Crypto-Ransomware : Your Worst IT Nightmare
Crypto-Ransomware Recovery ConsultantsCrypto-Ransomware has become a modern cyber pandemic that poses an enterprise-level danger for businesses vulnerable to an attack. Different iterations of ransomware like the Dharma, Fusob, Locky, NotPetya and MongoLock cryptoworms have been replicating for years and still inflict havoc. Modern variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, plus daily as yet unnamed viruses, not only perform encryption of online data files but also infect all available system protection mechanisms. Information synchronized to off-premises disaster recovery sites can also be rendered useless. In a poorly architected system, it can make any restoration hopeless and effectively sets the datacenter back to square one.

Retrieving applications and information after a crypto-ransomware outage becomes a sprint against time as the targeted organization fights to stop the spread, eradicate the virus, and restore enterprise-critical operations. Due to the fact that ransomware takes time to move laterally throughout a targeted network, penetrations are frequently launched during nights and weekends, when penetrations are likely to take longer to detect. This multiplies the difficulty of quickly assembling and coordinating a capable response team.

Progent makes available an assortment of solutions for securing Charleston enterprises from crypto-ransomware attacks. Among these are team training to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to identify and disable zero-day malware assaults. Progent also offers the services of seasoned crypto-ransomware recovery professionals with the skills and perseverance to restore a breached network as rapidly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Soon after a ransomware event, paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will return the codes to decrypt any of your files. Kaspersky Labs estimated that 17% of ransomware victims never restored their information after having sent off the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The other path is to re-install the vital elements of your IT environment. Absent access to essential system backups, this requires a wide complement of IT skills, professional project management, and the capability to work 24x7 until the recovery project is finished.

For two decades, Progent has offered expert Information Technology services for businesses throughout the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have been awarded high-level certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security consultants have earned internationally-recognized industry certifications including CISA, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has expertise with financial management and ERP applications. This breadth of expertise gives Progent the capability to rapidly understand important systems and consolidate the remaining pieces of your Information Technology system after a ransomware attack and assemble them into an operational network.

Progent's security team of experts uses top notch project management systems to orchestrate the complicated recovery process. Progent appreciates the importance of acting quickly and in unison with a customer's management and IT team members to prioritize tasks and to get critical services back on-line as soon as possible.

Customer Case Study: A Successful Ransomware Incident Recovery
A business sought out Progent after their network was attacked by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored criminal gangs, possibly using approaches leaked from the U.S. National Security Agency. Ryuk attacks specific businesses with little or no tolerance for operational disruption and is one of the most profitable versions of ransomware viruses. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing business located in Chicago with about 500 workers. The Ryuk intrusion had shut down all essential operations and manufacturing processes. The majority of the client's system backups had been on-line at the start of the attack and were encrypted. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and hoping for the best, but in the end called Progent.

"I can't say enough in regards to the expertise Progent provided us throughout the most fearful time of (our) company's existence. We most likely would have paid the hackers behind this attack if it wasn't for the confidence the Progent team afforded us. The fact that you could get our e-mail and critical servers back into operation in less than five days was incredible. Every single staff member I interacted with or e-mailed at Progent was amazingly focused on getting us operational and was working all day and night to bail us out."

Progent worked together with the customer to quickly determine and assign priority to the key elements that had to be addressed in order to restart business operations:

  • Windows Active Directory
  • Microsoft Exchange Server
  • MRP System
To begin, Progent followed Anti-virus event mitigation best practices by stopping the spread and clearing infected systems. Progent then initiated the process of rebuilding Windows Active Directory, the core of enterprise systems built upon Microsoft Windows Server technology. Exchange messaging will not function without Active Directory, and the client's financials and MRP applications leveraged Microsoft SQL, which requires Active Directory for access to the data.

Within 48 hours, Progent was able to re-build Active Directory services to its pre-attack state. Progent then completed rebuilding and storage recovery on essential servers. All Microsoft Exchange Server data and configuration information were intact, which facilitated the restore of Exchange. Progent was able to locate intact OST files (Microsoft Outlook Offline Data Files) on various workstations and laptops to recover email information. A not too old offline backup of the businesses financials/MRP systems made them able to recover these vital programs back on-line. Although major work was left to recover fully from the Ryuk damage, critical services were recovered quickly:

"For the most part, the production manufacturing operation did not miss a beat and we delivered all customer deliverables."

Over the next couple of weeks critical milestones in the recovery project were completed in tight collaboration between Progent team members and the customer:

  • Internal web applications were restored without losing any data.
  • The MailStore Exchange Server with over 4 million archived messages was restored to operations and accessible to users.
  • CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory capabilities were completely recovered.
  • A new Palo Alto Networks 850 firewall was brought online.
  • Most of the desktop computers were functioning as before the incident.
"Much of what was accomplished that first week is nearly entirely a haze for me, but my team will not forget the dedication all of you put in to give us our company back. I've been working with Progent for the past ten years, possibly more, and each time I needed help Progent has shined and delivered as promised. This time was the most impressive ever."

Conclusion
A possible company-ending disaster was evaded through the efforts of hard-working experts, a wide array of knowledge, and tight teamwork. Although in analyzing the event afterwards the ransomware virus attack described here would have been identified and prevented with up-to-date security technology solutions and security best practices, user education, and well thought out incident response procedures for information protection and proper patching controls, the reality is that government-sponsored cyber criminals from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware virus, remember that Progent's team of experts has extensive experience in ransomware virus blocking, cleanup, and file disaster recovery.

"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were contributing), thank you for letting me get rested after we made it through the first week. Everyone did an incredible effort, and if any of your team is in the Chicago area, a great meal is the least I can do!"

Download the Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Charleston
For ransomware recovery expertise in the Charleston metro area, phone Progent at 800-462-8800 or go to Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.