Ransomware : Your Crippling IT Catastrophe
Ransomware Remediation ConsultantsCrypto-Ransomware has become a modern cyber pandemic that represents an enterprise-level danger for organizations vulnerable to an assault. Multiple generations of ransomware such as CrySIS, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for years and continue to inflict destruction. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, as well as frequent unnamed malware, not only perform encryption of on-line files but also infect many available system backup. Data synched to cloud environments can also be encrypted. In a poorly architected environment, it can render automatic restore operations impossible and effectively sets the network back to square one.

Recovering programs and data after a crypto-ransomware outage becomes a sprint against the clock as the victim struggles to contain the damage, eradicate the crypto-ransomware, and resume enterprise-critical activity. Because ransomware takes time to move laterally throughout a network, attacks are frequently sprung during nights and weekends, when successful attacks are likely to take more time to identify. This multiplies the difficulty of rapidly mobilizing and organizing a capable mitigation team.

Progent has a variety of help services for securing Anaheim enterprises from crypto-ransomware events. Among these are user training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to detect and suppress zero-day malware assaults. Progent in addition offers the services of seasoned ransomware recovery engineers with the track record and commitment to re-deploy a breached system as urgently as possible.

Progent's Ransomware Restoration Help
Soon after a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not ensure that cyber criminals will provide the needed keys to decrypt all your files. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to setup from scratch the mission-critical components of your Information Technology environment. Absent access to complete information backups, this calls for a broad range of skills, top notch team management, and the capability to work continuously until the job is done.

For two decades, Progent has offered expert IT services for businesses throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have garnered internationally-recognized certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP applications. This breadth of expertise affords Progent the capability to knowledgably identify necessary systems and consolidate the remaining pieces of your computer network system after a crypto-ransomware attack and assemble them into an operational system.

Progent's ransomware group uses best of breed project management tools to coordinate the complex recovery process. Progent knows the importance of acting rapidly and in concert with a client's management and Information Technology staff to prioritize tasks and to get key services back on-line as fast as possible.

Client Story: A Successful Ransomware Attack Response
A customer engaged Progent after their company was taken over by Ryuk ransomware. Ryuk is generally considered to have been launched by North Korean government sponsored hackers, suspected of using technology leaked from America's NSA organization. Ryuk targets specific companies with little tolerance for disruption and is one of the most profitable examples of ransomware viruses. Major targets include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturer headquartered in the Chicago metro area with around 500 workers. The Ryuk intrusion had disabled all business operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the time of the intrusion and were destroyed. The client considered paying the ransom demand (more than $200,000) and wishfully thinking for the best, but ultimately utilized Progent.

"I cannot tell you enough in regards to the support Progent provided us throughout the most critical time of (our) company's life. We most likely would have paid the cyber criminals behind the attack if it wasn't for the confidence the Progent experts provided us. That you could get our messaging and essential applications back online quicker than five days was earth shattering. Every single expert I talked with or messaged at Progent was laser focused on getting us back on-line and was working all day and night on our behalf."

Progent worked hand in hand the customer to rapidly identify and prioritize the key systems that needed to be addressed to make it possible to continue departmental operations:

  • Active Directory
  • Microsoft Exchange Server
  • MRP System
To get going, Progent adhered to AV/Malware Processes incident response best practices by stopping lateral movement and cleaning systems of viruses. Progent then initiated the work of rebuilding Microsoft AD, the heart of enterprise systems built upon Microsoft Windows Server technology. Microsoft Exchange Server email will not operate without Active Directory, and the customer's MRP software used Microsoft SQL Server, which requires Active Directory services for security authorization to the data.

Within 2 days, Progent was able to rebuild Windows Active Directory to its pre-virus state. Progent then helped perform reinstallations and storage recovery of critical applications. All Exchange ties and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to collect intact OST files (Microsoft Outlook Off-Line Folder Files) on user desktop computers and laptops in order to recover mail data. A recent off-line backup of the client's financials/MRP systems made them able to return these essential applications back online. Although major work still had to be done to recover completely from the Ryuk attack, critical services were recovered quickly:

"For the most part, the manufacturing operation was never shut down and we did not miss any customer shipments."

Throughout the next couple of weeks critical milestones in the recovery process were accomplished in close cooperation between Progent team members and the customer:

  • Internal web sites were brought back up with no loss of data.
  • The MailStore Exchange Server with over 4 million historical messages was spun up and accessible to users.
  • CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control capabilities were fully recovered.
  • A new Palo Alto 850 security appliance was installed.
  • Nearly all of the user PCs were back into operation.
"A lot of what occurred in the early hours is nearly entirely a haze for me, but our team will not soon forget the commitment each and every one of you put in to help get our business back. I've been working with Progent for the past ten years, maybe more, and each time I needed help Progent has impressed me and delivered. This time was a Herculean accomplishment."

Conclusion
A possible business extinction catastrophe was avoided by results-oriented experts, a wide spectrum of technical expertise, and close teamwork. Although in hindsight the ransomware penetration described here would have been shut down with current security solutions and recognized best practices, team education, and well designed incident response procedures for data protection and applying software patches, the reality remains that government-sponsored hackers from Russia, North Korea and elsewhere are relentless and are not going away. If you do fall victim to a ransomware incident, remember that Progent's team of experts has a proven track record in ransomware virus defense, cleanup, and file restoration.

"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were contributing), thank you for letting me get rested after we made it through the most critical parts. Everyone did an fabulous effort, and if anyone is visiting the Chicago area, dinner is the least I can do!"

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Anaheim
For ransomware cleanup consulting in the Anaheim area, phone Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.