Ontario 24x7 Critical Ransomware
Computer Virus Damage Assessment and Recovery Services

Ransomware : Your Feared IT Disaster
Crypto-Ransomware has become an escalating cyberplague that presents an existential threat for businesses of all sizes poorly prepared for an assault. Different iterations of crypto-ransomware like the CrySIS, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for many years and continue to inflict havoc. The latest versions of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit or Egregor, plus additional as yet unnamed viruses, not only encrypt on-line files but also infiltrate most available system backup. Data synched to cloud environments can also be ransomed. In a poorly architected data protection solution, it can render automatic recovery useless and effectively knocks the entire system back to square one.

Retrieving applications and data after a ransomware attack becomes a sprint against the clock as the targeted organization fights to stop lateral movement, cleanup the virus, and resume enterprise-critical activity. Since crypto-ransomware takes time to spread, attacks are often launched at night, when successful attacks in many cases take longer to uncover. This compounds the difficulty of promptly assembling and orchestrating an experienced response team.

Progent has a variety of support services for protecting businesses from crypto-ransomware events. Among these are team member education to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for remote monitoring and management, plus installation of next-generation security appliances with AI capabilities from SentinelOne to detect and disable day-zero threats rapidly. Progent in addition offers the services of veteran ransomware recovery consultants with the skills and commitment to rebuild a compromised system as quickly as possible.

Progent's Ransomware Restoration Help
After a ransomware invasion, even paying the ransom demands in cryptocurrency does not guarantee that cyber criminals will provide the codes to decrypt all your data. Kaspersky Labs ascertained that seventeen percent of ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The fallback is to piece back together the critical parts of your IT environment. Absent the availability of complete system backups, this requires a broad complement of skills, top notch team management, and the willingness to work 24x7 until the task is over.

For twenty years, Progent has provided professional Information Technology services for businesses across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained top industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have earned internationally-recognized certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in financial systems and ERP software solutions. This breadth of expertise gives Progent the skills to quickly understand critical systems and organize the remaining components of your IT system following a crypto-ransomware event and assemble them into a functioning system.

Progent's recovery team has best of breed project management tools to orchestrate the complex restoration process. Progent understands the urgency of acting quickly and in concert with a client's management and IT staff to prioritize tasks and to get critical systems back on line as fast as humanly possible.

Business Case Study: A Successful Ransomware Penetration Recovery
A customer sought out Progent after their network system was attacked by Ryuk ransomware virus. Ryuk is thought to have been launched by North Korean state cybercriminals, suspected of adopting algorithms exposed from the United States NSA organization. Ryuk attacks specific businesses with little ability to sustain operational disruption and is one of the most lucrative incarnations of ransomware viruses. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing business based in Chicago and has about 500 staff members. The Ryuk event had shut down all business operations and manufacturing capabilities. Most of the client's information backups had been online at the beginning of the attack and were damaged. The client considered paying the ransom demand (more than $200K) and hoping for the best, but ultimately engaged Progent.

Progent worked hand in hand the customer to quickly identify and prioritize the mission critical applications that needed to be recovered to make it possible to continue company functions:

• Active Directory
• Microsoft Exchange Email
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then helped perform setup and hard drive recovery on essential systems. All Exchange ties and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to collect local OST files (Outlook Off-Line Folder Files) on various desktop computers in order to recover email information. A recent offline backup of the businesses financials/ERP systems made them able to return these required programs back available to users. Although a lot of work needed to be completed to recover completely from the Ryuk attack, essential services were restored rapidly:

Over the following month key milestones in the recovery process were accomplished in tight collaboration between Progent consultants and the customer:

• Internal web applications were restored without losing any information.
• The MailStore Server containing more than four million historical messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were 100% operational.
• A new Palo Alto Networks 850 security appliance was brought online.
• Ninety percent of the user workstations were operational.

Conclusion
A possible business catastrophe was averted by results-oriented professionals, a broad array of knowledge, and close teamwork. Although in retrospect the crypto-ransomware penetration detailed here would have been identified and prevented with current security technology and security best practices, user and IT administrator training, and well thought out incident response procedures for data protection and applying software patches, the reality remains that state-sponsored cybercriminals from China, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware incursion, feel confident that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, remediation, and file recovery.

To read or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide businesses in Ontario a range of remote monitoring and security assessment services to help you to reduce the threat from crypto-ransomware. These services include next-generation AI technology to uncover new variants of ransomware that can get past legacy signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to achieve leading-edge network resilience. Progent takes care of the necessary monitoring and management for you, so your system expands smoothly without becoming an obstacle. For a low and predictable monthly subscription, Progent's experienced IT team can be your dependable technology safety net. Basic packages include remote monitoring and management (RMM), security, monthly patching, and documentation. As your requirements grow, you can add low-cost subscriptions to advanced options such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to help keep your network running at peak levels by tracking the health of vital computers that drive your business network. When ProSight LAN Watch detects a problem, an alert is sent automatically to your designated IT management staff and your assigned Progent consultant so all potential problems can be addressed before they have a chance to disrupt your network. Find out more details about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-driven platform for monitoring and managing your client-server infrastructure by offering an environment for performing common time-consuming jobs. These can include health checking, patch management, automated repairs, endpoint setup, backup and recovery, anti-virus response, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious incident, it transmits an alert to your designated IT management staff and your assigned Progent consultant so emerging issues can be fixed before they interfere with productivity. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and inexpensive for small and mid-sized businesses to map out, track, optimize and troubleshoot their connectivity hardware such as routers, firewalls, and wireless controllers as well as servers, endpoints and other devices. Using cutting-edge RMM technology, ProSight WAN Watch ensures that infrastructure topology diagrams are kept current, captures and manages the configuration information of almost all devices connected to your network, tracks performance, and generates notices when issues are detected. By automating complex management and troubleshooting activities, WAN Watch can knock hours off common chores such as network mapping, reconfiguring your network, locating appliances that need important software patches, or isolating performance bottlenecks. Learn more details about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of in-depth management reporting plug-ins designed to integrate with the industry's top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as inconsistent support follow-up or endpoints with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, lowers management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has partnered with leading backup technology providers to create ProSight Data Protection Services (DPS), a selection of management outsourcing plans that provide backup-as-a-service (BaaS). ProSight DPS products automate and track your backup processes and enable non-disruptive backup and rapid recovery of critical files, applications, images, and VMs. ProSight DPS lets you recover from data loss resulting from equipment failures, natural calamities, fire, malware like ransomware, user mistakes, ill-intentioned insiders, or application glitches. Managed services available in the ProSight DPS portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built hardware, and ProSight MSP360 Hybrid Backup. Your Progent expert can assist you to determine which of these managed backup services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading data security vendors to deliver centralized management and comprehensive security for all your email traffic. The powerful structure of Email Guard managed service integrates a Cloud Protection Layer with an on-premises security gateway device to offer complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. The Cloud Protection Layer serves as a preliminary barricade and blocks the vast majority of unwanted email from making it to your security perimeter. This reduces your exposure to external attacks and saves system bandwidth and storage. Email Guard's onsite gateway appliance provides a deeper level of analysis for inbound email. For outbound email, the onsite gateway provides AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite gateway can also help Exchange Server to monitor and safeguard internal email that stays inside your security perimeter. For more details, see Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA service plans utilize Cisco's Duo technology to defend against stolen passwords by using two-factor authentication (2FA). Duo supports one-tap identity verification on Apple iOS, Google Android, and other personal devices. With 2FA, when you log into a protected application and give your password you are asked to verify who you are on a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A wide range of devices can be used for this second means of authentication including an iPhone or Android or watch, a hardware token, a landline telephone, etc. You can designate multiple validation devices. To learn more about Duo identity validation services, refer to Duo MFA two-factor authentication (2FA) services.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Help Desk managed services permit your information technology staff to outsource Call Center services to Progent or divide responsibilities for Service Desk support seamlessly between your internal support resources and Progent's nationwide roster of certified IT service technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a transparent supplement to your core network support group. Client access to the Help Desk, delivery of technical assistance, problem escalation, trouble ticket creation and updates, efficiency metrics, and maintenance of the support database are cohesive whether issues are taken care of by your corporate network support resources, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/shared Help Desk services.

• Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates next generation behavior-based analysis tools to guard endpoint devices and servers and VMs against modern malware assaults like ransomware and file-less exploits, which easily escape legacy signature-matching anti-virus tools. Progent ASM services protect on-premises and cloud resources and offers a unified platform to manage the entire threat progression including protection, infiltration detection, mitigation, cleanup, and forensics. Key features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Read more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, find and protect data about your network infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be alerted about impending expirations of SSL certificates or domains. By updating and managing your IT infrastructure documentation, you can save up to 50% of time wasted looking for critical information about your network. ProSight IT Asset Management includes a common repository for storing and collaborating on all documents related to managing your business network like standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're making enhancements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the information you require the instant you need it. Learn more about Progent's ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer organizations of any size a flexible and affordable alternative for assessing, testing, scheduling, implementing, and tracking updates to your dynamic IT network. Besides optimizing the protection and functionality of your IT network, Progent's software/firmware update management services permit your in-house IT team to focus on more strategic initiatives and tasks that deliver maximum business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a secure Tier III data center on a fast virtual machine host set up and managed by Progent's network support professionals. With the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the apps. Because the environment is virtualized, it can be moved immediately to an alternate hosting environment without requiring a lengthy and technically risky reinstallation process. With ProSight Virtual Hosting, your business is not locked into one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior-based machine learning tools to guard physical and virtual endpoint devices against new malware assaults such as ransomware and email phishing, which routinely escape legacy signature-matching AV products. ProSight Active Security Monitoring safeguards on-premises and cloud resources and provides a unified platform to address the entire malware attack lifecycle including filtering, infiltration detection, containment, cleanup, and forensics. Key capabilities include one-click rollback with Windows VSS and automatic system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Filtering
  ProSight Enhanced Security Protection (ESP) managed services offer affordable multi-layer protection for physical and virtual servers, desktops, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to security assaults from all vectors. ProSight ESP delivers two-way firewall protection, intrusion alerts, device control, and web filtering through leading-edge technologies incorporated within one agent accessible from a single control. Progent's security and virtualization consultants can assist you to plan and implement a ProSight ESP environment that meets your organization's unique needs and that allows you prove compliance with legal and industry data protection regulations. Progent will assist you specify and implement policies that ProSight ESP will manage, and Progent will monitor your network and respond to alerts that require urgent attention. Progent can also help your company to set up and verify a backup and disaster recovery system like ProSight Data Protection Services so you can recover rapidly from a potentially disastrous security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange email filtering.