Crypto-Ransomware : Your Feared IT Nightmare
Ransomware Remediation ProfessionalsRansomware has become a too-frequent cyber pandemic that presents an enterprise-level danger for businesses vulnerable to an attack. Versions of ransomware such as CrySIS, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for years and continue to inflict destruction. More recent variants of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as daily as yet unnamed viruses, not only perform encryption of on-line data files but also infect many configured system backups. Files synchronized to the cloud can also be corrupted. In a poorly designed system, it can render automated restore operations hopeless and basically knocks the datacenter back to square one.

Getting back online applications and data following a ransomware attack becomes a sprint against the clock as the targeted business struggles to stop the spread, clear the ransomware, and resume mission-critical activity. Because ransomware requires time to spread throughout a network, assaults are usually sprung on weekends and holidays, when successful attacks may take longer to recognize. This multiplies the difficulty of promptly marshalling and coordinating a qualified response team.

Progent offers a variety of solutions for protecting Des Moines organizations from crypto-ransomware attacks. These include team member education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based threat protection to detect and disable day-zero modern malware assaults. Progent in addition offers the services of seasoned crypto-ransomware recovery engineers with the talent and perseverance to restore a compromised system as quickly as possible.

Progent's Ransomware Recovery Support Services
Following a crypto-ransomware event, paying the ransom demands in cryptocurrency does not ensure that distant criminals will return the codes to unencrypt any of your files. Kaspersky estimated that seventeen percent of ransomware victims never restored their data even after having paid the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to piece back together the critical components of your IT environment. Without the availability of complete information backups, this requires a broad complement of skill sets, well-coordinated project management, and the ability to work continuously until the task is complete.

For two decades, Progent has made available certified expert Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded high-level certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of experience provides Progent the skills to knowledgably ascertain necessary systems and integrate the remaining components of your network system after a crypto-ransomware penetration and configure them into an operational system.

Progent's security team deploys best of breed project management systems to orchestrate the sophisticated recovery process. Progent knows the urgency of acting quickly and together with a customer's management and IT team members to prioritize tasks and to get the most important applications back on-line as fast as humanly possible.

Customer Story: A Successful Ransomware Intrusion Response
A customer sought out Progent after their network system was taken over by Ryuk ransomware virus. Ryuk is thought to have been created by North Korean government sponsored hackers, suspected of adopting algorithms leaked from America's NSA organization. Ryuk attacks specific businesses with little or no ability to sustain operational disruption and is among the most profitable instances of ransomware viruses. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company based in the Chicago metro area and has about 500 employees. The Ryuk event had disabled all essential operations and manufacturing processes. Most of the client's data protection had been online at the start of the intrusion and were encrypted. The client considered paying the ransom (exceeding two hundred thousand dollars) and hoping for the best, but in the end engaged Progent.

"I cannot thank you enough in regards to the expertise Progent provided us during the most stressful time of (our) company's survival. We may have had to pay the cybercriminals if not for the confidence the Progent group afforded us. That you could get our e-mail system and key applications back into operation faster than five days was beyond my wildest dreams. Every single consultant I interacted with or communicated with at Progent was laser focused on getting our system up and was working non-stop on our behalf."

Progent worked together with the customer to rapidly identify and assign priority to the most important applications that needed to be recovered in order to restart departmental operations:

  • Active Directory
  • Exchange Server
  • Accounting and Manufacturing Software
To begin, Progent followed Anti-virus penetration mitigation industry best practices by halting lateral movement and clearing infected systems. Progent then began the process of restoring Microsoft AD, the foundation of enterprise environments built upon Microsoft Windows Server technology. Microsoft Exchange Server email will not work without Active Directory, and the businesses' financials and MRP applications utilized SQL Server, which requires Active Directory for access to the information.

Within two days, Progent was able to rebuild Active Directory services to its pre-attack state. Progent then completed rebuilding and storage recovery on mission critical servers. All Exchange data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to assemble non-encrypted OST data files (Outlook Email Offline Folder Files) on team desktop computers and laptops in order to recover mail data. A not too old off-line backup of the businesses financials/ERP systems made it possible to restore these required applications back online. Although significant work was left to recover totally from the Ryuk event, essential systems were recovered rapidly:

"For the most part, the production manufacturing operation survived unscathed and we delivered all customer sales."

During the following couple of weeks key milestones in the recovery project were accomplished through tight cooperation between Progent team members and the client:

  • In-house web sites were restored without losing any information.
  • The MailStore Microsoft Exchange Server containing more than 4 million historical messages was restored to operations and accessible to users.
  • CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory capabilities were completely functional.
  • A new Palo Alto 850 security appliance was brought on-line.
  • Most of the desktop computers were operational.
"A lot of what occurred during the initial response is mostly a haze for me, but I will not forget the urgency each and every one of the team put in to give us our company back. I have utilized Progent for the past ten years, maybe more, and each time Progent has shined and delivered. This time was a life saver."

Conclusion
A likely business-ending disaster was averted by hard-working professionals, a wide spectrum of technical expertise, and close teamwork. Although in post mortem the ransomware virus attack described here would have been stopped with up-to-date security technology solutions and NIST Cybersecurity Framework best practices, user and IT administrator training, and properly executed security procedures for backup and applying software patches, the reality remains that government-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do fall victim to a crypto-ransomware penetration, feel confident that Progent's team of professionals has substantial experience in ransomware virus defense, remediation, and data recovery.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen and Chris (and any others who were contributing), thanks very much for allowing me to get some sleep after we made it past the initial fire. All of you did an incredible effort, and if any of your guys is visiting the Chicago area, dinner is the least I can do!"

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Des Moines
For ransomware recovery expertise in the Des Moines metro area, phone Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.