St. Paul 24-Hour Critical Ransomware
Malware Detection and Removal Consultants

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a too-frequent cyber pandemic that represents an existential danger for organizations poorly prepared for an assault. Different versions of crypto-ransomware like the Reveton, WannaCry, Locky, SamSam and MongoLock cryptoworms have been circulating for a long time and still inflict havoc. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch or Egregor, plus additional as yet unnamed viruses, not only encrypt on-line data but also infect most available system backups. Information synched to off-site disaster recovery sites can also be encrypted. In a poorly designed data protection solution, this can make any recovery hopeless and basically knocks the datacenter back to square one.

Getting back programs and information after a ransomware event becomes a race against the clock as the targeted organization fights to stop lateral movement, clear the virus, and resume enterprise-critical operations. Since ransomware takes time to spread, attacks are often launched at night, when successful attacks are likely to take more time to identify. This multiplies the difficulty of rapidly assembling and orchestrating a qualified mitigation team.

Progent provides a range of solutions for securing businesses from ransomware attacks. Among these are staff education to become familiar with and not fall victim to phishing exploits, ProSight Active Security Monitoring for remote monitoring and management, along with setup and configuration of modern security solutions with machine learning technology from SentinelOne to identify and extinguish day-zero cyber threats quickly. Progent also can provide the assistance of expert ransomware recovery professionals with the talent and perseverance to restore a breached environment as quickly as possible.

Progent's Ransomware Restoration Help
Soon after a crypto-ransomware penetration, paying the ransom demands in cryptocurrency does not provide any assurance that criminal gangs will respond with the keys to decrypt any or all of your files. Kaspersky ascertained that 17% of ransomware victims never recovered their files even after having sent off the ransom, resulting in increased losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The alternative is to piece back together the mission-critical elements of your Information Technology environment. Without access to essential information backups, this requires a broad range of IT skills, professional team management, and the willingness to work non-stop until the task is done.

For decades, Progent has offered certified expert IT services for companies across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded top industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise in accounting and ERP software solutions. This breadth of experience provides Progent the ability to rapidly determine necessary systems and consolidate the remaining parts of your computer network environment after a ransomware event and configure them into a functioning network.

Progent's ransomware team utilizes top notch project management systems to coordinate the complicated recovery process. Progent understands the urgency of acting quickly and together with a client's management and Information Technology resources to prioritize tasks and to put the most important services back on line as fast as possible.

Client Case Study: A Successful Crypto-Ransomware Incident Response
A client escalated to Progent after their company was taken over by the Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean government sponsored hackers, possibly adopting algorithms leaked from the U.S. NSA organization. Ryuk targets specific organizations with little or no tolerance for operational disruption and is one of the most lucrative incarnations of ransomware. Headline targets include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturer located in the Chicago metro area with around 500 workers. The Ryuk attack had paralyzed all business operations and manufacturing processes. The majority of the client's system backups had been directly accessible at the beginning of the attack and were encrypted. The client was pursuing financing for paying the ransom demand (more than two hundred thousand dollars) and wishfully thinking for good luck, but ultimately brought in Progent.

Progent worked hand in hand the customer to rapidly assess and assign priority to the critical systems that had to be addressed in order to continue company operations:

• Active Directory (AD)
• Electronic Messaging
• MRP System

Within two days, Progent was able to rebuild Active Directory to its pre-penetration state. Progent then performed reinstallations and storage recovery of key servers. All Exchange Server ties and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to find local OST data files (Outlook Email Offline Folder Files) on various PCs to recover email data. A not too old off-line backup of the client's financials/MRP systems made it possible to recover these essential services back online. Although significant work remained to recover completely from the Ryuk event, essential services were returned to operations quickly:

Throughout the following few weeks important milestones in the recovery process were made through close collaboration between Progent team members and the customer:

• In-house web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server exceeding 4 million archived emails was brought online and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory modules were 100% operational.
• A new Palo Alto 850 security appliance was brought online.
• Most of the desktop computers were back into operation.

Conclusion
A potential enterprise-killing disaster was evaded due to results-oriented professionals, a wide spectrum of subject matter expertise, and close teamwork. Although in analyzing the event afterwards the ransomware virus incident described here should have been disabled with current security systems and best practices, user and IT administrator education, and well thought out incident response procedures for data backup and keeping systems up to date with security patches, the reality remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's roster of experts has substantial experience in ransomware virus blocking, remediation, and data disaster recovery.

To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Ransomware Protection Services Offered by Progent
Progent offers companies in St. Paul a range of online monitoring and security assessment services designed to help you to minimize the threat from ransomware. These services incorporate next-generation AI technology to detect new variants of ransomware that are able to escape detection by traditional signature-based anti-virus solutions.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop remote monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to keep your network running at peak levels by checking the health of vital assets that drive your information system. When ProSight LAN Watch uncovers a problem, an alert is sent immediately to your designated IT management personnel and your assigned Progent engineering consultant so that any potential problems can be resolved before they can impact productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring services.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM Solution for Networks, Servers, and Desktops
  ProSight LAN Watch with NinjaOne RMM software delivers a centralized, cloud-driven solution for monitoring and managing your client-server infrastructure by providing an environment for streamlining common time-consuming jobs. These can include health monitoring, patch management, automated repairs, endpoint configuration, backup and restore, anti-virus defense, secure remote access, built-in and custom scripts, resource inventory, endpoint status reports, and debugging support. If ProSight LAN Watch with NinjaOne RMM spots a serious problem, it transmits an alarm to your specified IT personnel and your assigned Progent consultant so that emerging issues can be fixed before they interfere with your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure monitoring and management service that makes it simple and affordable for small and mid-sized businesses to map out, monitor, optimize and debug their networking hardware like routers, firewalls, and load balancers as well as servers, printers, client computers and other devices. Using state-of-the-art RMM technology, ProSight WAN Watch ensures that network maps are kept updated, copies and manages the configuration information of virtually all devices on your network, tracks performance, and sends notices when potential issues are detected. By automating tedious management and troubleshooting activities, WAN Watch can cut hours off common tasks like making network diagrams, reconfiguring your network, finding appliances that need critical updates, or identifying the cause of performance bottlenecks. Learn more about ProSight WAN Watch infrastructure management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Applications
  ProSight Reporting is a growing suite of in-depth management reporting plug-ins created to integrate with the leading ticketing and remote network monitoring applications including ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting incorporates Microsoft Graph and features color coding to surface and contextualize key issues like inconsistent support follow-through or endpoints with missing patches. By identifying ticketing or network health problems concisely and in near-real time, ProSight Reporting improves network value, reduces management overhead, and saves money. For details, see ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Managed Backup and Recovery Services
  Progent has worked with advanced backup technology providers to create ProSight Data Protection Services (DPS), a portfolio of subscription-based management offerings that provide backup-as-a-service. ProSight DPS products automate and monitor your data backup processes and allow transparent backup and rapid recovery of vital files/folders, applications, images, plus VMs. ProSight DPS lets your business protect against data loss resulting from hardware failures, natural calamities, fire, malware such as ransomware, user error, ill-intentioned insiders, or software bugs. Managed services in the ProSight Data Protection Services product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight ECHO Backup using Barracuda dedicated storage, and ProSight MSP360 Cloud and On-prem Backup. Your Progent consultant can help you to determine which of these fully managed backup services are most appropriate for your IT environment.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of leading data security vendors to deliver centralized management and world-class protection for all your email traffic. The hybrid structure of Email Guard combines cloud-based filtering with a local security gateway device to provide complete defense against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks (DHAs), and other email-based malware. The Cloud Protection Layer serves as a preliminary barricade and keeps most unwanted email from making it to your security perimeter. This decreases your exposure to external attacks and saves system bandwidth and storage. Email Guard's on-premises gateway appliance adds a deeper layer of analysis for inbound email. For outgoing email, the onsite gateway provides AV and anti-spam filtering, DLP, and email encryption. The on-premises security gateway can also help Exchange Server to monitor and protect internal email that originates and ends within your corporate firewall. For more information, visit Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Identity Validation, Endpoint Policy Enforcement, and Protected Single Sign-on
  Progent's Duo MFA services utilize Cisco's Duo cloud technology to protect against stolen passwords by using two-factor authentication (2FA). Duo supports one-tap identity confirmation on iOS, Android, and other out-of-band devices. Using 2FA, when you sign into a protected application and enter your password you are requested to verify who you are via a unit that only you have and that uses a separate network channel. A wide selection of devices can be used for this second form of ID validation such as an iPhone or Android or wearable, a hardware token, a landline phone, etc. You can designate several validation devices. To learn more about Duo two-factor identity authentication services, see Cisco Duo MFA two-factor authentication (2FA) services for access security.

• Progent's Outsourced/Shared Call Desk: Call Center Managed Services
  Progent's Call Center managed services allow your IT staff to outsource Help Desk services to Progent or split responsibilities for support services transparently between your internal network support resources and Progent's extensive pool of certified IT service engineers and subject matter experts (SMEs). Progent's Co-managed Service Desk offers a smooth extension of your core IT support resources. Client access to the Service Desk, provision of support services, issue escalation, ticket creation and tracking, efficiency metrics, and maintenance of the support database are consistent regardless of whether incidents are taken care of by your internal network support staff, by Progent's team, or both. Learn more about Progent's outsourced/co-managed Service Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Detection and Remediation
  Progent's Active Protection Against Ransomware is an endpoint protection (EPP) managed service that utilizes next generation behavior-based analysis technology to guard endpoints as well as physical and virtual servers against modern malware assaults such as ransomware and email phishing, which easily escape traditional signature-based anti-virus products. Progent Active Security Monitoring services protect on-premises and cloud resources and provides a unified platform to manage the complete malware attack lifecycle including filtering, detection, mitigation, remediation, and post-attack forensics. Key capabilities include single-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Learn more about Progent's ransomware defense and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  Progent's ProSight IT Asset Management service is a cloud-based IT documentation management service that allows you to capture, maintain, retrieve and safeguard data related to your IT infrastructure, procedures, business apps, and services. You can quickly find passwords or IP addresses and be alerted automatically about impending expirations of SSLs or domains. By updating and managing your IT documentation, you can eliminate up to 50% of time wasted trying to find vital information about your IT network. ProSight IT Asset Management features a common location for storing and sharing all documents required for managing your network infrastructure like recommended procedures and self-service instructions. ProSight IT Asset Management also offers a high level of automation for gathering and associating IT information. Whether you're planning enhancements, performing maintenance, or responding to a crisis, ProSight IT Asset Management delivers the data you need when you need it. Read more about ProSight IT Asset Management service.

• Patch Management: Patch Management Services
  Progent's support services for patch management provide businesses of all sizes a versatile and affordable alternative for assessing, testing, scheduling, applying, and documenting updates to your ever-evolving information network. Besides maximizing the protection and reliability of your IT environment, Progent's software/firmware update management services allow your in-house IT staff to concentrate on line-of-business projects and tasks that derive maximum business value from your network. Learn more about Progent's patch management services.

• ProSight Virtual Hosting: Hosted Virtual Machines at Progent's Tier III Data Center
  With Progent's ProSight Virtual Hosting service, a small business can have its key servers and apps hosted in a secure fault tolerant data center on a high-performance virtual machine host configured and managed by Progent's network support professionals. With the ProSight Virtual Hosting service model, the client owns the data, the OS platforms, and the apps. Because the environment is virtualized, it can be ported immediately to an alternate hardware environment without a lengthy and difficult reinstallation procedure. With ProSight Virtual Hosting, your business is not tied a single hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection solution that incorporates SentinelOne's next generation behavior machine learning technology to defend physical and virtual endpoint devices against modern malware assaults like ransomware and file-less exploits, which routinely escape traditional signature-matching AV tools. ProSight Active Security Monitoring safeguards local and cloud-based resources and offers a single platform to manage the entire malware attack progression including blocking, detection, mitigation, cleanup, and forensics. Top features include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic system-wide immunization against newly discovered threats. Progent is a SentinelOne Partner, dealer, and integrator. Find out more about Progent's ProSight Active Security Monitoring next-generation endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection: Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection managed services offer economical multi-layer security for physical servers and virtual machines, workstations, mobile devices, and Exchange Server. ProSight ESP uses contextual security and advanced machine learning for continuously monitoring and reacting to security assaults from all vectors. ProSight ESP delivers two-way firewall protection, penetration alarms, device management, and web filtering through cutting-edge technologies packaged within a single agent managed from a unified console. Progent's data protection and virtualization experts can assist your business to design and configure a ProSight ESP deployment that meets your organization's specific requirements and that allows you prove compliance with government and industry information security standards. Progent will assist you define and configure security policies that ProSight ESP will manage, and Progent will monitor your IT environment and react to alerts that require immediate action. Progent can also help you to install and test a backup and restore system like ProSight Data Protection Services (DPS) so you can recover quickly from a potentially disastrous security attack such as ransomware. Find out more about Progent's ProSight Enhanced Security Protection unified physical and virtual endpoint protection and Exchange filtering.