Minneapolis 24x7 Critical CryptoLocker
Computer Virus Damage Assessment and Remediation Consultants

Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become an escalating cyber pandemic that represents an existential threat for businesses poorly prepared for an assault. Different iterations of ransomware like the CryptoLocker, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been around for many years and continue to cause havoc. Recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti or Egregor, as well as daily unnamed malware, not only encrypt on-line data but also infect any accessible system protection. Files replicated to cloud environments can also be encrypted. In a poorly architected data protection solution, it can render automatic restore operations impossible and effectively sets the entire system back to square one.

Retrieving services and data following a ransomware attack becomes a race against the clock as the targeted organization struggles to contain the damage, clear the virus, and restore enterprise-critical activity. Because crypto-ransomware takes time to replicate, attacks are frequently sprung during weekends and nights, when successful attacks typically take longer to identify. This multiplies the difficulty of rapidly marshalling and organizing a qualified response team.

Progent offers a range of services for securing organizations from ransomware events. Among these are team member training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for remote monitoring and management, plus installation of next-generation security appliances with artificial intelligence technology from SentinelOne to identify and suppress zero-day cyber threats automatically. Progent also provides the services of experienced ransomware recovery consultants with the talent and perseverance to rebuild a compromised environment as rapidly as possible.

Progent's Ransomware Restoration Help
Soon after a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will return the keys to unencrypt any or all of your data. Kaspersky determined that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to piece back together the mission-critical elements of your IT environment. Without access to full system backups, this calls for a broad range of skill sets, professional project management, and the willingness to work continuously until the recovery project is done.

For twenty years, Progent has made available professional Information Technology services for companies throughout the US and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded advanced certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with accounting and ERP applications. This breadth of expertise gives Progent the capability to quickly understand necessary systems and integrate the surviving components of your computer network system after a ransomware event and rebuild them into an operational system.

Progent's recovery team of experts deploys powerful project management systems to coordinate the complicated recovery process. Progent understands the urgency of working quickly and in concert with a client's management and IT resources to assign priority to tasks and to put key services back online as fast as possible.

Customer Case Study: A Successful Crypto-Ransomware Virus Response
A client hired Progent after their network system was crashed by the Ryuk ransomware. Ryuk is believed to have been launched by Northern Korean government sponsored cybercriminals, suspected of using strategies leaked from America's National Security Agency. Ryuk targets specific companies with little room for disruption and is one of the most lucrative versions of ransomware viruses. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing business based in the Chicago metro area with around 500 staff members. The Ryuk penetration had disabled all essential operations and manufacturing capabilities. The majority of the client's information backups had been online at the time of the intrusion and were damaged. The client was pursuing financing for paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but ultimately utilized Progent.

Progent worked together with the client to quickly identify and prioritize the critical applications that had to be recovered in order to restart company operations:

• Microsoft Active Directory
• Microsoft Exchange
• MRP System

In less than two days, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then assisted with rebuilding and storage recovery of key applications. All Exchange Server data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to locate local OST data files (Outlook Email Off-Line Data Files) on staff desktop computers and laptops to recover email data. A recent off-line backup of the client's accounting/MRP software made it possible to return these vital services back servicing users. Although major work was left to recover fully from the Ryuk virus, the most important systems were restored quickly:

During the next few weeks key milestones in the restoration project were made through tight collaboration between Progent engineers and the client:

• Internal web applications were restored with no loss of data.
• The MailStore Microsoft Exchange Server containing more than 4 million archived messages was brought on-line and accessible to users.
• CRM/Orders/Invoicing/AP/AR/Inventory capabilities were 100 percent recovered.
• A new Palo Alto Networks 850 firewall was installed and configured.
• 90% of the desktops and laptops were fully operational.

Conclusion
A probable business-ending catastrophe was avoided with hard-working experts, a wide spectrum of IT skills, and close teamwork. Although upon completion of forensics the ransomware attack described here could have been identified and blocked with advanced security technology solutions and NIST Cybersecurity Framework best practices, team training, and well designed security procedures for data backup and applying software patches, the reality is that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware virus, remember that Progent's team of experts has a proven track record in crypto-ransomware virus blocking, cleanup, and information systems disaster recovery.

To read or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent can provide companies in Minneapolis a variety of online monitoring and security assessment services to assist you to minimize your vulnerability to crypto-ransomware. These services include modern machine learning technology to uncover new strains of ransomware that are able to evade legacy signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates state-of-the-art remote monitoring and management (RMM) techniques to keep your network running efficiently by tracking the health of critical assets that drive your business network. When ProSight LAN Watch uncovers an issue, an alarm is sent immediately to your designated IT personnel and your assigned Progent engineering consultant so that all potential problems can be resolved before they can disrupt your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software offers a centralized, cloud-driven platform for managing your client-server infrastructure by providing tools for performing common time-consuming jobs. These can include health checking, patch management, automated remediation, endpoint configuration, backup and recovery, A/V defense, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting assistance. When ProSight LAN Watch with NinjaOne RMM spots a serious problem, it sends an alert to your specified IT staff and your Progent consultant so that potential issues can be fixed before they interfere with productivity. Learn more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Infrastructure Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it easy and inexpensive for small and mid-sized organizations to diagram, track, reconfigure and troubleshoot their networking appliances such as routers and switches, firewalls, and load balancers as well as servers, printers, endpoints and other devices. Incorporating cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology diagrams are kept updated, copies and displays the configuration of almost all devices connected to your network, monitors performance, and sends alerts when issues are detected. By automating time-consuming network management activities, WAN Watch can knock hours off common tasks such as making network diagrams, expanding your network, locating devices that need important updates, or resolving performance issues. Find out more about ProSight WAN Watch infrastructure monitoring and management consulting.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing line of in-depth management reporting plug-ins designed to work with the industry's top ticketing and network monitoring platforms including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues like inconsistent support follow-through or endpoints with missing patches. By exposing ticketing or network health problems clearly and in near-real time, ProSight Reporting improves network value, lowers management hassle, and saves money. For more information, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services: Managed Backup and Recovery Services
  Progent has worked with advanced backup technology providers to produce ProSight Data Protection Services (DPS), a portfolio of subscription-based management outsourcing plans that deliver backup-as-a-service. ProSight DPS products manage and track your data backup operations and enable non-disruptive backup and rapid recovery of critical files/folders, apps, images, plus Hyper-V and VMware virtual machines. ProSight DPS lets your business recover from data loss resulting from hardware breakdown, natural calamities, fire, cyber attacks such as ransomware, human error, ill-intentioned insiders, or software glitches. Managed backup services in the ProSight Data Protection Services portfolio include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to determine which of these managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam and virus filtering and email encryption service that uses the technology of top information security companies to provide centralized management and comprehensive protection for your inbound and outbound email. The powerful structure of Progent's Email Guard combines cloud-based filtering with an on-premises security gateway device to provide advanced defense against spam, viruses, Dos Attacks, Directory Harvest Attacks (DHAs), and other email-borne malware. The cloud filter serves as a preliminary barricade and keeps most threats from making it to your network firewall. This decreases your vulnerability to external threats and conserves network bandwidth and storage. Email Guard's onsite gateway device adds a further layer of inspection for incoming email. For outgoing email, the local gateway offers anti-virus and anti-spam filtering, protection against data leaks, and email encryption. The onsite gateway can also assist Microsoft Exchange Server to monitor and safeguard internal email traffic that originates and ends within your security perimeter. For more details, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Secure Single Sign-on
  Progent's Duo authentication service plans incorporate Cisco's Duo cloud technology to defend against stolen passwords through the use of two-factor authentication. Duo enables one-tap identity verification on iOS, Android, and other personal devices. With 2FA, when you log into a protected application and enter your password you are requested to verify your identity via a unit that only you possess and that is accessed using a different ("out-of-band") network channel. A wide range of devices can be used for this second form of authentication such as a smartphone or wearable, a hardware/software token, a landline phone, etc. You can register several validation devices. To learn more about ProSight Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Help Center: Help Desk Managed Services
  Progent's Call Desk services allow your information technology staff to offload Call Center services to Progent or divide activity for Service Desk support transparently between your in-house network support staff and Progent's nationwide roster of certified IT support technicians, engineers and subject matter experts. Progent's Shared Help Desk Service provides a smooth supplement to your in-house support staff. End user access to the Help Desk, delivery of technical assistance, problem escalation, ticket creation and updates, performance measurement, and maintenance of the service database are consistent regardless of whether incidents are resolved by your core network support group, by Progent's team, or by a combination. Find out more about Progent's outsourced/co-managed Call Center services.

• Progent Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection service that incorporates cutting edge behavior machine learning technology to defend endpoint devices and servers and VMs against new malware assaults such as ransomware and email phishing, which routinely get by legacy signature-based anti-virus tools. Progent ASM services protect local and cloud resources and provides a single platform to address the complete malware attack progression including filtering, infiltration detection, containment, cleanup, and forensics. Key features include one-click rollback using Windows VSS and automatic network-wide immunization against newly discovered attacks. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is an IT infrastructure documentation management service that allows you to capture, update, retrieve and protect data related to your IT infrastructure, processes, business apps, and services. You can quickly locate passwords or serial numbers and be alerted about impending expirations of SSL certificates ,domains or warranties. By updating and organizing your IT documentation, you can save as much as 50% of time thrown away searching for vital information about your IT network. ProSight IT Asset Management features a common location for storing and collaborating on all documents required for managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for gathering and relating IT information. Whether you're planning improvements, doing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the knowledge you need when you need it. Find out more about Progent's ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's managed services for patch management offer organizations of any size a flexible and affordable alternative for assessing, testing, scheduling, applying, and documenting software and firmware updates to your ever-evolving IT network. In addition to optimizing the protection and functionality of your IT network, Progent's patch management services free up time for your IT team to concentrate on line-of-business initiatives and activities that derive maximum business value from your information network. Read more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With ProSight Virtual Hosting service, a small or mid-size organization can have its critical servers and apps hosted in a protected Tier III data center on a high-performance virtual host configured and managed by Progent's IT support experts. With the ProSight Virtual Hosting service model, the customer retains ownership of the data, the OS platforms, and the applications. Because the environment is virtualized, it can be ported easily to an alternate hosting solution without requiring a lengthy and difficult reinstallation process. With ProSight Virtual Hosting, you are not tied a single hosting provider. Learn more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that incorporates SentinelOne's next generation behavior-based machine learning technology to guard physical and virtual endpoint devices against new malware attacks such as ransomware and email phishing, which routinely escape traditional signature-based AV tools. ProSight ASM safeguards on-premises and cloud-based resources and offers a unified platform to manage the complete malware attack progression including filtering, infiltration detection, mitigation, remediation, and post-attack forensics. Key features include single-click rollback with Windows VSS and automatic network-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Learn more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Physical and Virtual Endpoint Protection and Microsoft Exchange Filtering
  ProSight Enhanced Security Protection managed services offer affordable multi-layer protection for physical servers and VMs, workstations, smartphones, and Microsoft Exchange. ProSight ESP uses adaptive security and modern behavior analysis for round-the-clock monitoring and reacting to cyber threats from all attack vectors. ProSight ESP offers two-way firewall protection, penetration alarms, endpoint control, and web filtering via leading-edge technologies incorporated within a single agent accessible from a unified console. Progent's security and virtualization consultants can assist you to plan and configure a ProSight ESP deployment that meets your organization's unique requirements and that helps you achieve and demonstrate compliance with government and industry data security regulations. Progent will assist you define and implement security policies that ProSight ESP will enforce, and Progent will monitor your network and react to alarms that call for immediate action. Progent's consultants can also help your company to set up and test a backup and disaster recovery system like ProSight Data Protection Services so you can recover quickly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection unified endpoint protection and Microsoft Exchange filtering.