able to escape detection by legacy signature-based anti-virus solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to deploy Remote Monitoring and Management (RMM) solutions to achieve advanced network resilience. Progent takes care of the necessary monitoring and management for you, so your network scales readily without becoming an obstacle. For an affordable and predictable monthly price, Progent's experienced IT group can be your dependable technology safety net. Entry-level plans include remote monitoring and management (RMM), security, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to best-of-breed options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses state-of-the-art remote monitoring and management technology to help keep your network running at peak levels by checking the health of vital assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alert is transmitted immediately to your designated IT management staff and your assigned Progent consultant so that any looming issues can be resolved before they can disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven solution for monitoring and managing your network, server, and desktop devices by offering tools for streamlining common time-consuming tasks. These can include health monitoring, patch management, automated repairs, endpoint deployment, backup and recovery, anti-virus protection, remote access, standard and custom scripts, resource inventory, endpoint status reports, and debugging support. If ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your specified IT personnel and your assigned Progent consultant so emerging problems can be fixed before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for small and mid-sized organizations to map, monitor, reconfigure and troubleshoot their networking appliances like routers, firewalls, and access points as well as servers, printers, client computers and other devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch ensures that network maps are kept updated, copies and manages the configuration of almost all devices connected to your network, tracks performance, and generates notices when issues are discovered. By automating tedious network management processes, WAN Watch can cut hours off common chores like network mapping, expanding your network, finding devices that require important updates, or isolating performance bottlenecks. Find out more details about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of in-depth reporting utilities created to work with the leading ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize critical issues like spotty support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances productivity, lowers management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with leading backup technology providers to produce ProSight Data Protection Services (DPS), a family of offerings that provide backup-as-a-service. ProSight DPS products manage and monitor your backup processes and allow non-disruptive backup and fast recovery of critical files/folders, apps, images, plus virtual machines. ProSight DPS helps your business recover from data loss caused by equipment failures, natural calamities, fire, malware like ransomware, user error, malicious insiders, or application glitches. Managed backup services available in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to identify which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of leading data security vendors to provide web-based management and comprehensive protection for all your inbound and outbound email. The hybrid structure of Email Guard combines cloud-based filtering with an on-premises security gateway appliance to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based threats. Email Guard's Cloud Protection Layer serves as a preliminary barricade and blocks most threats from reaching your network firewall. This reduces your vulnerability to external attacks and conserves network bandwidth and storage space. Email Guard's on-premises security gateway device provides a deeper level of inspection for inbound email. For outgoing email, the on-premises security gateway provides AV and anti-spam protection, protection against data leaks, and email encryption. The local security gateway can also help Microsoft Exchange Server to track and safeguard internal email that originates and ends within your security perimeter. For more information, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Protected Single Sign-on (SSO)
  Progent's Duo MFA managed services incorporate Cisco's Duo cloud technology to defend against password theft through the use of two-factor authentication (2FA). Duo supports single-tap identity verification with iOS, Google Android, and other personal devices. Using 2FA, when you log into a protected application and give your password you are requested to verify who you are on a device that only you possess and that is accessed using a different ("out-of-band") network channel. A wide range of devices can be used for this added means of ID validation such as an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You may register multiple validation devices. To find out more about Duo two-factor identity authentication services, visit Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Call Center: Support Desk Managed Services
  Progent's Help Center managed services permit your information technology group to outsource Call Center services to Progent or divide activity for Help Desk services transparently between your internal support group and Progent's extensive roster of certified IT service technicians, engineers and subject matter experts. Progent's Shared Help Desk Service provides a seamless extension of your core network support resources. End user access to the Help Desk, delivery of technical assistance, escalation, ticket generation and tracking, performance metrics, and management of the support database are consistent whether issues are taken care of by your internal network support organization, by Progent's team, or both. Find out more about Progent's outsourced/co-managed Call Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection solution that incorporates next generation behavior-based machine learning tools to guard endpoints and physical and virtual servers against modern malware attacks like ransomware and file-less exploits, which routinely escape traditional signature-based anti-virus tools. Progent ASM services safeguard local and cloud resources and offers a single platform to automate the entire threat progression including filtering, detection, mitigation, cleanup, and post-attack forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, find and safeguard information about your network infrastructure, processes, applications, and services. You can instantly find passwords or serial numbers and be warned about impending expirations of SSLs or warranties. By updating and organizing your network documentation, you can eliminate up to 50% of time thrown away trying to find critical information about your network. ProSight IT Asset Management includes a common location for storing and collaborating on all documents required for managing your business network like recommended procedures and self-service instructions. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're making enhancements, performing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the knowledge you need when you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer businesses of any size a versatile and affordable solution for evaluating, validating, scheduling, applying, and tracking updates to your dynamic IT network. In addition to maximizing the protection and reliability of your computer environment, Progent's patch management services permit your in-house IT staff to concentrate on more strategic initiatives and tasks that derive maximum business value from your network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and apps hosted in a protected Tier III data center on a fast virtual host set up and managed by Progent's IT support professionals. Under Progent's ProSight Virtual Hosting model, the client owns the data, the OS platforms, and the apps. Since the environment is virtualized, it can be moved immediately to an alternate hosting environment without a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, you are not locked into one hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that utilizes SentinelOne's next generation behavior-based analysis tools to defend physical and virtual endpoint devices against modern malware assaults such as ransomware and file-less exploits, which easily escape legacy signature-matching anti-virus products. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a single platform to automate the entire malware attack lifecycle including protection, infiltration detection, containment, cleanup, and post-attack forensics. Key features include single-click rollback using Windows Volume Shadow Copy Service and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver affordable in-depth protection for physical and virtual servers, workstations, smartphones, and Microsoft Exchange. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, device management, and web filtering via leading-edge tools packaged within a single agent managed from a unified control. Progent's data protection and virtualization experts can help you to design and configure a ProSight ESP deployment that addresses your organization's specific needs and that allows you achieve and demonstrate compliance with government and industry information security regulations. Progent will help you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and react to alarms that require immediate action. Progent can also assist your company to install and test a backup and restore system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Microsoft Exchange filtering.