Ransomware : Your Crippling Information Technology Nightmare
Crypto-Ransomware Remediation ProfessionalsCrypto-Ransomware has become a too-frequent cyberplague that presents an existential danger for businesses of all sizes poorly prepared for an attack. Multiple generations of crypto-ransomware such as Reveton, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and still inflict havoc. Newer variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, plus daily unnamed malware, not only encrypt on-line files but also infect most accessible system backups. Data replicated to cloud environments can also be corrupted. In a poorly architected environment, it can render automatic recovery impossible and effectively sets the entire system back to square one.

Restoring services and information following a crypto-ransomware attack becomes a race against the clock as the victim struggles to stop lateral movement, eradicate the ransomware, and restore enterprise-critical operations. Since ransomware takes time to replicate across a targeted network, assaults are often sprung during nights and weekends, when attacks tend to take longer to uncover. This compounds the difficulty of rapidly assembling and coordinating a qualified mitigation team.

Progent provides an assortment of help services for securing Southfield organizations from crypto-ransomware events. These include team member education to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat defense to detect and extinguish zero-day malware assaults. Progent also can provide the services of seasoned ransomware recovery engineers with the skills and perseverance to rebuild a compromised system as soon as possible.

Progent's Ransomware Restoration Services
Following a ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will return the codes to decipher any of your files. Kaspersky Labs estimated that seventeen percent of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to re-install the key elements of your Information Technology environment. Without the availability of complete data backups, this requires a broad range of skills, well-coordinated team management, and the ability to work continuously until the job is completed.

For decades, Progent has offered certified expert IT services for companies across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have earned advanced industry certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have garnered internationally-recognized certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in financial systems and ERP software solutions. This breadth of experience affords Progent the ability to rapidly determine critical systems and organize the surviving pieces of your IT system after a crypto-ransomware penetration and rebuild them into a functioning system.

Progent's recovery team deploys state-of-the-art project management systems to orchestrate the sophisticated recovery process. Progent knows the importance of working quickly and in unison with a client's management and Information Technology resources to prioritize tasks and to put key systems back online as soon as humanly possible.

Business Case Study: A Successful Ransomware Penetration Restoration
A small business escalated to Progent after their network was brought down by the Ryuk ransomware. Ryuk is thought to have been deployed by North Korean government sponsored criminal gangs, suspected of using technology exposed from America's NSA organization. Ryuk targets specific businesses with little tolerance for disruption and is one of the most lucrative iterations of ransomware viruses. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturer located in the Chicago metro area with about 500 employees. The Ryuk attack had paralyzed all business operations and manufacturing processes. The majority of the client's backups had been directly accessible at the beginning of the attack and were eventually encrypted. The client considered paying the ransom demand (in excess of $200K) and praying for good luck, but ultimately brought in Progent.

"I cannot speak enough in regards to the care Progent provided us throughout the most stressful period of (our) company's existence. We most likely would have paid the cyber criminals if not for the confidence the Progent experts afforded us. The fact that you were able to get our messaging and essential servers back faster than one week was beyond my wildest dreams. Each expert I spoke to or e-mailed at Progent was amazingly focused on getting our system up and was working day and night on our behalf."

Progent worked hand in hand the customer to quickly get our arms around and prioritize the most important elements that needed to be restored in order to resume business functions:

  • Windows Active Directory
  • Email
  • Financials/MRP
To get going, Progent adhered to Anti-virus penetration mitigation best practices by halting lateral movement and clearing up compromised systems. Progent then began the process of rebuilding Windows Active Directory, the foundation of enterprise networks built upon Microsoft Windows technology. Microsoft Exchange messaging will not operate without AD, and the client's MRP system utilized Microsoft SQL Server, which requires Active Directory for access to the data.

In less than 48 hours, Progent was able to restore Windows Active Directory to its pre-penetration state. Progent then assisted with rebuilding and storage recovery of critical applications. All Exchange Server data and configuration information were usable, which facilitated the restore of Exchange. Progent was able to find intact OST files (Outlook Off-Line Data Files) on team desktop computers and laptops to recover email messages. A recent off-line backup of the customer's accounting/MRP software made them able to restore these vital programs back available to users. Although a lot of work still had to be done to recover completely from the Ryuk event, the most important services were recovered rapidly:

"For the most part, the production operation was never shut down and we produced all customer sales."

Over the following few weeks critical milestones in the recovery process were achieved in close collaboration between Progent team members and the customer:

  • Self-hosted web applications were returned to operation without losing any information.
  • The MailStore Server with over 4 million archived emails was brought online and available for users.
  • CRM/Orders/Invoicing/Accounts Payable/AR/Inventory Control functions were fully operational.
  • A new Palo Alto Networks 850 security appliance was set up and programmed.
  • Most of the user desktops and notebooks were being used by staff.
"Much of what transpired in the initial days is nearly entirely a blur for me, but my team will not soon forget the countless hours each of the team put in to give us our company back. I've utilized Progent for at least 10 years, maybe more, and every time I needed help Progent has outperformed my expectations and delivered as promised. This situation was a Herculean accomplishment."

Conclusion
A probable business catastrophe was avoided due to results-oriented experts, a broad spectrum of subject matter expertise, and tight teamwork. Although in analyzing the event afterwards the crypto-ransomware incident detailed here would have been stopped with current security technology and best practices, staff education, and appropriate incident response procedures for information backup and proper patching controls, the reality remains that state-sponsored hackers from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's team of professionals has extensive experience in ransomware virus blocking, remediation, and information systems recovery.

"So, to Darrin, Matt, Aaron, Dan, Jesse, Arnaud, Allen, Tony and Chris (along with others that were involved), I'm grateful for allowing me to get some sleep after we got through the first week. Everyone did an incredible effort, and if any of your team is in the Chicago area, dinner is my treat!"

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Southfield
For ransomware cleanup consulting in the Southfield metro area, phone Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.