24/7/365 Bellevue Immediate Crypto
Computer Malware Damage Assessment and Removal Help

Ransomware : Your Crippling IT Nightmare
Ransomware has become an escalating cyberplague that represents an extinction-level threat for businesses unprepared for an attack. Different iterations of ransomware like the Dharma, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been replicating for many years and still inflict havoc. Recent variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, along with more as yet unnamed viruses, not only do encryption of on-line files but also infiltrate many configured system backups. Information synched to cloud environments can also be encrypted. In a poorly designed data protection solution, it can render automated restore operations hopeless and effectively sets the network back to square one.

Getting back on-line services and information following a crypto-ransomware event becomes a sprint against time as the victim fights to stop the spread, remove the virus, and restore mission-critical activity. Since ransomware requires time to replicate, attacks are often launched during nights and weekends, when attacks may take longer to detect. This multiplies the difficulty of quickly mobilizing and coordinating a knowledgeable mitigation team.

Progent provides an assortment of services for protecting organizations from ransomware penetrations. Among these are user education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with installation of the latest generation security appliances with machine learning technology from SentinelOne to discover and quarantine day-zero cyber attacks rapidly. Progent in addition offers the assistance of expert crypto-ransomware recovery professionals with the talent and perseverance to restore a compromised system as quickly as possible.

Progent's Ransomware Restoration Support Services
Soon after a crypto-ransomware attack, sending the ransom demands in cryptocurrency does not ensure that cyber criminals will return the needed codes to decipher any or all of your data. Kaspersky estimated that seventeen percent of ransomware victims never restored their data even after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The fallback is to setup from scratch the mission-critical components of your Information Technology environment. Absent the availability of complete information backups, this requires a wide range of IT skills, well-coordinated team management, and the ability to work 24x7 until the recovery project is completed.

For twenty years, Progent has offered certified expert IT services for businesses across the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have attained advanced certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial management and ERP application software. This breadth of expertise provides Progent the capability to rapidly identify necessary systems and consolidate the surviving components of your IT system after a ransomware attack and rebuild them into a functioning system.

Progent's ransomware team of experts utilizes state-of-the-art project management applications to coordinate the complicated recovery process. Progent understands the urgency of acting swiftly and together with a client's management and Information Technology staff to assign priority to tasks and to get essential systems back on-line as soon as possible.

Client Story: A Successful Ransomware Attack Restoration
A business engaged Progent after their network system was taken over by Ryuk ransomware virus. Ryuk is thought to have been launched by Northern Korean government sponsored cybercriminals, suspected of using strategies exposed from the U.S. National Security Agency. Ryuk goes after specific companies with little room for operational disruption and is one of the most lucrative incarnations of crypto-ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturer located in Chicago and has about 500 staff members. The Ryuk penetration had shut down all business operations and manufacturing capabilities. The majority of the client's system backups had been directly accessible at the beginning of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom (in excess of two hundred thousand dollars) and hoping for good luck, but in the end reached out to Progent.

Progent worked together with the customer to rapidly determine and prioritize the key areas that needed to be addressed in order to continue company functions:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

Within 48 hours, Progent was able to rebuild Active Directory to its pre-penetration state. Progent then completed reinstallations and hard drive recovery on the most important systems. All Microsoft Exchange Server data and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to collect local OST data files (Outlook Off-Line Folder Files) on team desktop computers to recover mail information. A not too old offline backup of the customer's manufacturing systems made them able to recover these required applications back online for users. Although significant work still had to be done to recover fully from the Ryuk damage, critical systems were restored quickly:

Throughout the following couple of weeks key milestones in the restoration project were completed in close cooperation between Progent engineers and the customer:

• Internal web applications were brought back up without losing any data.
• The MailStore Server exceeding four million historical messages was brought online and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory capabilities were 100% restored.
• A new Palo Alto Networks 850 security appliance was installed.
• Nearly all of the user desktops and notebooks were operational.

Conclusion
A potential business-killing catastrophe was avoided due to dedicated experts, a wide spectrum of subject matter expertise, and tight teamwork. Although upon completion of forensics the crypto-ransomware virus penetration detailed here would have been identified and blocked with up-to-date cyber security systems and best practices, team education, and well thought out incident response procedures for backup and keeping systems up to date with security patches, the fact is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware incident, remember that Progent's team of experts has substantial experience in ransomware virus blocking, mitigation, and file restoration.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Bellevue a portfolio of online monitoring and security assessment services designed to assist you to minimize your vulnerability to ransomware. These services utilize modern artificial intelligence capability to detect new variants of ransomware that are able to get past legacy signature-based security solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that uses state-of-the-art remote monitoring and management techniques to help keep your IT system operating efficiently by checking the health of vital computers that drive your information system. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your specified IT personnel and your Progent consultant so that any looming issues can be resolved before they can impact productivity. Find out more details about ProSight LAN Watch server and desktop monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software offers a unified, cloud-based platform for managing your client-server infrastructure by offering an environment for streamlining common tedious tasks. These include health monitoring, patch management, automated remediation, endpoint deployment, backup and restore, A/V protection, secure remote access, built-in and custom scripts, resource inventory, endpoint profile reports, and troubleshooting help. When ProSight LAN Watch with NinjaOne RMM uncovers a serious problem, it sends an alert to your specified IT personnel and your assigned Progent technical consultant so that potential issues can be fixed before they interfere with productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  Progent's ProSight WAN Watch is an infrastructure management service that makes it simple and affordable for smaller organizations to map, track, reconfigure and troubleshoot their networking hardware such as routers, firewalls, and load balancers as well as servers, printers, client computers and other networked devices. Using state-of-the-art RMM technology, WAN Watch makes sure that network diagrams are kept updated, captures and manages the configuration information of almost all devices connected to your network, monitors performance, and sends alerts when problems are detected. By automating tedious management and troubleshooting activities, WAN Watch can knock hours off ordinary tasks like making network diagrams, reconfiguring your network, locating devices that require important updates, or identifying the cause of performance issues. Learn more about ProSight WAN Watch infrastructure management consulting.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is an expanding suite of real-time and in-depth management reporting plug-ins created to work with the leading ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to surface and contextualize critical issues like inconsistent support follow-up or machines with missing patches. By identifying ticketing or network health concerns clearly and in near-real time, ProSight Reporting enhances network value, reduces management overhead, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has partnered with leading backup technology providers to create ProSight Data Protection Services, a portfolio of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS services manage and monitor your backup operations and allow transparent backup and fast restoration of vital files/folders, apps, images, and VMs. ProSight DPS helps you avoid data loss caused by hardware failures, natural disasters, fire, cyber attacks such as ransomware, user mistakes, ill-intentioned insiders, or software glitches. Managed backup services in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight DPS MSP360 Cloud and On-prem Backup. Your Progent service representative can assist you to identify which of these managed services are most appropriate for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the technology of leading data security vendors to provide web-based management and comprehensive security for your inbound and outbound email. The hybrid structure of Progent's Email Guard managed service integrates a Cloud Protection Layer with a local security gateway appliance to offer advanced protection against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne threats. Email Guard's Cloud Protection Layer serves as a preliminary barricade and keeps the vast majority of threats from making it to your security perimeter. This decreases your vulnerability to external threats and conserves network bandwidth and storage. Email Guard's onsite gateway appliance provides a deeper level of inspection for inbound email. For outgoing email, the onsite security gateway provides anti-virus and anti-spam filtering, policy-based Data Loss Prevention, and email encryption. The local security gateway can also help Exchange Server to track and protect internal email that originates and ends inside your security perimeter. For more information, see Email Guard spam filtering and data leakage protection.

• ProSight Duo Two-Factor Authentication: ID Confirmation, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA managed services utilize Cisco's Duo technology to defend against compromised passwords by using two-factor authentication (2FA). Duo supports single-tap identity verification with Apple iOS, Android, and other out-of-band devices. Using 2FA, whenever you sign into a secured application and enter your password you are requested to confirm who you are on a device that only you have and that uses a different ("out-of-band") network channel. A broad range of out-of-band devices can be used as this added form of ID validation including a smartphone or watch, a hardware token, a landline phone, etc. You can register several verification devices. To find out more about ProSight Duo two-factor identity validation services, see Cisco Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Service Center: Help Desk Managed Services
  Progent's Call Desk services permit your IT staff to offload Call Center services to Progent or divide responsibilities for Help Desk services seamlessly between your internal network support team and Progent's extensive pool of certified IT service engineers and subject matter experts (SMEs). Progent's Co-managed Help Desk Service offers a smooth extension of your in-house network support staff. User interaction with the Service Desk, delivery of support services, problem escalation, ticket creation and updates, performance measurement, and management of the support database are consistent regardless of whether incidents are taken care of by your in-house IT support staff, by Progent's team, or by a combination. Learn more about Progent's outsourced/shared Service Center services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) service that incorporates cutting edge behavior-based machine learning technology to defend endpoint devices and physical and virtual servers against modern malware attacks such as ransomware and file-less exploits, which easily escape traditional signature-matching AV tools. Progent Active Security Monitoring services safeguard local and cloud resources and offers a single platform to address the entire threat lifecycle including protection, detection, mitigation, remediation, and post-attack forensics. Key features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Learn more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, update, find and safeguard data related to your IT infrastructure, procedures, applications, and services. You can instantly find passwords or serial numbers and be alerted about impending expirations of SSLs or warranties. By updating and managing your IT documentation, you can eliminate up to half of time wasted looking for vital information about your IT network. ProSight IT Asset Management features a common repository for storing and collaborating on all documents required for managing your network infrastructure such as standard operating procedures (SOPs) and How-To's. ProSight IT Asset Management also offers advanced automation for gathering and relating IT information. Whether you're making improvements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the information you need as soon as you need it. Read more about ProSight IT Asset Management service.

• Progent's Patch Management: Patch Management Services
  Progent's support services for software and firmware patch management offer businesses of all sizes a flexible and cost-effective solution for evaluating, testing, scheduling, applying, and tracking software and firmware updates to your ever-evolving information system. Besides optimizing the security and functionality of your IT network, Progent's patch management services permit your in-house IT staff to focus on line-of-business initiatives and tasks that deliver the highest business value from your information network. Read more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a protected fault tolerant data center on a fast virtual host set up and managed by Progent's network support experts. With Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system software, and the applications. Since the system is virtualized, it can be moved easily to an alternate hosting environment without requiring a lengthy and technically risky reinstallation procedure. With ProSight Virtual Hosting, your business is not locked into one hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  Progent's ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's next generation behavior analysis tools to defend physical and virtual endpoint devices against modern malware assaults like ransomware and email phishing, which routinely get by legacy signature-matching AV products. ProSight Active Security Monitoring protects local and cloud-based resources and provides a single platform to manage the entire threat progression including protection, identification, containment, remediation, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and real-time network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware recovery.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) managed services offer affordable multi-layer security for physical and virtual servers, workstations, mobile devices, and Exchange Server. ProSight ESP uses adaptive security and advanced machine learning for continuously monitoring and responding to security assaults from all attack vectors. ProSight ESP offers firewall protection, intrusion alarms, device control, and web filtering via leading-edge technologies packaged within one agent managed from a single console. Progent's data protection and virtualization experts can assist your business to plan and configure a ProSight ESP deployment that addresses your company's specific requirements and that helps you demonstrate compliance with legal and industry data security standards. Progent will assist you specify and configure security policies that ProSight ESP will enforce, and Progent will monitor your network and respond to alerts that require immediate action. Progent can also assist your company to install and verify a backup and disaster recovery solution such as ProSight Data Protection Services so you can get back in business quickly from a destructive security attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint security and Exchange filtering.