Boise 24x7x365 Immediate Ransomware
Computer Virus Detection and Removal Support

Ransomware : Your Crippling IT Nightmare
Ransomware has become a too-frequent cyber pandemic that presents an enterprise-level danger for businesses of all sizes unprepared for an attack. Different iterations of ransomware such as Reveton, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been circulating for a long time and continue to cause damage. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, as well as additional unnamed malware, not only do encryption of on-line files but also infiltrate all configured system protection mechanisms. Information replicated to cloud environments can also be ransomed. In a vulnerable environment, this can make automated restore operations hopeless and effectively sets the entire system back to square one.

Retrieving services and data after a crypto-ransomware outage becomes a race against time as the targeted organization fights to contain the damage, clear the ransomware, and restore mission-critical activity. Because crypto-ransomware needs time to replicate, assaults are frequently sprung during weekends and nights, when penetrations typically take longer to notice. This multiplies the difficulty of promptly marshalling and orchestrating an experienced response team.

Progent offers a variety of services for protecting organizations from crypto-ransomware penetrations. These include team member training to help identify and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for remote monitoring and management, in addition to deployment of the latest generation security gateways with AI technology from SentinelOne to detect and suppress new cyber threats quickly. Progent also can provide the assistance of expert ransomware recovery consultants with the talent and perseverance to reconstruct a compromised network as soon as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will return the codes to decrypt all your files. Kaspersky ascertained that seventeen percent of ransomware victims never restored their information after having sent off the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The other path is to setup from scratch the mission-critical parts of your Information Technology environment. Without the availability of full system backups, this requires a broad range of skill sets, top notch project management, and the capability to work continuously until the task is finished.

For decades, Progent has offered expert IT services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have been awarded advanced certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity consultants have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial systems and ERP applications. This breadth of expertise gives Progent the ability to efficiently understand important systems and organize the surviving parts of your computer network system following a ransomware penetration and rebuild them into an operational network.

Progent's security team uses state-of-the-art project management systems to coordinate the sophisticated restoration process. Progent knows the urgency of working swiftly and in concert with a client's management and IT staff to assign priority to tasks and to put the most important applications back on line as fast as humanly possible.

Customer Story: A Successful Ransomware Attack Recovery
A client contacted Progent after their company was taken over by the Ryuk ransomware. Ryuk is thought to have been deployed by Northern Korean state cybercriminals, possibly adopting strategies leaked from America's NSA organization. Ryuk attacks specific companies with limited tolerance for disruption and is one of the most lucrative incarnations of ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturing business located in Chicago and has about 500 staff members. The Ryuk intrusion had paralyzed all business operations and manufacturing processes. The majority of the client's system backups had been online at the start of the intrusion and were damaged. The client was pursuing financing for paying the ransom demand (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but ultimately utilized Progent.

Progent worked with the customer to rapidly identify and prioritize the most important areas that needed to be addressed in order to restart departmental operations:

• Active Directory
• Email
• Financials/MRP

Within 2 days, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then initiated rebuilding and hard drive recovery of the most important servers. All Exchange ties and configuration information were intact, which greatly helped the restore of Exchange. Progent was also able to locate non-encrypted OST data files (Microsoft Outlook Offline Data Files) on staff PCs in order to recover mail messages. A not too old offline backup of the customer's manufacturing systems made them able to return these essential services back servicing users. Although a large amount of work needed to be completed to recover fully from the Ryuk damage, essential systems were recovered quickly:

During the following couple of weeks key milestones in the restoration process were completed in tight collaboration between Progent consultants and the customer:

• Self-hosted web sites were returned to operation with no loss of data.
• The MailStore Server with over 4 million historical messages was brought on-line and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable/AR/Inventory Control capabilities were 100 percent operational.
• A new Palo Alto 850 firewall was installed.
• Ninety percent of the user desktops were operational.

Conclusion
A probable business-ending disaster was evaded by top-tier experts, a broad range of knowledge, and close collaboration. Although in hindsight the ransomware virus incident detailed here should have been stopped with advanced security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and properly executed incident response procedures for backup and applying software patches, the fact is that government-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware attack, feel confident that Progent's roster of professionals has extensive experience in ransomware virus defense, removal, and file recovery.

To review or download a PDF version of this customer case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Offered by Progent
Progent offers businesses in Boise a portfolio of remote monitoring and security assessment services to help you to minimize your vulnerability to ransomware. These services incorporate next-generation machine learning technology to uncover new strains of crypto-ransomware that are able to get past legacy signature-based security solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring and Management
  ProSight LAN Watch is Progent's server and desktop monitoring service that incorporates advanced remote monitoring and management techniques to help keep your IT system operating at peak levels by tracking the state of vital computers that power your business network. When ProSight LAN Watch detects a problem, an alert is transmitted immediately to your designated IT personnel and your assigned Progent consultant so any looming issues can be addressed before they have a chance to disrupt your network. Learn more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based solution for managing your network, server, and desktop devices by offering an environment for performing common tedious jobs. These can include health checking, update management, automated repairs, endpoint setup, backup and restore, anti-virus defense, secure remote access, standard and custom scripts, resource inventory, endpoint status reports, and debugging assistance. When ProSight LAN Watch with NinjaOne RMM spots a serious issue, it transmits an alert to your specified IT staff and your assigned Progent consultant so potential issues can be taken care of before they impact productivity. Learn more details about ProSight LAN Watch with NinjaOne RMM server and desktop monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized businesses to map out, monitor, optimize and troubleshoot their networking appliances such as routers, firewalls, and load balancers plus servers, endpoints and other networked devices. Incorporating cutting-edge Remote Monitoring and Management (RMM) technology, WAN Watch makes sure that network maps are always updated, captures and displays the configuration information of almost all devices on your network, monitors performance, and generates notices when issues are detected. By automating time-consuming management and troubleshooting processes, WAN Watch can knock hours off ordinary tasks such as making network diagrams, reconfiguring your network, finding appliances that need critical software patches, or isolating performance issues. Learn more details about ProSight WAN Watch network infrastructure management services.

• ProSight Reporting: Real-time Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is an expanding family of in-depth management reporting utilities created to integrate with the leading ticketing and network monitoring programs including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and utilizes color coding to highlight and contextualize key issues such as inconsistent support follow-up or machines with out-of-date AVs. By exposing ticketing or network health problems concisely and in near-real time, ProSight Reporting improves productivity, lowers management hassle, and saves money. For more information, visit ProSight Reporting for ticketing and network monitoring applications.

• ProSight Data Protection Services: Backup and Recovery Services
  Progent has partnered with advanced backup technology providers to create ProSight Data Protection Services (DPS), a portfolio of subscription-based management offerings that deliver backup-as-a-service. ProSight DPS products automate and track your backup processes and enable transparent backup and rapid restoration of vital files/folders, apps, system images, and Hyper-V and VMware virtual machines. ProSight DPS lets you avoid data loss caused by equipment breakdown, natural disasters, fire, malware like ransomware, user error, malicious employees, or application glitches. Managed backup services available in the ProSight DPS product line include ProSight Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated hardware, and ProSight MSP360 Hybrid Backup. Your Progent service representative can help you to identify which of these fully managed services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering and email encryption service that uses the infrastructure of leading data security vendors to deliver centralized management and world-class security for your email traffic. The powerful architecture of Progent's Email Guard integrates cloud-based filtering with a local gateway appliance to provide complete defense against spam, viruses, Dos Attacks, Directory Harvest Attacks, and other email-borne threats. Email Guard's Cloud Protection Layer acts as a first line of defense and blocks most threats from reaching your security perimeter. This reduces your exposure to external attacks and conserves network bandwidth and storage. Email Guard's onsite security gateway device provides a further level of inspection for incoming email. For outbound email, the on-premises gateway offers anti-virus and anti-spam filtering, DLP, and email encryption. The on-premises security gateway can also help Exchange Server to monitor and protect internal email that originates and ends inside your corporate firewall. For more information, visit ProSight Email Guard spam filtering and data leakage protection.

• ProSight Duo Multi-Factor Authentication: Access Security, Endpoint Remediation, and Secure Single Sign-on
  Progent's Duo MFA service plans incorporate Cisco's Duo technology to defend against compromised passwords through the use of two-factor authentication. Duo supports single-tap identity verification with iOS, Google Android, and other personal devices. Using Duo 2FA, whenever you log into a protected online account and give your password you are asked to confirm your identity on a unit that only you have and that uses a different ("out-of-band") network channel. A broad range of devices can be utilized as this added means of authentication such as a smartphone or wearable, a hardware token, a landline telephone, etc. You can designate several verification devices. To find out more about ProSight Duo identity authentication services, refer to Duo MFA two-factor authentication (2FA) services.

• Outsourced/Co-managed Service Desk: Support Desk Managed Services
  Progent's Help Desk managed services allow your information technology staff to outsource Support Desk services to Progent or divide responsibilities for Help Desk services seamlessly between your in-house network support resources and Progent's nationwide roster of IT support technicians, engineers and subject matter experts. Progent's Shared Service Desk offers a transparent extension of your in-house IT support resources. Client interaction with the Help Desk, delivery of support services, issue escalation, ticket creation and tracking, performance metrics, and management of the service database are consistent regardless of whether incidents are resolved by your core network support organization, by Progent's team, or both. Learn more about Progent's outsourced/shared Service Center services.

• Progent Active Protection Against Ransomware: AI-based Ransomware Detection and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection (EPP) managed service that incorporates cutting edge behavior analysis technology to guard endpoint devices as well as physical and virtual servers against modern malware attacks such as ransomware and file-less exploits, which easily evade traditional signature-based AV products. Progent ASM services protect local and cloud resources and offers a unified platform to automate the complete threat progression including blocking, detection, mitigation, cleanup, and forensics. Key capabilities include single-click rollback using Windows Volume Shadow Copy Service (VSS) and real-time system-wide immunization against new attacks. Read more about Progent's ransomware protection and cleanup services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is an IT infrastructure documentation management service that makes it easy to create, maintain, retrieve and protect data about your IT infrastructure, processes, business apps, and services. You can instantly locate passwords or serial numbers and be warned automatically about impending expirations of SSLs or warranties. By updating and organizing your IT documentation, you can save up to 50% of time thrown away looking for critical information about your network. ProSight IT Asset Management features a centralized repository for storing and sharing all documents required for managing your business network like recommended procedures and How-To's. ProSight IT Asset Management also supports advanced automation for gathering and associating IT data. Whether you're making enhancements, doing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the data you need the instant you need it. Find out more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's support services for patch management offer businesses of all sizes a versatile and affordable alternative for assessing, testing, scheduling, applying, and documenting updates to your ever-evolving information system. In addition to maximizing the protection and functionality of your IT environment, Progent's patch management services allow your in-house IT team to concentrate on more strategic initiatives and activities that derive the highest business value from your network. Find out more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With Progent's ProSight Virtual Hosting service, a small or mid-size business can have its critical servers and apps hosted in a protected Tier III data center on a fast virtual machine host configured and managed by Progent's IT support experts. With Progent's ProSight Virtual Hosting model, the customer retains ownership of the data, the operating system software, and the applications. Because the system is virtualized, it can be moved immediately to an alternate hosting solution without a lengthy and difficult configuration procedure. With ProSight Virtual Hosting, your business is not tied a single hosting provider. Find out more details about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection (EPP) solution that incorporates SentinelOne's cutting edge behavior analysis technology to guard physical and virtual endpoints against new malware attacks such as ransomware and email phishing, which routinely evade traditional signature-matching anti-virus tools. ProSight Active Security Monitoring protects on-premises and cloud resources and provides a unified platform to address the entire malware attack progression including filtering, identification, containment, cleanup, and post-attack forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service and real-time system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Read more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Security and Microsoft Exchange Email Filtering
  ProSight Enhanced Security Protection managed services deliver ultra-affordable in-depth protection for physical and virtual servers, workstations, mobile devices, and Exchange email. ProSight ESP utilizes adaptive security and advanced machine learning for continuously monitoring and responding to security threats from all attack vectors. ProSight ESP delivers firewall protection, penetration alarms, device control, and web filtering through cutting-edge technologies incorporated within a single agent managed from a single control. Progent's data protection and virtualization experts can help you to design and implement a ProSight ESP deployment that meets your company's unique requirements and that helps you achieve and demonstrate compliance with legal and industry information security regulations. Progent will help you define and implement policies that ProSight ESP will manage, and Progent will monitor your network and react to alerts that require immediate action. Progent can also assist your company to install and test a backup and disaster recovery system such as ProSight Data Protection Services (DPS) so you can get back in business rapidly from a destructive cyber attack like ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified endpoint protection and Microsoft Exchange filtering.