24x7 Montreal Urgent Crypto
Malware Identification and Repair Support

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Crypto-Ransomware has become a modern cyberplague that poses an extinction-level danger for businesses of all sizes poorly prepared for an assault. Versions of ransomware like the Dharma, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been running rampant for years and still inflict havoc. The latest strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti or Egregor, plus daily as yet unnamed malware, not only encrypt online files but also infect many configured system restores and backups. Information synched to cloud environments can also be held hostage. In a poorly architected data protection solution, this can render any recovery useless and basically sets the datacenter back to square one.

Restoring services and information following a crypto-ransomware attack becomes a race against time as the victim struggles to contain, clear the ransomware, and resume enterprise-critical activity. Because ransomware takes time to spread, assaults are usually sprung during weekends and nights, when successful penetrations typically take more time to notice. This multiplies the difficulty of rapidly marshalling and organizing an experienced response team.

Progent makes available a range of solutions for protecting organizations from ransomware events. These include staff training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, plus deployment of modern security gateways with artificial intelligence technology from SentinelOne to identify and suppress day-zero threats rapidly. Progent in addition offers the assistance of veteran ransomware recovery engineers with the track record and commitment to re-deploy a compromised environment as soon as possible.

Progent's Crypto-Ransomware Recovery Support Services
Soon after a ransomware invasion, sending the ransom demands in cryptocurrency does not ensure that cyber criminals will respond with the codes to decrypt any of your data. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to re-install the mission-critical parts of your Information Technology environment. Without access to essential data backups, this calls for a broad range of skill sets, top notch team management, and the capability to work non-stop until the job is completed.

For twenty years, Progent has made available expert IT services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have attained top industry certifications in foundation technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-renowned certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial management and ERP application software. This breadth of experience gives Progent the capability to knowledgably ascertain critical systems and organize the remaining components of your computer network environment after a ransomware attack and rebuild them into an operational system.

Progent's security group utilizes state-of-the-art project management systems to orchestrate the complex recovery process. Progent understands the urgency of acting rapidly and in concert with a customer's management and Information Technology staff to prioritize tasks and to get the most important systems back online as fast as possible.

Customer Story: A Successful Crypto-Ransomware Incident Recovery
A small business engaged Progent after their organization was brought down by Ryuk ransomware. Ryuk is believed to have been created by Northern Korean government sponsored criminal gangs, possibly adopting algorithms leaked from the U.S. National Security Agency. Ryuk seeks specific companies with little or no room for operational disruption and is one of the most lucrative examples of ransomware viruses. Headline victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business located in Chicago and has around 500 workers. The Ryuk event had disabled all company operations and manufacturing processes. Most of the client's data backups had been online at the time of the intrusion and were destroyed. The client was evaluating paying the ransom (more than $200K) and wishfully thinking for good luck, but ultimately brought in Progent.

Progent worked together with the client to quickly assess and prioritize the most important elements that needed to be addressed to make it possible to resume business functions:

• Active Directory (AD)
• E-Mail
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then accomplished reinstallations and hard drive recovery on needed applications. All Exchange Server schema and configuration information were intact, which accelerated the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Microsoft Outlook Off-Line Data Files) on staff PCs to recover mail information. A not too old offline backup of the client's accounting/ERP software made it possible to restore these vital services back servicing users. Although a large amount of work needed to be completed to recover fully from the Ryuk virus, critical systems were restored rapidly:

During the following few weeks critical milestones in the recovery project were accomplished in tight collaboration between Progent team members and the customer:

• Internal web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than four million archived messages was brought on-line and accessible to users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/AR/Inventory capabilities were 100 percent restored.
• A new Palo Alto Networks 850 firewall was installed.
• Most of the user PCs were back into operation.

Conclusion
A possible business-ending catastrophe was averted with results-oriented professionals, a wide range of IT skills, and close collaboration. Although in post mortem the crypto-ransomware attack detailed here would have been identified and prevented with advanced security solutions and security best practices, staff education, and well thought out incident response procedures for data protection and proper patching controls, the fact is that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a ransomware incident, remember that Progent's team of professionals has a proven track record in ransomware virus blocking, mitigation, and information systems disaster recovery.

To review or download a PDF version of this ransomware incident report, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Available from Progent
Progent offers businesses in Montreal a range of online monitoring and security evaluation services to help you to minimize your vulnerability to ransomware. These services include modern artificial intelligence capability to uncover zero-day strains of ransomware that are able to get past traditional signature-based security solutions.

• ProSight Managed Service Packages: for Small to Mid-size Businesses
  Progent's ProSight Managed IT Service Plans make it realistic for small and mid-size businesses to utilize Remote Monitoring and Management (RMM) technology to create leading-edge IT resilience. Progent handles the necessary monitoring and management for you, so your network scales smoothly without becoming an obstacle. For a low and predictable monthly subscription, Progent's full-service IT group can be your dependable technology safety net. Entry-level packages include remote monitoring and management (RMM), cybersecurity, monthly patching, and documentation. As your needs expand, you can add low-cost subscriptions to best-in-class options such as SaaS M365/Google Workspace backup, Multi-Factor Authentication, penetration testing, or WiFi management.

• ProSight LAN Watch: Server and Desktop Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring service that incorporates advanced remote monitoring and management (RMM) techniques to keep your IT system running at peak levels by checking the state of vital assets that power your information system. When ProSight LAN Watch detects a problem, an alert is sent automatically to your specified IT staff and your Progent consultant so that all potential issues can be resolved before they have a chance to impact your network. Find out more about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Unified RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for monitoring and managing your network, server, and desktop devices by offering tools for performing common tedious jobs. These include health monitoring, patch management, automated remediation, endpoint deployment, backup and recovery, anti-virus response, secure remote access, built-in and custom scripts, asset inventory, endpoint status reports, and troubleshooting support. When ProSight LAN Watch with NinjaOne RMM identifies a serious issue, it sends an alert to your specified IT staff and your assigned Progent technical consultant so potential problems can be fixed before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it easy and inexpensive for small and mid-sized businesses to map, track, enhance and debug their connectivity hardware such as switches, firewalls, and load balancers as well as servers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, ProSight WAN Watch makes sure that infrastructure topology maps are always updated, copies and manages the configuration of virtually all devices on your network, tracks performance, and generates notices when issues are discovered. By automating complex management processes, ProSight WAN Watch can knock hours off common chores like network mapping, expanding your network, finding appliances that require critical software patches, or resolving performance problems. Learn more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time and In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding line of in-depth management reporting utilities designed to integrate with the top ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues like spotty support follow-up or machines with out-of-date AVs. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Disaster Recovery Services
  Progent has partnered with advanced backup software companies to create ProSight Data Protection Services, a selection of offerings that provide backup-as-a-service. ProSight DPS products automate and track your backup processes and enable non-disruptive backup and rapid restoration of vital files/folders, applications, images, plus Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss resulting from hardware failures, natural calamities, fire, cyber attacks like ransomware, human error, ill-intentioned employees, or application glitches. Managed backup services in the ProSight Data Protection Services product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup based on Barracuda dedicated storage, and ProSight MSP360 Hybrid Backup. Your Progent consultant can assist you to determine which of these managed backup services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering service that incorporates the technology of leading data security vendors to provide centralized management and comprehensive security for your email traffic. The hybrid architecture of Email Guard managed service combines cloud-based filtering with a local security gateway device to offer complete protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-borne malware. Email Guard's Cloud Protection Layer acts as a first line of defense and keeps most threats from reaching your security perimeter. This reduces your exposure to external attacks and conserves network bandwidth and storage space. Email Guard's onsite security gateway appliance adds a further layer of inspection for incoming email. For outgoing email, the onsite security gateway offers AV and anti-spam protection, protection against data leaks, and email encryption. The onsite gateway can also assist Exchange Server to track and protect internal email traffic that originates and ends inside your corporate firewall. For more details, see ProSight Email Guard spam and content filtering.

• ProSight Duo Multi-Factor Authentication: ID Confirmation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to defend against stolen passwords by using two-factor authentication. Duo supports one-tap identity verification on Apple iOS, Google Android, and other personal devices. Using 2FA, when you sign into a secured online account and give your password you are asked to confirm your identity via a unit that only you possess and that uses a separate network channel. A wide selection of devices can be used as this second form of ID validation such as a smartphone or wearable, a hardware/software token, a landline telephone, etc. You can register several verification devices. For more information about ProSight Duo two-factor identity authentication services, refer to Duo MFA two-factor authentication services.

• Outsourced/Co-managed Help Center: Support Desk Managed Services
  Progent's Help Center services allow your information technology team to offload Help Desk services to Progent or divide activity for Service Desk support seamlessly between your in-house network support team and Progent's extensive pool of IT support engineers and subject matter experts. Progent's Co-managed Service Desk provides a seamless extension of your internal support team. User interaction with the Service Desk, provision of technical assistance, problem escalation, trouble ticket generation and updates, performance measurement, and management of the service database are consistent regardless of whether issues are taken care of by your corporate IT support group, by Progent's team, or a mix of the two. Find out more about Progent's outsourced/co-managed Service Desk services.

• Active Defense Against Ransomware: AI-based Ransomware Identification and Remediation
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) solution that incorporates cutting edge behavior analysis technology to guard endpoints as well as physical and virtual servers against modern malware assaults such as ransomware and file-less exploits, which routinely evade traditional signature-matching anti-virus products. Progent Active Security Monitoring services safeguard on-premises and cloud resources and offers a single platform to automate the complete threat progression including blocking, identification, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered attacks. Read more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and protect data about your IT infrastructure, processes, applications, and services. You can quickly find passwords or IP addresses and be warned automatically about upcoming expirations of SSL certificates or warranties. By cleaning up and managing your network documentation, you can eliminate up to half of time thrown away looking for vital information about your network. ProSight IT Asset Management includes a common repository for storing and sharing all documents related to managing your business network like standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and associating IT information. Whether you're making improvements, doing maintenance, or reacting to an emergency, ProSight IT Asset Management delivers the knowledge you need the instant you need it. Find out more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for software and firmware patch management provide businesses of any size a flexible and affordable solution for evaluating, validating, scheduling, implementing, and documenting software and firmware updates to your ever-evolving IT network. Besides optimizing the security and functionality of your IT environment, Progent's software/firmware update management services allow your in-house IT staff to focus on line-of-business initiatives and tasks that deliver the highest business value from your network. Read more about Progent's software/firmware update management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its critical servers and apps hosted in a protected Tier III data center on a fast virtual machine host configured and managed by Progent's network support professionals. Under the ProSight Virtual Hosting service model, the client retains ownership of the data, the OS platforms, and the applications. Because the environment is virtualized, it can be ported easily to an alternate hardware solution without requiring a time-consuming and difficult configuration procedure. With ProSight Virtual Hosting, your business is not locked into one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring is an endpoint protection (EPP) service that incorporates SentinelOne's cutting edge behavior analysis technology to defend physical and virtual endpoint devices against new malware attacks like ransomware and file-less exploits, which routinely escape legacy signature-matching AV tools. ProSight Active Security Monitoring safeguards on-premises and cloud-based resources and provides a single platform to address the complete threat progression including filtering, identification, containment, cleanup, and post-attack forensics. Top capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring (ASM) next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection services offer affordable in-depth security for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and advanced heuristics for continuously monitoring and responding to cyber assaults from all vectors. ProSight ESP provides firewall protection, penetration alarms, endpoint control, and web filtering via leading-edge technologies packaged within a single agent accessible from a unified control. Progent's data protection and virtualization experts can assist your business to plan and implement a ProSight ESP deployment that meets your organization's unique requirements and that allows you prove compliance with legal and industry information protection standards. Progent will help you define and configure policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require immediate attention. Progent can also help your company to set up and test a backup and disaster recovery solution like ProSight Data Protection Services so you can get back in business rapidly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint security and Microsoft Exchange email filtering.