24-Hour Toronto Immediate Crypto-Ransomware
Computer Malware Assessment and Restoration Help

Ransomware : Your Feared IT Disaster
Ransomware has become an escalating cyberplague that represents an enterprise-level threat for businesses of all sizes poorly prepared for an attack. Multiple generations of ransomware such as CryptoLocker, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for a long time and continue to cause harm. Recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch or Egregor, along with more as yet unnamed newcomers, not only encrypt online critical data but also infiltrate many configured system protection. Data synchronized to the cloud can also be corrupted. In a poorly designed environment, it can render automated restore operations hopeless and effectively sets the datacenter back to square one.

Recovering programs and data following a crypto-ransomware event becomes a sprint against the clock as the targeted organization tries its best to contain, clear the ransomware, and restore business-critical activity. Since ransomware takes time to move laterally, penetrations are often launched on weekends, when penetrations may take longer to notice. This multiplies the difficulty of rapidly assembling and organizing an experienced mitigation team.

Progent offers a range of support services for protecting enterprises from ransomware attacks. These include user training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus setup and configuration of modern security appliances with AI technology from SentinelOne to detect and suppress new cyber threats automatically. Progent also offers the services of experienced crypto-ransomware recovery consultants with the talent and perseverance to reconstruct a breached network as urgently as possible.

Progent's Crypto-Ransomware Recovery Support Services
Soon after a crypto-ransomware invasion, paying the ransom in cryptocurrency does not guarantee that criminal gangs will respond with the codes to decrypt all your data. Kaspersky ascertained that seventeen percent of crypto-ransomware victims never recovered their information even after having sent off the ransom, resulting in increased losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The other path is to setup from scratch the vital parts of your Information Technology environment. Without access to complete information backups, this requires a wide complement of IT skills, professional project management, and the willingness to work 24x7 until the recovery project is done.

For decades, Progent has offered certified expert Information Technology services for businesses throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have earned internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in accounting and ERP applications. This breadth of expertise gives Progent the capability to quickly understand critical systems and integrate the surviving parts of your computer network system after a ransomware attack and assemble them into a functioning system.

Progent's ransomware team has state-of-the-art project management systems to orchestrate the complex restoration process. Progent understands the importance of working swiftly and together with a customer's management and Information Technology team members to assign priority to tasks and to put critical applications back online as soon as humanly possible.

Client Story: A Successful Ransomware Attack Recovery
A business engaged Progent after their organization was crashed by Ryuk ransomware. Ryuk is thought to have been launched by Northern Korean government sponsored cybercriminals, possibly adopting technology exposed from the United States NSA organization. Ryuk goes after specific businesses with little or no ability to sustain disruption and is one of the most profitable iterations of ransomware. Headline organizations include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing company based in the Chicago metro area and has around 500 workers. The Ryuk intrusion had disabled all business operations and manufacturing capabilities. The majority of the client's information backups had been on-line at the beginning of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom demand (exceeding two hundred thousand dollars) and praying for the best, but ultimately made the decision to use Progent.

Progent worked hand in hand the client to quickly get our arms around and prioritize the essential areas that needed to be restored to make it possible to resume company operations:

• Microsoft Active Directory
• Electronic Mail
• Accounting and Manufacturing Software

Within 2 days, Progent was able to recover Active Directory to its pre-intrusion state. Progent then charged ahead with setup and hard drive recovery of critical applications. All Microsoft Exchange Server schema and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was also able to collect non-encrypted OST files (Outlook Email Off-Line Data Files) on team workstations and laptops to recover email data. A recent offline backup of the customer's accounting systems made them able to return these vital applications back servicing users. Although major work needed to be completed to recover completely from the Ryuk damage, core services were returned to operations rapidly:

During the following few weeks critical milestones in the recovery project were achieved through tight collaboration between Progent consultants and the client:

• In-house web sites were restored without losing any information.
• The MailStore Exchange Server containing more than four million archived emails was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control functions were 100% recovered.
• A new Palo Alto Networks 850 firewall was deployed.
• 90% of the user desktops and notebooks were operational.

Conclusion
A possible business catastrophe was averted through the efforts of dedicated experts, a broad array of IT skills, and tight collaboration. Although in retrospect the crypto-ransomware virus penetration detailed here could have been identified and blocked with modern security technology solutions and ISO/IEC 27001 best practices, staff education, and well designed security procedures for information backup and proper patching controls, the reality remains that government-sponsored cybercriminals from Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do fall victim to a ransomware incursion, feel confident that Progent's roster of experts has proven experience in ransomware virus defense, mitigation, and file recovery.

To read or download a PDF version of this customer case study, click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Additional Crypto-Ransomware Protection Services Available from Progent
Progent offers companies in Toronto a variety of remote monitoring and security assessment services designed to help you to minimize your vulnerability to ransomware. These services utilize modern AI capability to detect new variants of ransomware that are able to evade traditional signature-based anti-virus products.

• ProSight LAN Watch: Server and Desktop Remote Monitoring
  ProSight LAN Watch is Progent's server and desktop monitoring managed service that incorporates advanced remote monitoring and management (RMM) techniques to keep your network operating efficiently by tracking the health of vital assets that power your business network. When ProSight LAN Watch uncovers a problem, an alert is sent automatically to your specified IT management staff and your assigned Progent consultant so that all potential problems can be addressed before they can impact productivity. Find out more details about ProSight LAN Watch server and desktop remote monitoring consulting.

• ProSight LAN Watch with NinjaOne RMM: Centralized RMM for Networks, Servers, and Workstations
  ProSight LAN Watch with NinjaOne RMM software delivers a unified, cloud-based platform for managing your client-server infrastructure by providing tools for streamlining common time-consuming jobs. These can include health monitoring, update management, automated remediation, endpoint setup, backup and restore, A/V response, remote access, built-in and custom scripts, resource inventory, endpoint status reports, and troubleshooting support. If ProSight LAN Watch with NinjaOne RMM identifies a serious problem, it transmits an alarm to your designated IT personnel and your assigned Progent consultant so that emerging issues can be fixed before they impact your network. Find out more about ProSight LAN Watch with NinjaOne RMM server and desktop remote monitoring services.

• ProSight WAN Watch: Network Infrastructure Remote Monitoring and Management
  ProSight WAN Watch is a network infrastructure management service that makes it easy and inexpensive for small and mid-sized organizations to map, track, optimize and troubleshoot their networking appliances like routers and switches, firewalls, and load balancers as well as servers, client computers and other networked devices. Incorporating cutting-edge Remote Monitoring and Management technology, WAN Watch makes sure that infrastructure topology diagrams are always updated, copies and displays the configuration of almost all devices connected to your network, tracks performance, and generates notices when potential issues are detected. By automating time-consuming management and troubleshooting processes, ProSight WAN Watch can cut hours off ordinary tasks such as network mapping, reconfiguring your network, locating devices that require important software patches, or isolating performance issues. Find out more about ProSight WAN Watch network infrastructure monitoring and management services.

• ProSight Reporting: In-depth Reporting for Ticketing and Network Monitoring Platforms
  ProSight Reporting is a growing family of real-time and in-depth management reporting tools created to work with the industry's top ticketing and network monitoring programs such as ConnectWise Manage, ConnectWise Automate, Customer Thermometer, Auvik, and SentinelOne. ProSight Reporting uses Microsoft Graph and utilizes color coding to surface and contextualize critical issues such as spotty support follow-up or endpoints with missing patches. By exposing ticketing or network health concerns concisely and in near-real time, ProSight Reporting improves network value, reduces management hassle, and saves money. For details, visit ProSight Reporting for ticketing and network monitoring platforms.

• ProSight Data Protection Services (DPS): Backup and Disaster Recovery Services
  Progent has worked with leading backup/restore software companies to create ProSight Data Protection Services, a family of management outsourcing plans that deliver backup-as-a-service. ProSight DPS products automate and monitor your data backup operations and enable transparent backup and fast restoration of vital files/folders, applications, images, and Hyper-V and VMware virtual machines. ProSight DPS helps your business avoid data loss resulting from hardware failures, natural calamities, fire, cyber attacks such as ransomware, user error, ill-intentioned employees, or application glitches. Managed backup services available in the ProSight DPS product line include ProSight DPS Altaro VM Backup, ProSight 365 Total Backup (formerly Altaro 365 Backup), ProSight DPS ECHO Backup using Barracuda dedicated storage, and ProSight DPS MSP360 Hybrid Backup. Your Progent consultant can assist you to identify which of these managed backup services are best suited for your network.

• ProSight Email Guard: Inbound and Outbound Spam Filtering and Data Leakage Protection
  ProSight Email Guard is Progent's spam filtering service that incorporates the technology of leading data security companies to provide centralized management and comprehensive protection for all your email traffic. The powerful structure of Email Guard combines cloud-based filtering with a local security gateway device to provide advanced protection against spam, viruses, Denial of Service (DoS) Attacks, Directory Harvest Attacks, and other email-based threats. Email Guard's Cloud Protection Layer serves as a preliminary barricade and blocks most unwanted email from reaching your network firewall. This decreases your exposure to external attacks and conserves network bandwidth and storage space. Email Guard's on-premises security gateway device provides a deeper layer of inspection for inbound email. For outbound email, the local security gateway provides anti-virus and anti-spam protection, DLP, and email encryption. The on-premises security gateway can also assist Exchange Server to track and protect internal email that stays within your security perimeter. For more details, visit ProSight Email Guard spam and content filtering.

• ProSight Duo Two-Factor Authentication: Access Security, Endpoint Policy Enforcement, and Protected Single Sign-on (SSO)
  Progent's Duo MFA managed services utilize Cisco's Duo technology to protect against compromised passwords through the use of two-factor authentication (2FA). Duo enables single-tap identity confirmation on Apple iOS, Android, and other personal devices. Using 2FA, whenever you sign into a secured application and enter your password you are requested to confirm who you are via a device that only you have and that is accessed using a different ("out-of-band") network channel. A broad range of devices can be utilized for this added means of ID validation such as an iPhone or Android or watch, a hardware token, a landline telephone, etc. You may designate several verification devices. For more information about ProSight Duo two-factor identity authentication services, see Duo MFA two-factor authentication services.

• Outsourced/Co-managed Call Center: Support Desk Managed Services
  Progent's Help Center managed services permit your IT group to outsource Call Center services to Progent or divide responsibilities for Help Desk services seamlessly between your internal network support resources and Progent's nationwide pool of IT support technicians, engineers and subject matter experts. Progent's Co-managed Help Desk Service provides a seamless supplement to your corporate support organization. User access to the Help Desk, delivery of support, escalation, trouble ticket creation and tracking, efficiency metrics, and management of the service database are consistent regardless of whether incidents are resolved by your core network support resources, by Progent's team, or both. Find out more about Progent's outsourced/co-managed Help Center services.

• Active Protection Against Ransomware: Machine Learning-based Ransomware Identification and Cleanup
  Progent's Active Defense Against Ransomware is an endpoint protection managed service that utilizes next generation behavior-based analysis tools to defend endpoint devices and physical and virtual servers against modern malware attacks like ransomware and email phishing, which routinely escape legacy signature-matching anti-virus products. Progent Active Security Monitoring services safeguard local and cloud-based resources and offers a single platform to address the complete malware attack progression including protection, infiltration detection, containment, remediation, and forensics. Top capabilities include one-click rollback with Windows Volume Shadow Copy Service (VSS) and automatic network-wide immunization against newly discovered threats. Find out more about Progent's ransomware protection and recovery services.

• ProSight IT Asset Management: Network Documentation Management
  ProSight IT Asset Management service is a cloud-based IT documentation management service that makes it easy to create, update, find and protect data related to your network infrastructure, processes, applications, and services. You can quickly locate passwords or IP addresses and be warned automatically about impending expirations of SSL certificates ,domains or warranties. By updating and managing your network documentation, you can save as much as half of time thrown away searching for critical information about your IT network. ProSight IT Asset Management includes a centralized repository for holding and sharing all documents required for managing your network infrastructure such as standard operating procedures and self-service instructions. ProSight IT Asset Management also supports a high level of automation for collecting and relating IT data. Whether you're planning enhancements, performing regular maintenance, or reacting to an emergency, ProSight IT Asset Management gets you the knowledge you require as soon as you need it. Learn more about ProSight IT Asset Management service.

• Progent's Patch Management: Software/Firmware Update Management Services
  Progent's managed services for patch management offer businesses of any size a versatile and affordable solution for assessing, validating, scheduling, applying, and tracking software and firmware updates to your dynamic information system. Besides optimizing the security and reliability of your IT network, Progent's patch management services allow your in-house IT staff to concentrate on more strategic projects and tasks that deliver the highest business value from your information network. Find out more about Progent's patch management support services.

• ProSight Virtual Hosting: Hosted VMs at Progent's World-class Data Center
  With ProSight Virtual Hosting service, a small organization can have its key servers and applications hosted in a secure Tier III data center on a high-performance virtual host configured and maintained by Progent's IT support experts. With Progent's ProSight Virtual Hosting service model, the customer owns the data, the operating system software, and the apps. Because the environment is virtualized, it can be moved easily to a different hosting solution without a lengthy and difficult configuration process. With ProSight Virtual Hosting, your business is not locked into one hosting service. Find out more about ProSight Virtual Hosting services.

• ProSight Active Security Monitoring: Endpoint Protection and Ransomware Defense
  ProSight Active Security Monitoring (ASM) is an endpoint protection service that utilizes SentinelOne's next generation behavior-based analysis technology to defend physical and virtual endpoints against modern malware assaults like ransomware and file-less exploits, which routinely evade traditional signature-matching anti-virus tools. ProSight ASM safeguards on-premises and cloud-based resources and provides a single platform to address the entire malware attack lifecycle including blocking, infiltration detection, containment, remediation, and forensics. Key features include one-click rollback with Windows VSS and automatic system-wide immunization against newly discovered attacks. Progent is a SentinelOne Partner, reseller, and integrator. Find out more about Progent's ProSight Active Security Monitoring endpoint protection and ransomware defense.

• ProSight Enhanced Security Protection (ESP): Endpoint Protection and Microsoft Exchange Filtering
  Progent's ProSight Enhanced Security Protection (ESP) services deliver economical in-depth security for physical servers and VMs, workstations, mobile devices, and Exchange Server. ProSight ESP utilizes contextual security and modern behavior analysis for continuously monitoring and reacting to cyber assaults from all attack vectors. ProSight ESP provides firewall protection, intrusion alarms, device control, and web filtering through leading-edge tools packaged within one agent managed from a unified console. Progent's security and virtualization experts can assist you to design and configure a ProSight ESP environment that meets your organization's unique needs and that allows you demonstrate compliance with government and industry data security standards. Progent will assist you define and configure security policies that ProSight ESP will manage, and Progent will monitor your network and respond to alarms that require urgent attention. Progent's consultants can also assist you to install and verify a backup and restore system such as ProSight Data Protection Services (DPS) so you can get back in business quickly from a destructive cyber attack such as ransomware. Learn more about Progent's ProSight Enhanced Security Protection (ESP) unified physical and virtual endpoint security and Exchange filtering.