Ransomware : Your Feared IT Disaster
Ransomware Recovery ProfessionalsRansomware has become an escalating cyberplague that represents an extinction-level threat for organizations vulnerable to an attack. Different versions of ransomware like the Reveton, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and still inflict destruction. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, along with more unnamed newcomers, not only encrypt on-line files but also infiltrate any available system protection. Data synched to off-premises disaster recovery sites can also be rendered useless. In a poorly architected data protection solution, it can make any restore operations hopeless and effectively knocks the datacenter back to square one.

Getting back on-line applications and information after a ransomware attack becomes a sprint against time as the targeted business tries its best to stop lateral movement, eradicate the ransomware, and resume enterprise-critical operations. Because crypto-ransomware needs time to replicate throughout a network, assaults are frequently sprung on weekends and holidays, when penetrations typically take more time to uncover. This compounds the difficulty of promptly marshalling and organizing a qualified response team.

Progent offers a variety of services for securing Columbus enterprises from ransomware events. Among these are team training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat protection to discover and quarantine day-zero modern malware attacks. Progent in addition can provide the assistance of expert crypto-ransomware recovery professionals with the talent and commitment to reconstruct a compromised environment as urgently as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware penetration, sending the ransom demands in cryptocurrency does not ensure that cyber hackers will respond with the codes to unencrypt any or all of your data. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to setup from scratch the essential components of your IT environment. Without the availability of essential system backups, this calls for a broad complement of IT skills, well-coordinated team management, and the ability to work continuously until the job is completed.

For twenty years, Progent has made available professional IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes consultants who have been awarded high-level industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity engineers have earned internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with accounting and ERP applications. This breadth of experience affords Progent the skills to efficiently ascertain necessary systems and consolidate the remaining components of your Information Technology environment following a ransomware penetration and assemble them into an operational system.

Progent's recovery team of experts utilizes state-of-the-art project management applications to orchestrate the sophisticated restoration process. Progent knows the importance of working quickly and in unison with a customer's management and IT team members to assign priority to tasks and to get key systems back on-line as fast as possible.

Client Story: A Successful Crypto-Ransomware Incident Response
A customer contacted Progent after their company was brought down by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean state hackers, suspected of adopting technology exposed from the United States NSA organization. Ryuk attacks specific companies with little room for operational disruption and is one of the most lucrative incarnations of ransomware. High publicized targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturer headquartered in the Chicago metro area and has about 500 staff members. The Ryuk penetration had paralyzed all essential operations and manufacturing capabilities. The majority of the client's system backups had been on-line at the start of the attack and were damaged. The client was evaluating paying the ransom demand (exceeding two hundred thousand dollars) and hoping for the best, but ultimately reached out to Progent.

"I cannot thank you enough in regards to the care Progent provided us throughout the most critical period of (our) company's survival. We most likely would have paid the cyber criminals behind the attack if not for the confidence the Progent team provided us. That you were able to get our messaging and critical applications back online in less than five days was amazing. Every single person I talked with or e-mailed at Progent was hell bent on getting our system up and was working day and night to bail us out."

Progent worked with the client to quickly determine and assign priority to the key systems that needed to be addressed in order to resume business functions:

  • Active Directory (AD)
  • Exchange Server
  • MRP System
To get going, Progent followed AV/Malware Processes event mitigation industry best practices by stopping lateral movement and clearing up compromised systems. Progent then started the process of bringing back online Microsoft AD, the foundation of enterprise networks built upon Microsoft technology. Microsoft Exchange messaging will not work without AD, and the businesses' financials and MRP system used SQL Server, which needs Active Directory for authentication to the database.

Within 2 days, Progent was able to recover Windows Active Directory to its pre-attack state. Progent then performed reinstallations and hard drive recovery of key servers. All Microsoft Exchange Server ties and configuration information were usable, which greatly helped the rebuild of Exchange. Progent was able to collect local OST data files (Outlook Off-Line Folder Files) on various desktop computers to recover email information. A recent offline backup of the businesses financials/ERP systems made them able to restore these vital services back available to users. Although a large amount of work still had to be done to recover completely from the Ryuk virus, essential systems were restored quickly:

"For the most part, the production line operation did not miss a beat and we produced all customer shipments."

Over the following month important milestones in the restoration project were made through close collaboration between Progent consultants and the client:

  • In-house web applications were restored with no loss of information.
  • The MailStore Exchange Server with over four million historical emails was brought online and accessible to users.
  • CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory modules were completely operational.
  • A new Palo Alto Networks 850 firewall was brought on-line.
  • 90% of the desktop computers were being used by staff.
"So much of what occurred that first week is mostly a blur for me, but my management will not soon forget the commitment each and every one of the team put in to give us our business back. I have been working with Progent for the past ten years, possibly more, and every time Progent has impressed me and delivered. This time was a testament to your capabilities."

Conclusion
A possible business disaster was avoided by results-oriented experts, a wide range of IT skills, and close collaboration. Although in hindsight the ransomware virus penetration described here should have been stopped with advanced cyber security technology and ISO/IEC 27001 best practices, team education, and well thought out incident response procedures for data backup and proper patching controls, the fact remains that state-sponsored cybercriminals from China, North Korea and elsewhere are relentless and will continue. If you do fall victim to a ransomware incident, remember that Progent's team of professionals has extensive experience in crypto-ransomware virus blocking, removal, and file disaster recovery.

"So, to Darrin, Matt, Aaron, Dan, Jesse, Arnaud, Allen, Tony and Chris (and any others that were helping), thanks very much for letting me get some sleep after we made it past the most critical parts. All of you did an incredible effort, and if any of your team is visiting the Chicago area, a great meal is the least I can do!"

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Columbus
For ransomware system restoration consulting in the Columbus metro area, phone Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.