24/7 Tacoma Emergency Ransomware
Computer Virus Damage Assessment and Remediation Experts

Ransomware : Your Feared IT Nightmare
Ransomware has become a modern cyber pandemic that presents an existential threat for businesses of all sizes unprepared for an assault. Versions of ransomware like the Dharma, WannaCry, Locky, Syskey and MongoLock cryptoworms have been replicating for many years and still cause havoc. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, as well as daily unnamed newcomers, not only do encryption of on-line data files but also infect most available system protection mechanisms. Data replicated to off-site disaster recovery sites can also be corrupted. In a poorly designed system, this can make automated restore operations useless and basically sets the network back to square one.

Retrieving applications and information following a ransomware attack becomes a race against the clock as the targeted organization tries its best to stop the spread, clear the ransomware, and resume enterprise-critical operations. Since crypto-ransomware requires time to move laterally, assaults are frequently launched on weekends, when attacks tend to take longer to discover. This multiplies the difficulty of rapidly marshalling and organizing a qualified mitigation team.

Progent offers a range of help services for protecting businesses from ransomware penetrations. These include staff education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of the latest generation security gateways with AI capabilities from SentinelOne to identify and quarantine day-zero cyber threats quickly. Progent in addition provides the services of expert crypto-ransomware recovery consultants with the track record and commitment to restore a breached system as urgently as possible.

Progent's Crypto-Ransomware Recovery Help
Following a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not guarantee that distant criminals will respond with the needed keys to decipher any or all of your files. Kaspersky determined that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The alternative is to setup from scratch the critical components of your Information Technology environment. Without access to complete data backups, this requires a wide range of skills, top notch team management, and the willingness to work 24x7 until the task is complete.

For twenty years, Progent has offered expert Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained top industry certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have garnered internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial management and ERP applications. This breadth of expertise gives Progent the ability to rapidly identify necessary systems and consolidate the surviving components of your computer network system following a ransomware penetration and configure them into a functioning system.

Progent's security group deploys powerful project management systems to coordinate the complicated restoration process. Progent knows the urgency of acting rapidly and in concert with a customer's management and Information Technology resources to prioritize tasks and to get the most important systems back on line as soon as humanly possible.

Client Case Study: A Successful Ransomware Virus Recovery
A customer escalated to Progent after their organization was crashed by the Ryuk ransomware. Ryuk is believed to have been developed by North Korean state hackers, suspected of adopting algorithms exposed from the United States National Security Agency. Ryuk targets specific businesses with little or no ability to sustain operational disruption and is one of the most lucrative iterations of ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a regional manufacturing business based in the Chicago metro area and has about 500 employees. The Ryuk penetration had brought down all company operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the time of the attack and were eventually encrypted. The client considered paying the ransom demand (in excess of $200,000) and hoping for good luck, but ultimately engaged Progent.

Progent worked with the client to quickly get our arms around and assign priority to the key applications that needed to be restored in order to continue company functions:

• Active Directory
• Microsoft Exchange
• MRP System

In less than two days, Progent was able to rebuild Windows Active Directory to its pre-penetration state. Progent then initiated rebuilding and hard drive recovery of critical servers. All Microsoft Exchange Server schema and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to find intact OST files (Outlook Email Off-Line Folder Files) on various PCs in order to recover mail messages. A recent offline backup of the businesses accounting software made it possible to restore these vital applications back online for users. Although a large amount of work needed to be completed to recover completely from the Ryuk virus, critical services were recovered quickly:

Throughout the next month key milestones in the restoration project were completed in tight cooperation between Progent engineers and the client:

• Self-hosted web sites were restored with no loss of data.
• The MailStore Microsoft Exchange Server exceeding 4 million historical messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory modules were fully functional.
• A new Palo Alto Networks 850 firewall was brought online.
• Nearly all of the user desktops were being used by staff.

Conclusion
A potential business-ending disaster was evaded due to hard-working professionals, a broad spectrum of technical expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware virus incident detailed here would have been blocked with advanced security technology and NIST Cybersecurity Framework best practices, staff training, and well designed incident response procedures for data backup and applying software patches, the reality remains that state-sponsored cyber criminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incident, remember that Progent's team of professionals has extensive experience in crypto-ransomware virus defense, cleanup, and file restoration.

To read or download a PDF version of this customer story, click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Tacoma a variety of remote monitoring and security evaluation services designed to assist you to minimize your vulnerability to ransomware. These services utilize next-generation AI capability to detect zero-day variants of ransomware that are able to evade legacy signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Packages make it realistic for small and mid-size companies to deploy Remote Monitoring and Management (RMM) technology to achieve advanced IT resilience. Progent takes care of the daily monitoring and maintenance for you, so your system expands smoothly without holding you back. For a low and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Basic packages include RMM, security, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-in-class solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates state-of-the-art remote monitoring and management technology to help keep your IT system running at peak levels by tracking the health of critical assets that power your information system. When ProSight LAN Watch detects a problem, an alert is sent automatically to your designated IT management staff and your Progent engineering consultant so all potential problems can be addressed before they can disrupt productivity. Learn more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for monitoring and managing your network, server, and desktop devices by offering tools for performing common tedious jobs. These can include health checking, patch management, automated repairs, endpoint configuration, backup and restore, anti-virus response, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reporting, and debugging help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious issue, it sends an alarm to your designated IT personnel and your Progent technical consultant so potential issues can be taken care of before they impact your network. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for smaller organizations to map out, track, enhance and debug their networking hardware like routers, firewalls, and wireless controllers plus servers, endpoints and other devices. Incorporating state-of-the-art Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network maps are always current, copies and displays the configuration information of virtually all devices on your network, tracks performance, and sends notices when potential issues are discovered. By automating time-consuming network management processes, WAN Watch can knock hours off common chores such as making network diagrams, reconfiguring your network, locating devices that need important updates, or resolving performance problems. Learn more about ProSight WAN Watch network infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of real-time management reporting utilities designed to integrate with the industry's top ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to highlight and contextualize key issues like spotty support follow-through or endpoints with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting enhances productivity, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Disaster Recovery Services
  Progent has worked with advanced backup/restore technology companies to produce ProSight Data Protection Services, a portfolio of management offerings that deliver backup-as-a-service (BaaS). ProSight DPS products automate and monitor your backup processes and allow transparent backup and rapid restoration of important files/folders, apps, images, and VMs. ProSight DPS lets you recover from data loss caused by equipment breakdown, natural calamities, fire, cyber attacks like ransomware, user error, malicious insiders, or application glitches. Managed backup services in the ProSight Data Protection Services product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent expert can help you to identify which of these managed services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that uses the infrastructure of leading information security vendors to provide web-based management and world-class security for your inbound and outbound email. The powerful architecture of Progent's Email Guard integrates a Cloud Protection Layer with an on-premises security gateway device to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne threats. Email Guard's Cloud Protection Layer serves as a first line of defense and blocks most threats from making it to your security perimeter. This decreases your exposure to inbound threats and conserves network bandwidth and storage. Email Guard's on-premises security gateway appliance adds a deeper layer of inspection for inbound email. For outbound email, the on-premises security gateway offers anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The on-premises security gateway can also assist Microsoft Exchange Server to track and safeguard internal email that originates and ends within your corporate firewall. For more information, see ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo authentication service plans utilize Cisco's Duo technology to defend against compromised passwords through the use of two-factor authentication. Duo enables single-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you sign into a secured application and give your password you are requested to verify your identity via a device that only you possess and that uses a different network channel. A wide range of devices can be used for this added means of ID validation including an iPhone or Android or watch, a hardware/software token, a landline phone, etc. You can designate multiple verification devices. For more information about ProSight Duo identity authentication services, refer to Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Service Desk: Call Center Managed Services
  Progent's Call Center managed services enable your IT team to outsource Help Desk services to Progent or split responsibilities for Service Desk support seamlessly between your in-house network support team and Progent's extensive pool of certified IT service engineers and subject matter experts (SMEs). Progent's Shared Help Desk Service provides a seamless extension of your core IT support staff. User access to the Help Desk, provision of technical assistance, problem escalation, trouble ticket creation and updates, efficiency measurement, and management of the service database are cohesive whether incidents are resolved by your core support group, by Progent's team, or a mix of the two. Learn more about Progent's outsourced/shared Call Center services.

• Progent Active Defense Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes next generation behavior analysis tools to guard endpoints as well as servers and VMs against modern malware attacks such as ransomware and email phishing, which easily get by traditional signature-based anti-virus products. Progent Active Security Monitoring services protect on-premises and cloud resources and provides a unified platform to address the entire malware attack progression including filtering, detection, containment, remediation, and post-attack forensics. Key capabilities include one-click rollback with Windows VSS and automatic system-wide immunization against new attacks. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to capture, update, retrieve and safeguard data about your network infrastructure, processes, business apps, and services. You can quickly find passwords or serial numbers and be alerted about upcoming expirations of SSLs or warranties. By cleaning up and managing your network documentation, you can save as much as half of time thrown away trying to find vital information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and collaborating on all documents required for managing your network infrastructure such as standard operating procedures and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and associating IT data. Whether you're making improvements, performing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the information you require when you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management offer organizations of any size a flexible and cost-effective solution for assessing, validating, scheduling, implementing, and tracking updates to your dynamic IT system. In addition to optimizing the protection and functionality of your IT network, Progent's software/firmware update management services free up time for your in-house IT team to concentrate on line-of-business initiatives and activities that derive the highest business value from your network. Read more about Progent's software/firmware update management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small business can have its key servers and applications hosted in a protected fault tolerant data center on a high-performance virtual machine host configured and managed by Progent's network support experts. Under the ProSight Virtual Hosting model, the client retains ownership of the data, the operating system software, and the apps. Because the environment is virtualized, it can be ported immediately to an alternate hardware environment without a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, you are not tied a single hosting service. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's next generation behavior-based analysis tools to guard physical and virtual endpoint devices against modern malware assaults like ransomware and email phishing, which easily evade traditional signature-based AV tools. ProSight Active Security Monitoring protects local and cloud resources and provides a single platform to address the entire malware attack lifecycle including blocking, detection, mitigation, cleanup, and post-attack forensics. Top features include one-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Physical and Virtual Endpoint Security and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver affordable in-depth protection for physical servers and virtual machines, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses contextual security and advanced heuristics for round-the-clock monitoring and responding to cyber threats from all vectors. ProSight ESP offers two-way firewall protection, penetration alerts, endpoint control, and web filtering through leading-edge tools incorporated within one agent accessible from a unified control. Progent's data protection and virtualization experts can assist your business to plan and implement a ProSight ESP deployment that addresses your company's unique requirements and that allows you achieve and demonstrate compliance with legal and industry information security standards. Progent will assist you specify and configure policies that ProSight ESP will enforce, and Progent will monitor your IT environment and react to alerts that call for urgent attention. Progent can also help your company to set up and verify a backup and restore solution like ProSight Data Protection Services (DPS) so you can recover quickly from a destructive security attack like ransomware. Find out more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange email filtering.