Omaha 24/7 Urgent Ransomware
Virus Identification and Restoration Support

Ransomware : Your Crippling IT Disaster
Ransomware has become a too-frequent cyber pandemic that presents an extinction-level danger for businesses of all sizes vulnerable to an assault. Versions of ransomware like the CrySIS, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been out in the wild for years and continue to cause destruction. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, plus frequent as yet unnamed malware, not only do encryption of online data but also infect most configured system backup. Files replicated to cloud environments can also be corrupted. In a poorly designed environment, this can render any restore operations hopeless and effectively knocks the entire system back to square one.

Recovering applications and information following a crypto-ransomware event becomes a race against time as the targeted business tries its best to contain, cleanup the ransomware, and restore enterprise-critical operations. Because crypto-ransomware needs time to spread, assaults are often launched during weekends and nights, when penetrations typically take more time to discover. This multiplies the difficulty of quickly mobilizing and organizing a capable mitigation team.

Progent has a range of help services for protecting businesses from crypto-ransomware events. Among these are team training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, along with installation of the latest generation security appliances with machine learning capabilities from SentinelOne to discover and extinguish day-zero cyber attacks intelligently. Progent in addition can provide the services of veteran crypto-ransomware recovery engineers with the skills and perseverance to reconstruct a compromised network as soon as possible.

Progent's Ransomware Restoration Support Services
Soon after a crypto-ransomware event, paying the ransom in cryptocurrency does not ensure that cyber criminals will respond with the keys to decipher any or all of your data. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to setup from scratch the critical components of your Information Technology environment. Absent access to essential system backups, this calls for a wide range of skills, top notch project management, and the ability to work 24x7 until the task is over.

For two decades, Progent has provided certified expert Information Technology services for businesses across the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained top industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in financial systems and ERP application software. This breadth of expertise provides Progent the ability to efficiently identify important systems and consolidate the remaining pieces of your network environment after a crypto-ransomware event and assemble them into a functioning network.

Progent's recovery team of experts has best of breed project management systems to orchestrate the complicated restoration process. Progent understands the urgency of working quickly and in unison with a customer's management and Information Technology resources to prioritize tasks and to put the most important applications back on line as fast as possible.

Client Story: A Successful Ransomware Attack Restoration
A customer engaged Progent after their network system was brought down by Ryuk ransomware virus. Ryuk is thought to have been created by North Korean state sponsored cybercriminals, possibly using techniques leaked from the U.S. National Security Agency. Ryuk attacks specific businesses with limited room for disruption and is one of the most lucrative examples of ransomware malware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company based in the Chicago metro area with about 500 employees. The Ryuk intrusion had brought down all business operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the start of the attack and were eventually encrypted. The client considered paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for the best, but in the end engaged Progent.

Progent worked together with the customer to rapidly determine and prioritize the critical systems that had to be addressed in order to restart company functions:

• Windows Active Directory
• E-Mail
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to recover Windows Active Directory to its pre-intrusion state. Progent then performed setup and storage recovery on critical servers. All Exchange schema and attributes were usable, which facilitated the restore of Exchange. Progent was also able to assemble intact OST data files (Microsoft Outlook Offline Folder Files) on team desktop computers and laptops to recover email information. A recent offline backup of the client's financials/ERP systems made it possible to recover these essential programs back online for users. Although a large amount of work was left to recover fully from the Ryuk attack, essential services were restored rapidly:

During the following few weeks critical milestones in the restoration process were accomplished in tight cooperation between Progent consultants and the client:

• Self-hosted web applications were brought back up without losing any information.
• The MailStore Microsoft Exchange Server containing more than four million historical emails was brought on-line and available for users.
• CRM/Orders/Invoicing/AP/Accounts Receivables (AR)/Inventory Control modules were 100% restored.
• A new Palo Alto Networks 850 security appliance was installed.
• 90% of the user workstations were functioning as before the incident.

Conclusion
A probable company-ending disaster was averted with results-oriented experts, a broad range of IT skills, and close collaboration. Although in post mortem the ransomware incident described here could have been identified and blocked with advanced security systems and recognized best practices, team training, and well designed security procedures for data backup and applying software patches, the fact is that state-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware attack, feel confident that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and file disaster recovery.

To read or download a PDF version of this ransomware incident report, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide companies in Omaha a variety of online monitoring and security assessment services designed to help you to reduce the threat from ransomware. These services include next-generation artificial intelligence capability to uncover zero-day variants of ransomware that are able to get past legacy signature-based security products.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it possible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent handles the daily monitoring and maintenance for you, so your network scales easily without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Entry-level packages include RMM, cybersecurity, automatic monthly patching, and documentation. As your needs grow, you can add low-cost subscriptions to best-of-breed options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses advanced remote monitoring and management techniques to keep your IT system running efficiently by checking the health of critical assets that power your business network. When ProSight LAN Watch uncovers a problem, an alarm is sent automatically to your specified IT management staff and your Progent consultant so any potential issues can be resolved before they can disrupt productivity. Find out more about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based platform for managing your network, server, and desktop devices by providing tools for streamlining common tedious jobs. These can include health monitoring, patch management, automated repairs, endpoint configuration, backup and restore, anti-virus response, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and debugging support. If ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your specified IT personnel and your assigned Progent consultant so emerging problems can be fixed before they interfere with your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure monitoring and management service that makes it simple and inexpensive for small and mid-sized organizations to map out, track, enhance and debug their networking hardware such as switches, firewalls, and wireless controllers as well as servers, endpoints and other devices. Using cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch ensures that network maps are kept updated, copies and displays the configuration information of almost all devices on your network, tracks performance, and sends notices when issues are discovered. By automating time-consuming network management processes, WAN Watch can cut hours off ordinary tasks such as making network diagrams, expanding your network, finding appliances that need critical updates, or resolving performance problems. Learn more details about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of real-time and in-depth management reporting plug-ins designed to work with the industry's top ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to highlight and contextualize key issues like spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software companies to create ProSight Data Protection Services (DPS), a portfolio of management outsourcing plans that deliver backup-as-a-service (BaaS). ProSight DPS services manage and track your data backup operations and enable non-disruptive backup and rapid recovery of vital files/folders, apps, system images, and virtual machines. ProSight DPS helps you avoid data loss resulting from equipment breakdown, natural disasters, fire, cyber attacks like ransomware, user mistakes, malicious employees, or application glitches. Managed services in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to determine which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading information security companies to provide web-based control and world-class protection for your email traffic. The powerful structure of Email Guard managed service combines a Cloud Protection Layer with a local security gateway device to offer advanced defense against spam, viruses, Dos Attacks, DHAs, and other email-based threats. Email Guard's cloud filter serves as a first line of defense and keeps the vast majority of unwanted email from making it to your network firewall. This decreases your exposure to external threats and conserves system bandwidth and storage space. Email Guard's onsite gateway device adds a deeper level of analysis for incoming email. For outbound email, the local gateway provides anti-virus and anti-spam filtering, DLP, and email encryption. The on-premises gateway can also assist Exchange Server to monitor and protect internal email traffic that stays inside your security perimeter. For more details, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo MFA service plans incorporate Cisco's Duo technology to defend against password theft by using two-factor authentication. Duo enables single-tap identity confirmation on Apple iOS, Google Android, and other out-of-band devices. With 2FA, when you sign into a protected online account and give your password you are asked to confirm who you are on a device that only you have and that uses a different network channel. A broad range of devices can be used as this second form of ID validation such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You may designate several verification devices. For more information about Duo identity authentication services, go to Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Desk: Call Center Managed Services
  Progent's Help Center services allow your information technology team to offload Call Center services to Progent or divide responsibilities for support services seamlessly between your in-house network support team and Progent's extensive roster of IT service engineers and subject matter experts (SMEs). Progent's Shared Service Desk provides a seamless extension of your core network support resources. End user access to the Service Desk, provision of technical assistance, problem escalation, ticket creation and tracking, efficiency metrics, and maintenance of the service database are consistent whether issues are taken care of by your core network support staff, by Progent's team, or both. Learn more about Progent's outsourced/shared Call Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior-based analysis technology to guard endpoints and servers and VMs against modern malware assaults such as ransomware and file-less exploits, which routinely evade traditional signature-based AV tools. Progent ASM services safeguard on-premises and cloud-based resources and provides a single platform to address the entire malware attack lifecycle including protection, detection, mitigation, cleanup, and forensics. Key capabilities include one-click rollback using Windows VSS and real-time network-wide immunization against new threats. Find out more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to create, maintain, retrieve and safeguard information related to your network infrastructure, procedures, business apps, and services. You can instantly locate passwords or IP addresses and be alerted about impending expirations of SSL certificates or domains. By cleaning up and organizing your network documentation, you can save up to half of time wasted searching for critical information about your network. ProSight IT Asset Management features a centralized location for storing and sharing all documents required for managing your business network such as standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and associating IT data. Whether you're making enhancements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Learn more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer organizations of any size a versatile and affordable solution for evaluating, testing, scheduling, implementing, and tracking updates to your dynamic IT network. In addition to maximizing the protection and reliability of your computer network, Progent's patch management services permit your IT staff to focus on line-of-business projects and tasks that derive maximum business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual host set up and maintained by Progent's network support professionals. Under the ProSight Virtual Hosting model, the customer retains ownership of the data, the OS platforms, and the apps. Since the system is virtualized, it can be ported easily to an alternate hardware environment without a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not tied a single hosting service. Learn more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's cutting edge behavior-based analysis tools to guard physical and virtual endpoint devices against modern malware attacks such as ransomware and email phishing, which easily get by legacy signature-based anti-virus tools. ProSight Active Security Monitoring protects local and cloud-based resources and offers a unified platform to manage the complete threat progression including blocking, identification, mitigation, cleanup, and post-attack forensics. Key capabilities include one-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection services deliver affordable multi-layer protection for physical servers and virtual machines, workstations, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, endpoint management, and web filtering through cutting-edge tools packaged within one agent accessible from a unified control. Progent's security and virtualization consultants can assist your business to design and configure a ProSight ESP deployment that addresses your organization's unique needs and that helps you demonstrate compliance with legal and industry data protection standards. Progent will help you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alarms that call for urgent attention. Progent's consultants can also help you to install and verify a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can get back in business quickly from a potentially disastrous cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Microsoft Exchange email filtering.