Ottawa 24/7 Immediate Crypto
Virus Assessment and Remediation Experts

Crypto-Ransomware : Your Worst IT Disaster
Ransomware has become a modern cyberplague that presents an existential threat for businesses of all sizes unprepared for an attack. Different iterations of crypto-ransomware like the CrySIS, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for years and still inflict damage. Modern variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Nephilim, along with daily as yet unnamed malware, not only do encryption of on-line files but also infiltrate all configured system restores and backups. Information synchronized to off-site disaster recovery sites can also be corrupted. In a vulnerable data protection solution, it can render automatic restore operations impossible and effectively sets the entire system back to zero.

Getting back online applications and data following a ransomware attack becomes a race against the clock as the victim fights to stop the spread, eradicate the virus, and resume mission-critical activity. Because ransomware requires time to replicate, attacks are usually launched on weekends, when successful penetrations may take longer to detect. This compounds the difficulty of rapidly assembling and coordinating a knowledgeable mitigation team.

Progent provides a range of support services for securing businesses from crypto-ransomware attacks. Among these are user training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of the latest generation security gateways with AI capabilities from SentinelOne to detect and disable new cyber attacks rapidly. Progent also provides the assistance of experienced ransomware recovery professionals with the skills and perseverance to reconstruct a compromised system as urgently as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware invasion, even paying the ransom in cryptocurrency does not ensure that cyber hackers will return the keys to decipher any of your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The other path is to setup from scratch the essential elements of your IT environment. Without the availability of essential information backups, this calls for a broad complement of IT skills, professional team management, and the willingness to work 24x7 until the recovery project is complete.

For twenty years, Progent has made available certified expert IT services for companies across the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained advanced industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have garnered internationally-recognized industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with accounting and ERP software solutions. This breadth of expertise affords Progent the ability to knowledgably understand critical systems and re-organize the surviving parts of your Information Technology system following a ransomware attack and rebuild them into an operational system.

Progent's security group utilizes best of breed project management systems to orchestrate the complicated recovery process. Progent understands the urgency of working rapidly and in concert with a customer's management and Information Technology staff to assign priority to tasks and to put the most important services back on-line as soon as humanly possible.

Customer Story: A Successful Crypto-Ransomware Intrusion Restoration
A customer sought out Progent after their network system was penetrated by the Ryuk ransomware virus. Ryuk is thought to have been developed by North Korean government sponsored hackers, possibly using approaches exposed from America's NSA organization. Ryuk seeks specific companies with little room for disruption and is among the most lucrative iterations of crypto-ransomware. Major targets include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business based in the Chicago metro area with around 500 workers. The Ryuk penetration had paralyzed all business operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the time of the attack and were destroyed. The client was actively seeking loans for paying the ransom (more than two hundred thousand dollars) and hoping for the best, but in the end engaged Progent.

Progent worked with the customer to quickly understand and assign priority to the critical services that needed to be restored in order to resume business functions:

• Microsoft Active Directory
• Microsoft Exchange
• Accounting and Manufacturing Software

Within two days, Progent was able to recover Windows Active Directory to its pre-virus state. Progent then assisted with reinstallations and hard drive recovery of needed applications. All Exchange schema and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to collect non-encrypted OST files (Microsoft Outlook Off-Line Data Files) on team desktop computers in order to recover mail messages. A recent offline backup of the customer's manufacturing systems made it possible to recover these required programs back servicing users. Although significant work still had to be done to recover totally from the Ryuk virus, critical services were restored quickly:

Over the following couple of weeks critical milestones in the recovery process were achieved through tight cooperation between Progent engineers and the customer:

• Internal web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server containing more than four million historical messages was spun up and available for users.
• CRM/Orders/Invoices/AP/AR/Inventory Control functions were 100 percent restored.
• A new Palo Alto 850 security appliance was installed.
• 90% of the desktops and laptops were being used by staff.

Conclusion
A potential business-ending catastrophe was avoided by top-tier experts, a broad range of IT skills, and tight teamwork. Although in hindsight the crypto-ransomware virus attack detailed here should have been identified and stopped with advanced security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, team education, and appropriate incident response procedures for information backup and proper patching controls, the reality remains that government-sponsored hackers from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware incursion, remember that Progent's team of experts has extensive experience in ransomware virus blocking, mitigation, and information systems recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent can provide businesses in Ottawa a range of online monitoring and security assessment services to help you to reduce the threat from crypto-ransomware. These services include next-generation machine learning capability to detect new strains of ransomware that are able to escape detection by traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size companies to utilize Remote Monitoring and Management (RMM) technology to achieve advanced network resilience. Progent takes care of the daily monitoring and management for you, so your system scales easily without becoming an obstacle. For an affordable and predictable monthly price, Progent's experienced IT group can be your complete technology safety net. Entry-level packages include remote monitoring and management (RMM), cybersecurity, monthly patching, and reporting. As your requirements grow, you can add low-cost subscriptions to best-of-breed solutions such as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that uses advanced remote monitoring and management techniques to help keep your network running efficiently by checking the health of vital computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your designated IT personnel and your Progent consultant so that any looming issues can be resolved before they have a chance to impact your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-based solution for monitoring and managing your client-server infrastructure by providing tools for performing common time-consuming tasks. These can include health checking, patch management, automated remediation, endpoint deployment, backup and restore, A/V defense, remote access, standard and custom scripts, asset inventory, endpoint status reporting, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your designated IT management staff and your Progent technical consultant so emerging problems can be fixed before they impact your network. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring consulting.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized businesses to map out, monitor, enhance and debug their networking appliances like switches, firewalls, and access points plus servers, printers, client computers and other networked devices. Using state-of-the-art Remote Monitoring and Management technology, WAN Watch makes sure that network diagrams are always current, copies and displays the configuration information of almost all devices connected to your network, tracks performance, and sends alerts when problems are detected. By automating complex management and troubleshooting processes, WAN Watch can cut hours off common chores like network mapping, reconfiguring your network, locating devices that need important software patches, or isolating performance bottlenecks. Find out more about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of in-depth management reporting utilities designed to work with the industry's top ticketing and network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to surface and contextualize critical issues like spotty support follow-through or endpoints with out-of-date AVs. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore software providers to produce ProSight Data Protection Services (DPS), a selection of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS services automate and track your data backup processes and allow transparent backup and rapid restoration of important files/folders, applications, system images, and VMs. ProSight DPS lets your business avoid data loss resulting from hardware failures, natural disasters, fire, cyber attacks like ransomware, user mistakes, malicious insiders, or software glitches. Managed services in the ProSight Data Protection Services product family include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated hardware, and ProSight DPS MSP360 Hybrid Backup. Your Progent service representative can assist you to determine which of these managed services are best suited for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading data security vendors to deliver centralized management and world-class security for all your inbound and outbound email. The powerful architecture of Email Guard integrates a Cloud Protection Layer with an on-premises gateway device to provide complete protection against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based threats. The cloud filter serves as a preliminary barricade and keeps most threats from reaching your security perimeter. This reduces your exposure to external threats and conserves network bandwidth and storage space. Email Guard's on-premises security gateway appliance provides a further level of inspection for inbound email. For outgoing email, the on-premises security gateway offers AV and anti-spam protection, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also help Exchange Server to track and protect internal email that originates and ends inside your security perimeter. For more details, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo authentication managed services utilize Cisco's Duo cloud technology to defend against password theft through the use of two-factor authentication (2FA). Duo supports single-tap identity confirmation on iOS, Android, and other out-of-band devices. Using 2FA, whenever you log into a secured online account and enter your password you are requested to verify your identity on a unit that only you possess and that is accessed using a different network channel. A wide range of devices can be utilized for this added form of ID validation including a smartphone or wearable, a hardware token, a landline phone, etc. You can register multiple verification devices. For details about ProSight Duo identity authentication services, go to Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Service Desk: Support Desk Managed Services
  Progent's Help Desk services allow your information technology team to outsource Support Desk services to Progent or split responsibilities for Help Desk services seamlessly between your internal support group and Progent's extensive pool of certified IT service engineers and subject matter experts. Progent's Shared Help Desk Service offers a smooth supplement to your corporate support staff. User access to the Help Desk, delivery of technical assistance, problem escalation, ticket generation and updates, efficiency measurement, and maintenance of the support database are cohesive whether issues are resolved by your in-house IT support staff, by Progent, or by a combination. Find out more about Progent's outsourced/co-managed Call Desk services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior machine learning technology to defend endpoints as well as physical and virtual servers against new malware assaults such as ransomware and email phishing, which routinely evade legacy signature-matching anti-virus products. Progent ASM services protect local and cloud resources and offers a unified platform to automate the entire threat lifecycle including filtering, infiltration detection, containment, cleanup, and post-attack forensics. Top features include one-click rollback with Windows VSS and real-time network-wide immunization against new attacks. Learn more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, retrieve and safeguard data about your network infrastructure, processes, business apps, and services. You can instantly find passwords or IP addresses and be alerted automatically about impending expirations of SSLs or warranties. By cleaning up and managing your IT infrastructure documentation, you can save up to 50% of time wasted searching for vital information about your IT network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents required for managing your business network such as standard operating procedures (SOPs) and self-service instructions. ProSight IT Asset Management also offers advanced automation for collecting and relating IT information. Whether you're making improvements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the data you require the instant you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management provide organizations of all sizes a versatile and cost-effective alternative for evaluating, validating, scheduling, applying, and documenting updates to your ever-evolving IT network. In addition to optimizing the protection and reliability of your computer environment, Progent's software/firmware update management services allow your IT team to concentrate on more strategic initiatives and activities that deliver the highest business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its key servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host set up and managed by Progent's network support professionals. Under Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system platforms, and the applications. Since the environment is virtualized, it can be ported easily to a different hosting environment without requiring a lengthy and technically risky configuration procedure. With ProSight Virtual Hosting, your business is not tied one hosting provider. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's cutting edge behavior-based machine learning tools to guard physical and virtual endpoints against new malware attacks like ransomware and file-less exploits, which easily get by legacy signature-matching AV tools. ProSight ASM safeguards local and cloud-based resources and offers a unified platform to address the complete threat lifecycle including filtering, detection, mitigation, cleanup, and post-attack forensics. Top features include single-click rollback with Windows VSS and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services offer ultra-affordable in-depth protection for physical servers and virtual machines, workstations, smartphones, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and reacting to cyber assaults from all vectors. ProSight ESP provides firewall protection, intrusion alerts, endpoint control, and web filtering via leading-edge technologies packaged within a single agent accessible from a unified console. Progent's data protection and virtualization experts can assist you to plan and implement a ProSight ESP deployment that meets your company's specific requirements and that allows you demonstrate compliance with legal and industry data protection standards. Progent will help you specify and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that require immediate action. Progent's consultants can also assist your company to set up and test a backup and restore solution like ProSight Data Protection Services so you can get back in business quickly from a potentially disastrous security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange email filtering.