24/7/365 Calgary Immediate Ransomware
Infection Identification and Removal Consultants

Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a modern cyber pandemic that presents an extinction-level danger for businesses of all sizes unprepared for an attack. Versions of crypto-ransomware like the CryptoLocker, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for many years and continue to inflict destruction. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti or Nephilim, as well as additional unnamed viruses, not only do encryption of online files but also infiltrate all available system backups. Information replicated to off-site disaster recovery sites can also be corrupted. In a poorly designed data protection solution, it can render any restoration impossible and effectively sets the network back to square one.

Getting back online applications and information following a ransomware event becomes a sprint against time as the targeted organization tries its best to contain the damage, cleanup the crypto-ransomware, and resume business-critical activity. Since ransomware requires time to replicate, assaults are usually launched at night, when penetrations typically take longer to detect. This compounds the difficulty of quickly mobilizing and coordinating a capable response team.

Progent offers a range of services for protecting enterprises from ransomware penetrations. Among these are staff education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with deployment of the latest generation security solutions with machine learning technology from SentinelOne to detect and suppress day-zero threats rapidly. Progent also can provide the assistance of veteran ransomware recovery engineers with the talent and perseverance to reconstruct a breached system as urgently as possible.

Progent's Ransomware Recovery Help
Subsequent to a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will provide the needed codes to unencrypt all your files. Kaspersky determined that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The alternative is to setup from scratch the vital components of your IT environment. Absent the availability of essential data backups, this calls for a wide complement of skill sets, well-coordinated team management, and the capability to work continuously until the task is done.

For two decades, Progent has offered professional Information Technology services for companies across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned high-level certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of expertise gives Progent the skills to efficiently understand necessary systems and organize the surviving components of your Information Technology environment following a crypto-ransomware penetration and configure them into a functioning network.

Progent's recovery group utilizes best of breed project management systems to coordinate the complex restoration process. Progent knows the importance of acting quickly and together with a customer's management and IT resources to assign priority to tasks and to put essential applications back on line as fast as humanly possible.

Case Study: A Successful Ransomware Virus Recovery
A small business engaged Progent after their organization was taken over by the Ryuk ransomware virus. Ryuk is generally considered to have been developed by Northern Korean state sponsored criminal gangs, possibly using strategies exposed from the United States National Security Agency. Ryuk targets specific companies with little tolerance for operational disruption and is among the most profitable iterations of ransomware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business headquartered in the Chicago metro area and has around 500 workers. The Ryuk intrusion had shut down all business operations and manufacturing capabilities. Most of the client's data protection had been online at the start of the attack and were eventually encrypted. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and hoping for good luck, but ultimately engaged Progent.

Progent worked with the customer to quickly understand and assign priority to the key systems that had to be addressed in order to continue departmental functions:

• Windows Active Directory
• Exchange Server
• Accounting and Manufacturing Software

Within 2 days, Progent was able to recover Active Directory services to its pre-virus state. Progent then completed reinstallations and hard drive recovery on the most important servers. All Exchange Server schema and attributes were usable, which facilitated the rebuild of Exchange. Progent was also able to find non-encrypted OST data files (Outlook Email Off-Line Data Files) on team desktop computers and laptops in order to recover mail data. A recent offline backup of the businesses accounting systems made them able to restore these required programs back servicing users. Although a lot of work still had to be done to recover totally from the Ryuk event, essential services were returned to operations rapidly:

During the following few weeks critical milestones in the recovery process were achieved in tight collaboration between Progent consultants and the customer:

• Internal web applications were brought back up without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million historical messages was brought on-line and accessible to users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory modules were completely recovered.
• A new Palo Alto Networks 850 security appliance was brought online.
• Ninety percent of the user desktops and notebooks were fully operational.

Conclusion
A possible company-ending disaster was averted through the efforts of hard-working experts, a wide spectrum of subject matter expertise, and close collaboration. Although in analyzing the event afterwards the crypto-ransomware penetration described here should have been blocked with up-to-date security technology and ISO/IEC 27001 best practices, team education, and well thought out incident response procedures for data protection and proper patching controls, the reality remains that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incursion, feel confident that Progent's team of experts has a proven track record in ransomware virus defense, removal, and file recovery.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent can provide businesses in Calgary a range of online monitoring and security evaluation services to assist you to reduce the threat from ransomware. These services include modern AI technology to detect new variants of ransomware that are able to evade traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size companies to utilize Remote Monitoring and Management (RMM) solutions to create leading-edge network resilience. Progent takes care of the daily monitoring and management for you, so your network scales smoothly without becoming an obstacle. For an affordable and predictable monthly subscription, Progent's experienced IT team can be your complete technology safety net. Basic plans include RMM, cybersecurity, monthly patching, and reporting. As your requirements expand, you can add low-cost subscriptions to best-in-class options like as SaaS M365/Google Workspace backup and restore, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that uses state-of-the-art remote monitoring and management techniques to keep your IT system operating at peak levels by checking the state of critical assets that drive your business network. When ProSight LAN Watch detects a problem, an alarm is sent automatically to your designated IT staff and your assigned Progent consultant so that all looming issues can be resolved before they can disrupt productivity. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-driven solution for monitoring and managing your network, server, and desktop devices by offering tools for performing common time-consuming tasks. These can include health monitoring, update management, automated remediation, endpoint configuration, backup and restore, A/V defense, remote access, standard and custom scripts, resource inventory, endpoint status reports, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM spots a serious incident, it sends an alert to your specified IT personnel and your assigned Progent consultant so potential issues can be taken care of before they interfere with productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller businesses to map out, monitor, optimize and debug their connectivity hardware such as routers, firewalls, and wireless controllers as well as servers, endpoints and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch makes sure that network diagrams are always current, captures and manages the configuration of virtually all devices on your network, tracks performance, and sends alerts when problems are discovered. By automating time-consuming management and troubleshooting processes, WAN Watch can cut hours off ordinary chores such as network mapping, reconfiguring your network, finding appliances that need important software patches, or identifying the cause of performance issues. Learn more about ProSight WAN Watch network infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing family of in-depth reporting plug-ins created to integrate with the top ticketing and remote network monitoring applications such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize critical issues like inconsistent support follow-through or machines with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Managed Backup and Disaster Recovery Services
  Progent has worked with advanced backup technology companies to create ProSight Data Protection Services, a family of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS products automate and monitor your data backup processes and allow transparent backup and fast restoration of vital files/folders, apps, system images, plus virtual machines. ProSight DPS helps your business avoid data loss caused by hardware breakdown, natural calamities, fire, malware like ransomware, human error, malicious employees, or application bugs. Managed backup services in the ProSight Data Protection Services portfolio include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can help you to determine which of these managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that incorporates the infrastructure of top data security companies to provide web-based management and comprehensive security for your email traffic. The hybrid architecture of Progent's Email Guard combines a Cloud Protection Layer with a local security gateway device to offer advanced protection against spam, viruses, Denial of Service (DoS) Attacks, DHAs, and other email-based threats. The cloud filter serves as a first line of defense and keeps the vast majority of unwanted email from reaching your security perimeter. This reduces your vulnerability to inbound threats and conserves network bandwidth and storage space. Email Guard's on-premises security gateway appliance adds a further layer of inspection for inbound email. For outgoing email, the on-premises gateway offers AV and anti-spam filtering, protection against data leaks, and email encryption. The onsite security gateway can also assist Exchange Server to track and protect internal email traffic that originates and ends inside your corporate firewall. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo MFA services incorporate Cisco's Duo cloud technology to defend against compromised passwords by using two-factor authentication (2FA). Duo enables one-tap identity confirmation on iOS, Google Android, and other personal devices. With Duo 2FA, whenever you log into a protected online account and give your password you are requested to confirm your identity on a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A wide selection of devices can be utilized for this second form of ID validation including a smartphone or watch, a hardware token, a landline phone, etc. You can register several verification devices. To find out more about Duo identity authentication services, see Cisco Duo MFA two-factor authentication services.

• Outsourced/Co-managed Service Center: Help Desk Managed Services
  Progent's Help Center services permit your information technology staff to outsource Support Desk services to Progent or split activity for support services transparently between your internal network support resources and Progent's nationwide roster of certified IT service engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a seamless extension of your corporate network support organization. User access to the Help Desk, provision of support, escalation, ticket generation and tracking, efficiency metrics, and management of the service database are consistent regardless of whether incidents are taken care of by your core support resources, by Progent, or both. Read more about Progent's outsourced/shared Service Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that incorporates cutting edge behavior analysis tools to defend endpoint devices and physical and virtual servers against new malware attacks like ransomware and file-less exploits, which easily get by traditional signature-matching anti-virus products. Progent Active Security Monitoring services safeguard local and cloud-based resources and provides a unified platform to address the complete malware attack lifecycle including filtering, detection, mitigation, remediation, and forensics. Top features include single-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, maintain, retrieve and safeguard data related to your network infrastructure, procedures, applications, and services. You can instantly find passwords or IP addresses and be warned automatically about upcoming expirations of SSLs ,domains or warranties. By updating and organizing your IT documentation, you can save up to 50% of time thrown away searching for vital information about your IT network. ProSight IT Asset Management features a common location for storing and collaborating on all documents required for managing your business network such as recommended procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're making enhancements, performing regular maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you require when you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management provide businesses of all sizes a versatile and cost-effective solution for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving information system. Besides maximizing the security and reliability of your IT environment, Progent's patch management services free up time for your IT team to concentrate on line-of-business initiatives and tasks that deliver maximum business value from your information network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected Tier III data center on a fast virtual machine host set up and managed by Progent's IT support professionals. Under the ProSight Virtual Hosting model, the client owns the data, the OS software, and the apps. Since the environment is virtualized, it can be ported easily to a different hardware solution without a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior-based analysis technology to defend physical and virtual endpoint devices against modern malware assaults like ransomware and email phishing, which easily evade legacy signature-based anti-virus tools. ProSight ASM safeguards on-premises and cloud resources and provides a unified platform to automate the complete threat lifecycle including filtering, infiltration detection, mitigation, remediation, and forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against new attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection managed services deliver economical multi-layer protection for physical servers and virtual machines, desktops, mobile devices, and Exchange email. ProSight ESP utilizes contextual security and advanced heuristics for round-the-clock monitoring and responding to cyber assaults from all vectors. ProSight ESP offers two-way firewall protection, intrusion alarms, device control, and web filtering via leading-edge tools incorporated within one agent managed from a unified control. Progent's security and virtualization consultants can assist your business to design and configure a ProSight ESP environment that addresses your organization's unique needs and that helps you achieve and demonstrate compliance with government and industry information security regulations. Progent will assist you define and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alarms that require urgent attention. Progent can also assist your company to install and verify a backup and restore solution such as ProSight Data Protection Services so you can recover quickly from a potentially disastrous security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified endpoint security and Exchange email filtering.