Ransomware : Your Worst IT Disaster
Ransomware Recovery ConsultantsRansomware has become an escalating cyberplague that poses an enterprise-level threat for businesses vulnerable to an attack. Different versions of ransomware like the Dharma, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been replicating for years and continue to cause harm. Newer variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, plus more as yet unnamed viruses, not only perform encryption of on-line data but also infect all configured system protection. Files replicated to the cloud can also be rendered useless. In a vulnerable system, it can render any restore operations hopeless and effectively sets the datacenter back to square one.

Recovering programs and data after a crypto-ransomware outage becomes a race against time as the targeted organization struggles to contain, clear the crypto-ransomware, and resume business-critical activity. Since ransomware takes time to spread across a network, attacks are frequently launched at night, when successful penetrations typically take more time to identify. This compounds the difficulty of rapidly marshalling and organizing a capable response team.

Progent has a variety of solutions for securing Belo Horizonte organizations from ransomware attacks. These include staff training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to identify and suppress zero-day modern malware attacks. Progent in addition offers the services of seasoned ransomware recovery engineers with the skills and perseverance to reconstruct a compromised network as urgently as possible.

Progent's Ransomware Recovery Help
After a ransomware invasion, even paying the ransom in cryptocurrency does not ensure that merciless criminals will respond with the needed codes to decrypt any of your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can reach millions of dollars. The fallback is to setup from scratch the key elements of your IT environment. Without the availability of essential information backups, this calls for a wide complement of IT skills, top notch team management, and the ability to work continuously until the job is complete.

For twenty years, Progent has made available certified expert Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded advanced certifications in important technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have garnered internationally-renowned certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in accounting and ERP software solutions. This breadth of expertise affords Progent the ability to efficiently identify critical systems and re-organize the remaining components of your computer network environment following a crypto-ransomware attack and rebuild them into an operational network.

Progent's security team utilizes powerful project management applications to coordinate the complicated restoration process. Progent knows the importance of acting rapidly and together with a customer's management and IT resources to prioritize tasks and to get key systems back on-line as soon as possible.

Customer Case Study: A Successful Crypto-Ransomware Incident Restoration
A small business sought out Progent after their company was crashed by Ryuk ransomware virus. Ryuk is thought to have been created by North Korean state sponsored hackers, suspected of using strategies exposed from the United States NSA organization. Ryuk goes after specific companies with little or no tolerance for disruption and is one of the most lucrative instances of ransomware. Headline targets include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer headquartered in the Chicago metro area and has about 500 staff members. The Ryuk intrusion had disabled all business operations and manufacturing capabilities. Most of the client's system backups had been on-line at the start of the intrusion and were damaged. The client considered paying the ransom demand (exceeding two hundred thousand dollars) and hoping for the best, but ultimately reached out to Progent.

"I cannot thank you enough about the care Progent provided us throughout the most critical time of (our) company's existence. We had little choice but to pay the cyber criminals if not for the confidence the Progent group afforded us. That you were able to get our e-mail system and essential applications back into operation in less than one week was incredible. Each consultant I worked with or e-mailed at Progent was urgently focused on getting us working again and was working at all hours on our behalf."

Progent worked with the customer to rapidly get our arms around and prioritize the most important systems that needed to be addressed to make it possible to continue business operations:

  • Active Directory (AD)
  • Electronic Mail
  • Accounting and Manufacturing Software
To get going, Progent adhered to AV/Malware Processes incident response industry best practices by halting the spread and clearing infected systems. Progent then began the task of restoring Microsoft Active Directory, the heart of enterprise networks built upon Microsoft Windows technology. Microsoft Exchange Server messaging will not function without Active Directory, and the customer's MRP system utilized SQL Server, which depends on Windows AD for access to the databases.

Within 2 days, Progent was able to re-build Windows Active Directory to its pre-intrusion state. Progent then initiated rebuilding and storage recovery of mission critical systems. All Exchange Server schema and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was able to find non-encrypted OST files (Outlook Email Offline Data Files) on staff PCs and laptops to recover mail information. A not too old off-line backup of the client's financials/ERP systems made it possible to restore these essential programs back online for users. Although significant work still had to be done to recover fully from the Ryuk attack, core systems were returned to operations rapidly:

"For the most part, the production manufacturing operation never missed a beat and we delivered all customer deliverables."

Throughout the next month important milestones in the restoration process were accomplished through tight collaboration between Progent team members and the client:

  • Internal web sites were returned to operation without losing any data.
  • The MailStore Server containing more than 4 million archived messages was brought online and accessible to users.
  • CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory functions were completely restored.
  • A new Palo Alto 850 firewall was installed and configured.
  • Ninety percent of the user desktops and notebooks were operational.
"A huge amount of what was accomplished in the initial days is mostly a fog for me, but I will not forget the urgency each of your team put in to help get our business back. I've been working with Progent for at least 10 years, possibly more, and each time Progent has impressed me and delivered as promised. This time was no exception but maybe more Herculean."

Conclusion
A potential business extinction disaster was averted due to hard-working experts, a wide spectrum of technical expertise, and tight teamwork. Although in analyzing the event afterwards the ransomware incident described here could have been blocked with advanced cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff training, and well designed security procedures for data backup and applying software patches, the fact is that state-sponsored cyber criminals from Russia, China and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware virus, remember that Progent's team of experts has extensive experience in ransomware virus defense, cleanup, and data restoration.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen and Tony (and any others that were involved), thanks very much for making it so I could get rested after we got over the most critical parts. Everyone did an fabulous effort, and if any of your team is visiting the Chicago area, dinner is on me!"

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Expertise in Belo Horizonte
For ransomware system restoration services in the Belo Horizonte metro area, call Progent at 800-462-8800 or go to Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.