Portland 24/7 Emergency Ransomware
Malware Damage Assessment and Repair Consultants

Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware has become a modern cyber pandemic that presents an extinction-level threat for organizations poorly prepared for an assault. Multiple generations of ransomware such as Dharma, Fusob, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and still inflict destruction. Recent variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Nephilim, as well as daily as yet unnamed newcomers, not only do encryption of online data files but also infect any available system backup. Information synchronized to the cloud can also be ransomed. In a poorly designed system, this can render any restoration useless and effectively knocks the entire system back to square one.

Restoring applications and data following a ransomware event becomes a race against time as the targeted business struggles to contain the damage, clear the crypto-ransomware, and resume business-critical activity. Due to the fact that crypto-ransomware requires time to move laterally, penetrations are frequently launched on weekends, when attacks tend to take longer to identify. This compounds the difficulty of rapidly assembling and coordinating a qualified mitigation team.

Progent has an assortment of solutions for protecting businesses from crypto-ransomware events. Among these are staff training to become familiar with and avoid phishing scams, ProSight Active Security Monitoring for remote monitoring and management, in addition to installation of modern security solutions with AI technology from SentinelOne to detect and suppress new threats rapidly. Progent also can provide the services of experienced ransomware recovery professionals with the talent and perseverance to restore a breached network as quickly as possible.

Progent's Ransomware Restoration Services
After a ransomware invasion, even paying the ransom demands in cryptocurrency does not ensure that distant criminals will respond with the needed keys to decipher any or all of your files. Kaspersky ascertained that 17% of ransomware victims never restored their files even after having paid the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The fallback is to re-install the vital parts of your Information Technology environment. Absent access to full data backups, this calls for a broad range of skill sets, professional team management, and the willingness to work non-stop until the recovery project is done.

For two decades, Progent has offered professional IT services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have been awarded high-level industry certifications in important technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial systems and ERP application software. This breadth of expertise affords Progent the ability to quickly determine necessary systems and consolidate the remaining components of your computer network system following a ransomware event and rebuild them into a functioning system.

Progent's ransomware group utilizes state-of-the-art project management systems to coordinate the sophisticated restoration process. Progent knows the urgency of working rapidly and together with a customer's management and Information Technology staff to assign priority to tasks and to put critical applications back online as fast as humanly possible.

Case Study: A Successful Crypto-Ransomware Intrusion Recovery
A small business engaged Progent after their network was crashed by the Ryuk crypto-ransomware. Ryuk is believed to have been created by Northern Korean state sponsored hackers, suspected of using approaches leaked from America's NSA organization. Ryuk seeks specific organizations with little ability to sustain operational disruption and is among the most profitable iterations of ransomware malware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer based in the Chicago metro area with around 500 workers. The Ryuk penetration had disabled all business operations and manufacturing processes. The majority of the client's data backups had been online at the beginning of the attack and were encrypted. The client was evaluating paying the ransom (exceeding two hundred thousand dollars) and hoping for good luck, but in the end engaged Progent.

Progent worked with the customer to quickly get our arms around and assign priority to the essential areas that needed to be addressed to make it possible to continue business functions:

• Active Directory
• Electronic Messaging
• Accounting and Manufacturing Software

In less than two days, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then performed setup and storage recovery of needed applications. All Exchange ties and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to find intact OST data files (Microsoft Outlook Off-Line Folder Files) on various desktop computers to recover mail data. A recent offline backup of the businesses accounting/ERP software made it possible to restore these required services back servicing users. Although major work was left to recover fully from the Ryuk event, critical systems were restored quickly:

Throughout the following few weeks important milestones in the restoration process were achieved in close cooperation between Progent consultants and the customer:

• Self-hosted web sites were restored with no loss of data.
• The MailStore Server containing more than four million historical messages was brought online and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/AR/Inventory capabilities were fully recovered.
• A new Palo Alto 850 firewall was installed and configured.
• Ninety percent of the desktop computers were being used by staff.

Conclusion
A likely business extinction catastrophe was avoided by hard-working professionals, a broad array of technical expertise, and tight teamwork. Although in retrospect the crypto-ransomware attack detailed here could have been blocked with current cyber security systems and best practices, user training, and appropriate security procedures for data protection and applying software patches, the fact is that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware incident, remember that Progent's roster of professionals has a proven track record in ransomware virus blocking, removal, and data recovery.

To read or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers businesses in Portland a range of online monitoring and security assessment services to help you to reduce your vulnerability to crypto-ransomware. These services include modern AI capability to uncover zero-day strains of crypto-ransomware that are able to escape detection by legacy signature-based security solutions.

• ProSight Managed Service Plans: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it feasible for small and mid-size businesses to deploy Remote Monitoring and Management (RMM) technology to create advanced network resilience. Progent handles the daily monitoring and maintenance for you, so your network expands readily without holding you back. For an affordable and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Basic plans include RMM, security, automatic monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to advanced solutions such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) technology to keep your IT system operating efficiently by tracking the health of vital assets that drive your business network. When ProSight LAN Watch detects a problem, an alert is transmitted automatically to your specified IT staff and your assigned Progent consultant so that any potential issues can be resolved before they have a chance to disrupt your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for managing your client-server infrastructure by providing tools for streamlining common time-consuming tasks. These can include health monitoring, update management, automated repairs, endpoint configuration, backup and restore, anti-virus response, secure remote access, standard and custom scripts, asset inventory, endpoint status reporting, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alert to your designated IT personnel and your Progent consultant so potential issues can be fixed before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and affordable for small and mid-sized businesses to map out, monitor, reconfigure and troubleshoot their networking hardware such as routers, firewalls, and wireless controllers as well as servers, printers, client computers and other networked devices. Using cutting-edge RMM technology, WAN Watch ensures that network maps are always updated, captures and manages the configuration of virtually all devices connected to your network, monitors performance, and generates notices when potential issues are detected. By automating tedious network management activities, ProSight WAN Watch can knock hours off ordinary tasks such as making network diagrams, expanding your network, locating appliances that require critical updates, or isolating performance bottlenecks. Learn more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time reporting plug-ins designed to work with the industry's leading ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and features color coding to highlight and contextualize key issues like inconsistent support follow-up or machines with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves productivity, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore software providers to create ProSight Data Protection Services (DPS), a family of management outsourcing plans that deliver backup-as-a-service. ProSight DPS services manage and monitor your data backup processes and allow transparent backup and rapid recovery of critical files/folders, apps, system images, plus VMs. ProSight DPS helps your business recover from data loss resulting from hardware failures, natural calamities, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned insiders, or application glitches. Managed backup services in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda purpose-built storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these fully managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of top information security companies to provide centralized control and world-class security for your email traffic. The hybrid architecture of Email Guard managed service integrates cloud-based filtering with an on-premises gateway device to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The cloud filter acts as a preliminary barricade and blocks most threats from reaching your network firewall. This decreases your exposure to inbound threats and conserves system bandwidth and storage space. Email Guard's on-premises gateway appliance provides a further level of inspection for inbound email. For outgoing email, the local gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also assist Microsoft Exchange Server to track and safeguard internal email traffic that stays within your security perimeter. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA managed services utilize Cisco's Duo technology to defend against password theft through the use of two-factor authentication (2FA). Duo supports one-tap identity verification on Apple iOS, Google Android, and other out-of-band devices. Using 2FA, when you sign into a protected online account and enter your password you are requested to verify who you are via a device that only you have and that is accessed using a separate network channel. A broad range of devices can be utilized for this added means of ID validation including a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can designate several verification devices. To find out more about ProSight Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Center: Support Desk Managed Services
  Progent's Call Center services permit your information technology staff to offload Support Desk services to Progent or divide activity for Service Desk support transparently between your internal support team and Progent's extensive pool of IT support engineers and subject matter experts. Progent's Shared Help Desk Service provides a smooth extension of your core support organization. End user access to the Service Desk, provision of technical assistance, problem escalation, ticket creation and updates, performance measurement, and management of the support database are consistent regardless of whether issues are resolved by your in-house network support resources, by Progent, or by a combination. Read more about Progent's outsourced/shared Call Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that utilizes cutting edge behavior machine learning tools to defend endpoints as well as physical and virtual servers against new malware attacks like ransomware and email phishing, which easily get by traditional signature-matching anti-virus products. Progent Active Security Monitoring services protect local and cloud resources and offers a single platform to automate the complete malware attack lifecycle including blocking, detection, containment, cleanup, and forensics. Top features include one-click rollback using Windows VSS and automatic system-wide immunization against newly discovered attacks. Find out more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to capture, maintain, find and protect information related to your IT infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be warned about impending expirations of SSLs or domains. By updating and organizing your IT infrastructure documentation, you can save as much as half of time thrown away searching for critical information about your network. ProSight IT Asset Management includes a common location for holding and collaborating on all documents required for managing your network infrastructure like recommended procedures and How-To's. ProSight IT Asset Management also offers advanced automation for collecting and associating IT data. Whether you're making enhancements, performing maintenance, or reacting to a crisis, ProSight IT Asset Management delivers the data you require as soon as you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer businesses of any size a versatile and cost-effective alternative for assessing, testing, scheduling, implementing, and tracking updates to your dynamic IT system. Besides optimizing the security and functionality of your computer environment, Progent's patch management services allow your IT staff to concentrate on line-of-business projects and activities that deliver the highest business value from your information network. Learn more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a secure Tier III data center on a high-performance virtual machine host set up and maintained by Progent's IT support professionals. With the ProSight Virtual Hosting service model, the client owns the data, the operating system software, and the applications. Since the system is virtualized, it can be moved immediately to a different hardware environment without a time-consuming and technically risky reinstallation process. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's cutting edge behavior machine learning technology to defend physical and virtual endpoints against modern malware attacks like ransomware and file-less exploits, which easily evade legacy signature-based AV products. ProSight Active Security Monitoring protects local and cloud resources and provides a unified platform to manage the complete malware attack progression including filtering, identification, containment, remediation, and post-attack forensics. Key capabilities include one-click rollback using Windows VSS and real-time network-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Read more about Progent's ProSight Active Security Monitoring (ASM) endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
  ProSight Enhanced Security Protection managed services offer affordable multi-layer security for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and responding to cyber threats from all vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, endpoint management, and web filtering through leading-edge technologies packaged within a single agent accessible from a unified control. Progent's data protection and virtualization consultants can assist you to design and configure a ProSight ESP environment that meets your company's unique needs and that allows you demonstrate compliance with legal and industry information security regulations. Progent will assist you specify and implement policies that ProSight ESP will enforce, and Progent will monitor your IT environment and respond to alerts that require immediate action. Progent can also help your company to set up and test a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can recover quickly from a destructive cyber attack like ransomware. Read more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange filtering.