Tukwila 24x7 Critical Crypto
Computer Virus Identification and Recovery Support

Ransomware : Your Feared IT Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that poses an existential danger for organizations poorly prepared for an assault. Different versions of crypto-ransomware like the CrySIS, WannaCry, Locky, SamSam and MongoLock cryptoworms have been out in the wild for many years and continue to inflict havoc. The latest versions of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit or Egregor, along with more as yet unnamed viruses, not only encrypt online data but also infect any configured system protection mechanisms. Information synched to cloud environments can also be encrypted. In a vulnerable environment, this can make automatic restoration impossible and effectively knocks the datacenter back to square one.

Recovering programs and information following a ransomware outage becomes a sprint against the clock as the targeted organization struggles to contain, eradicate the crypto-ransomware, and resume business-critical activity. Since ransomware needs time to move laterally, assaults are usually launched on weekends, when penetrations tend to take more time to detect. This compounds the difficulty of rapidly assembling and organizing a knowledgeable response team.

Progent offers a range of support services for protecting businesses from ransomware attacks. These include team member training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of the latest generation security solutions with AI technology from SentinelOne to detect and disable day-zero threats rapidly. Progent in addition can provide the assistance of experienced ransomware recovery professionals with the skills and commitment to re-deploy a compromised system as soon as possible.

Progent's Ransomware Recovery Support Services
Following a ransomware attack, sending the ransom demands in cryptocurrency does not ensure that cyber criminals will respond with the codes to decrypt any or all of your data. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their files after having paid the ransom, resulting in additional losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The fallback is to re-install the key components of your Information Technology environment. Without the availability of complete data backups, this calls for a broad complement of skill sets, professional project management, and the willingness to work non-stop until the job is done.

For decades, Progent has provided expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have been awarded top certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security engineers have garnered internationally-renowned certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial management and ERP applications. This breadth of expertise gives Progent the ability to rapidly identify critical systems and integrate the remaining pieces of your computer network environment following a crypto-ransomware penetration and configure them into a functioning network.

Progent's ransomware team deploys powerful project management applications to coordinate the sophisticated recovery process. Progent appreciates the urgency of working rapidly and in concert with a client's management and Information Technology resources to assign priority to tasks and to put critical services back online as fast as humanly possible.

Case Study: A Successful Crypto-Ransomware Attack Restoration
A customer contacted Progent after their network was penetrated by the Ryuk crypto-ransomware. Ryuk is thought to have been deployed by Northern Korean state sponsored hackers, possibly adopting technology exposed from the United States National Security Agency. Ryuk goes after specific businesses with little or no room for operational disruption and is one of the most lucrative incarnations of ransomware. Headline victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing company headquartered in the Chicago metro area and has about 500 workers. The Ryuk penetration had frozen all essential operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the start of the intrusion and were damaged. The client was evaluating paying the ransom (in excess of $200K) and hoping for the best, but ultimately made the decision to use Progent.

Progent worked with the client to rapidly get our arms around and assign priority to the key areas that had to be recovered in order to continue company operations:

• Windows Active Directory
• Microsoft Exchange
• Financials/MRP

Within 2 days, Progent was able to restore Windows Active Directory to its pre-attack state. Progent then completed reinstallations and hard drive recovery of critical servers. All Microsoft Exchange Server schema and configuration information were intact, which facilitated the rebuild of Exchange. Progent was able to find local OST files (Outlook Email Off-Line Folder Files) on various desktop computers in order to recover mail information. A not too old offline backup of the businesses accounting systems made it possible to recover these required programs back on-line. Although major work needed to be completed to recover fully from the Ryuk virus, the most important systems were restored quickly:

During the next couple of weeks important milestones in the recovery process were accomplished through tight collaboration between Progent team members and the customer:

• Internal web applications were restored with no loss of data.
• The MailStore Exchange Server with over four million historical messages was restored to operations and accessible to users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory Control modules were 100 percent functional.
• A new Palo Alto 850 security appliance was deployed.
• 90% of the user desktops were operational.

Conclusion
A probable enterprise-killing catastrophe was averted due to top-tier experts, a wide spectrum of subject matter expertise, and close teamwork. Although upon completion of forensics the ransomware virus penetration detailed here should have been blocked with up-to-date security technology solutions and ISO/IEC 27001 best practices, staff education, and well designed security procedures for information protection and keeping systems up to date with security patches, the reality remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are tireless and are not going away. If you do fall victim to a ransomware attack, feel confident that Progent's team of professionals has proven experience in ransomware virus defense, cleanup, and data recovery.

To review or download a PDF version of this customer story, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in Tukwila a variety of online monitoring and security evaluation services to help you to minimize your vulnerability to crypto-ransomware. These services utilize next-generation machine learning technology to uncover zero-day variants of crypto-ransomware that are able to escape detection by legacy signature-based security products.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create leading-edge network resilience. Progent takes care of the daily monitoring and maintenance for you, so your system scales easily without becoming an obstacle. For an affordable and predictable monthly price, Progent's experienced IT group can be your dependable technology safety net. Basic plans include remote monitoring and management, cybersecurity, monthly patching, and reporting. As your needs grow, you can add low-cost subscriptions to best-of-breed solutions like as SaaS M365/Google Workspace backup, Multi-Factor Authentication (MFA), pen testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management technology to help keep your IT system operating at peak levels by tracking the state of vital computers that power your business network. When ProSight LAN Watch uncovers an issue, an alert is sent automatically to your designated IT staff and your Progent engineering consultant so that any looming problems can be resolved before they can disrupt productivity. Find out more about ProSight LAN Watch server and desktop monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for monitoring and managing your client-server infrastructure by providing an environment for performing common tedious jobs. These can include health monitoring, update management, automated repairs, endpoint configuration, backup and recovery, anti-virus protection, remote access, standard and custom scripts, asset inventory, endpoint profile reporting, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alert to your specified IT management personnel and your Progent technical consultant so that potential problems can be fixed before they impact productivity. Find out more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring consulting.

• ProSight WAN Watch: Network Infrastructure Management
  ProSight WAN Watch is an infrastructure management service that makes it easy and affordable for smaller businesses to diagram, monitor, enhance and troubleshoot their networking appliances like routers, firewalls, and wireless controllers plus servers, endpoints and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, ProSight WAN Watch ensures that network maps are kept updated, copies and displays the configuration information of virtually all devices on your network, monitors performance, and generates notices when issues are detected. By automating tedious network management processes, ProSight WAN Watch can cut hours off ordinary tasks such as network mapping, expanding your network, finding appliances that need critical software patches, or resolving performance issues. Find out more details about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time reporting plug-ins created to integrate with the industry's top ticketing and remote network monitoring platforms such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues such as spotty support follow-through or endpoints with missing patches. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting enhances network value, reduces management hassle, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup software companies to create ProSight Data Protection Services, a family of subscription-based management offerings that deliver backup-as-a-service (BaaS). ProSight DPS services automate and monitor your backup operations and allow transparent backup and rapid recovery of critical files/folders, applications, images, plus VMs. ProSight DPS helps your business avoid data loss resulting from equipment breakdown, natural calamities, fire, malware such as ransomware, user mistakes, ill-intentioned employees, or application glitches. Managed services in the ProSight DPS product family include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup based on Barracuda purpose-built hardware, and ProSight MSP360 Cloud and On-prem Backup. Your Progent expert can assist you to identify which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the infrastructure of leading data security companies to deliver web-based management and world-class security for all your email traffic. The hybrid structure of Progent's Email Guard combines a Cloud Protection Layer with an on-premises gateway appliance to provide complete protection against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-based threats. Email Guard's Cloud Protection Layer serves as a preliminary barricade and blocks most threats from making it to your security perimeter. This reduces your vulnerability to external threats and conserves network bandwidth and storage. Email Guard's on-premises gateway appliance adds a further layer of analysis for incoming email. For outbound email, the onsite security gateway provides AV and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The onsite security gateway can also help Exchange Server to monitor and protect internal email that stays within your corporate firewall. For more information, visit Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on (SSO)
  Progent's Duo MFA service plans utilize Cisco's Duo technology to protect against stolen passwords by using two-factor authentication (2FA). Duo enables one-tap identity confirmation with Apple iOS, Google Android, and other out-of-band devices. With Duo 2FA, when you sign into a protected application and enter your password you are requested to confirm who you are via a device that only you possess and that uses a separate network channel. A wide range of out-of-band devices can be used as this added means of authentication including a smartphone or watch, a hardware/software token, a landline telephone, etc. You may designate several verification devices. For details about ProSight Duo two-factor identity validation services, see Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Service Center: Call Center Managed Services
  Progent's Support Center services enable your information technology staff to offload Call Center services to Progent or divide activity for Help Desk services seamlessly between your internal support group and Progent's extensive pool of IT service engineers and subject matter experts. Progent's Shared Service Desk provides a smooth extension of your core support group. User access to the Help Desk, delivery of technical assistance, issue escalation, ticket generation and updates, performance measurement, and maintenance of the support database are consistent whether incidents are resolved by your corporate support staff, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/co-managed Call Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that incorporates next generation behavior analysis tools to defend endpoints and servers and VMs against modern malware assaults such as ransomware and email phishing, which easily get by legacy signature-based AV products. Progent Active Security Monitoring services protect local and cloud resources and provides a unified platform to automate the entire malware attack lifecycle including protection, infiltration detection, containment, cleanup, and forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and real-time network-wide immunization against newly discovered threats. Read more about Progent's ransomware defense and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, retrieve and safeguard information related to your IT infrastructure, processes, applications, and services. You can instantly locate passwords or serial numbers and be alerted automatically about upcoming expirations of SSL certificates or domains. By updating and organizing your network documentation, you can save as much as 50% of time wasted looking for critical information about your network. ProSight IT Asset Management features a centralized repository for holding and sharing all documents required for managing your business network such as standard operating procedures and self-service instructions. ProSight IT Asset Management also supports advanced automation for collecting and relating IT data. Whether you're making improvements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the information you need the instant you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Software/Firmware Update Management Services
  Progent's managed services for software and firmware patch management offer organizations of all sizes a flexible and affordable solution for evaluating, testing, scheduling, implementing, and documenting software and firmware updates to your ever-evolving information network. In addition to optimizing the protection and reliability of your computer environment, Progent's patch management services permit your in-house IT team to concentrate on line-of-business projects and tasks that deliver maximum business value from your network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and applications hosted in a protected Tier III data center on a fast virtual host set up and maintained by Progent's network support professionals. With Progent's ProSight Virtual Hosting service model, the client retains ownership of the data, the OS software, and the applications. Since the environment is virtualized, it can be moved immediately to a different hardware environment without requiring a time-consuming and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) solution that utilizes SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoints against modern malware attacks like ransomware and email phishing, which easily escape traditional signature-matching AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and offers a unified platform to address the complete threat lifecycle including blocking, detection, containment, cleanup, and forensics. Top capabilities include single-click rollback with Windows Volume Shadow Copy Service and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, dealer, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Security and Exchange Email Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer ultra-affordable in-depth security for physical and virtual servers, desktops, smartphones, and Microsoft Exchange. ProSight ESP uses adaptive security and modern behavior analysis for continuously monitoring and reacting to cyber threats from all vectors. ProSight ESP offers firewall protection, penetration alarms, device management, and web filtering via leading-edge tools incorporated within a single agent managed from a single console. Progent's security and virtualization experts can help you to design and configure a ProSight ESP environment that meets your organization's unique requirements and that allows you prove compliance with legal and industry information protection regulations. Progent will help you specify and configure policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alarms that call for urgent attention. Progent can also assist your company to set up and test a backup and disaster recovery system like ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous security attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint protection and Exchange email filtering.