Ransomware : Your Crippling IT Catastrophe
Ransomware Remediation ProfessionalsCrypto-Ransomware has become an escalating cyberplague that represents an extinction-level threat for organizations vulnerable to an assault. Different iterations of crypto-ransomware such as Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been around for a long time and still inflict destruction. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, along with more as yet unnamed malware, not only encrypt on-line critical data but also infiltrate any accessible system backup. Files synchronized to off-premises disaster recovery sites can also be corrupted. In a poorly architected environment, it can make automated restore operations impossible and basically knocks the network back to zero.

Getting back on-line programs and data after a ransomware event becomes a sprint against the clock as the victim struggles to stop lateral movement, clear the ransomware, and resume mission-critical operations. Since ransomware requires time to spread throughout a network, attacks are usually launched at night, when successful penetrations tend to take longer to uncover. This compounds the difficulty of promptly assembling and orchestrating a qualified response team.

Progent offers a range of support services for securing Buffalo enterprises from ransomware penetrations. Among these are team member education to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based threat protection to identify and suppress day-zero modern malware attacks. Progent in addition offers the services of seasoned crypto-ransomware recovery engineers with the track record and commitment to reconstruct a compromised system as quickly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a crypto-ransomware penetration, sending the ransom demands in cryptocurrency does not guarantee that cyber criminals will respond with the keys to decrypt any or all of your files. Kaspersky Labs estimated that 17% of ransomware victims never recovered their information after having paid the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions of dollars. The other path is to piece back together the vital parts of your IT environment. Absent access to full information backups, this requires a broad range of skill sets, professional project management, and the capability to work 24x7 until the recovery project is complete.

For decades, Progent has made available expert Information Technology services for companies across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have been awarded high-level industry certifications in leading technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP application software. This breadth of expertise provides Progent the capability to efficiently determine important systems and re-organize the surviving parts of your Information Technology system after a ransomware attack and assemble them into an operational network.

Progent's security team of experts has top notch project management systems to orchestrate the sophisticated restoration process. Progent appreciates the importance of working swiftly and together with a client's management and IT team members to prioritize tasks and to put essential services back online as fast as humanly possible.

Customer Story: A Successful Crypto-Ransomware Virus Restoration
A small business escalated to Progent after their network system was brought down by the Ryuk ransomware. Ryuk is thought to have been deployed by North Korean government sponsored hackers, suspected of adopting strategies leaked from the United States NSA organization. Ryuk goes after specific companies with little room for operational disruption and is one of the most lucrative instances of crypto-ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company based in the Chicago metro area with around 500 staff members. The Ryuk event had frozen all company operations and manufacturing capabilities. The majority of the client's information backups had been directly accessible at the time of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom demand (in excess of two hundred thousand dollars) and praying for the best, but ultimately brought in Progent.

"I cannot speak enough about the support Progent gave us during the most stressful time of (our) businesses existence. We most likely would have paid the criminal gangs if not for the confidence the Progent group gave us. That you could get our messaging and key servers back on-line sooner than a week was amazing. Each expert I got help from or e-mailed at Progent was hell bent on getting our system up and was working 24/7 on our behalf."

Progent worked together with the customer to quickly understand and prioritize the mission critical applications that had to be restored in order to continue business operations:

  • Active Directory (AD)
  • Exchange Server
  • Financials/MRP
To begin, Progent adhered to AV/Malware Processes event mitigation best practices by stopping the spread and disinfecting systems. Progent then initiated the work of recovering Microsoft Active Directory, the foundation of enterprise networks built on Microsoft technology. Exchange email will not operate without Active Directory, and the customer's financials and MRP software utilized Microsoft SQL, which needs Windows AD for security authorization to the databases.

Within 48 hours, Progent was able to restore Active Directory to its pre-virus state. Progent then helped perform rebuilding and hard drive recovery on essential servers. All Exchange Server data and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to locate non-encrypted OST data files (Outlook Email Off-Line Data Files) on team PCs and laptops in order to recover mail messages. A recent off-line backup of the businesses accounting systems made them able to restore these vital programs back available to users. Although major work needed to be completed to recover completely from the Ryuk virus, essential systems were recovered rapidly:

"For the most part, the manufacturing operation did not miss a beat and we delivered all customer shipments."

Over the following few weeks important milestones in the recovery project were accomplished in close collaboration between Progent consultants and the client:

  • Self-hosted web applications were returned to operation with no loss of data.
  • The MailStore Server containing more than 4 million archived emails was brought on-line and available for users.
  • CRM/Product Ordering/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were fully operational.
  • A new Palo Alto 850 firewall was installed and configured.
  • 90% of the user workstations were fully operational.
"So much of what happened that first week is nearly entirely a blur for me, but our team will not soon forget the care all of the team put in to give us our business back. I have been working together with Progent for the past 10 years, maybe more, and every time I needed help Progent has impressed me and delivered. This time was a Herculean accomplishment."

Conclusion
A possible enterprise-killing disaster was dodged by results-oriented professionals, a wide array of technical expertise, and tight collaboration. Although in analyzing the event afterwards the ransomware virus penetration detailed here would have been prevented with up-to-date cyber security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator education, and appropriate incident response procedures for data protection and proper patching controls, the fact is that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware attack, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, removal, and file recovery.

"So, to Darrin, Matt, Aaron, Dan, Jesse, Arnaud, Allen, Tony and Chris (along with others that were involved), thanks very much for making it so I could get rested after we got through the initial push. All of you did an incredible job, and if anyone that helped is visiting the Chicago area, a great meal is the least I can do!"

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Buffalo
For ransomware cleanup services in the Buffalo metro area, call Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.