Ransomware : Your Feared Information Technology Nightmare
Ransomware Recovery ConsultantsCrypto-Ransomware has become a modern cyberplague that represents an extinction-level threat for organizations poorly prepared for an assault. Multiple generations of ransomware like the Reveton, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been circulating for years and continue to inflict havoc. Newer strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as frequent unnamed malware, not only encrypt online files but also infiltrate any accessible system restores and backups. Data synchronized to cloud environments can also be encrypted. In a vulnerable system, it can make any restore operations useless and basically knocks the entire system back to square one.

Recovering services and data after a ransomware intrusion becomes a race against the clock as the victim fights to stop the spread, cleanup the ransomware, and restore mission-critical activity. Due to the fact that crypto-ransomware needs time to move laterally throughout a network, penetrations are frequently sprung on weekends, when attacks typically take longer to detect. This multiplies the difficulty of quickly mobilizing and orchestrating a capable mitigation team.

Progent offers a range of solutions for protecting Oklahoma CIty organizations from ransomware penetrations. Among these are staff training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to discover and quarantine zero-day malware attacks. Progent also provides the services of experienced ransomware recovery engineers with the track record and perseverance to re-deploy a breached network as urgently as possible.

Progent's Ransomware Recovery Support Services
Following a ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that merciless criminals will respond with the needed keys to decrypt any or all of your files. Kaspersky ascertained that 17% of ransomware victims never restored their files after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The alternative is to piece back together the vital elements of your Information Technology environment. Without the availability of full system backups, this calls for a wide range of skills, well-coordinated project management, and the capability to work 24x7 until the recovery project is done.

For decades, Progent has offered professional IT services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have earned internationally-recognized certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with accounting and ERP applications. This breadth of expertise gives Progent the skills to knowledgably determine important systems and re-organize the surviving components of your Information Technology system following a ransomware attack and configure them into an operational system.

Progent's security group uses best of breed project management tools to coordinate the complicated recovery process. Progent appreciates the urgency of acting rapidly and in unison with a customer's management and Information Technology staff to prioritize tasks and to get the most important applications back on-line as soon as possible.

Customer Case Study: A Successful Ransomware Penetration Response
A business engaged Progent after their company was penetrated by the Ryuk ransomware virus. Ryuk is generally considered to have been launched by North Korean state cybercriminals, possibly adopting technology leaked from the U.S. NSA organization. Ryuk attacks specific businesses with little or no tolerance for operational disruption and is among the most lucrative versions of crypto-ransomware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a regional manufacturing business based in the Chicago metro area with around 500 staff members. The Ryuk penetration had paralyzed all company operations and manufacturing processes. The majority of the client's data protection had been online at the time of the intrusion and were eventually encrypted. The client was taking steps for paying the ransom (in excess of $200,000) and hoping for good luck, but in the end brought in Progent.

"I cannot speak enough about the expertise Progent gave us throughout the most stressful period of (our) businesses survival. We most likely would have paid the hackers behind this attack if it wasn't for the confidence the Progent group gave us. That you could get our e-mail and important servers back on-line in less than one week was amazing. Every single person I worked with or messaged at Progent was amazingly focused on getting us operational and was working 24/7 on our behalf."

Progent worked hand in hand the client to quickly identify and assign priority to the mission critical systems that needed to be recovered in order to continue company functions:

  • Microsoft Active Directory
  • Microsoft Exchange
  • Accounting/MRP
To get going, Progent adhered to AV/Malware Processes incident response industry best practices by stopping lateral movement and removing active viruses. Progent then started the steps of restoring Microsoft AD, the core of enterprise environments built upon Microsoft Windows Server technology. Microsoft Exchange messaging will not work without Windows AD, and the customer's MRP applications utilized Microsoft SQL, which needs Active Directory for authentication to the databases.

Within two days, Progent was able to recover Active Directory to its pre-penetration state. Progent then completed reinstallations and storage recovery of critical applications. All Microsoft Exchange Server schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was able to collect intact OST data files (Outlook Offline Data Files) on various PCs in order to recover mail messages. A recent offline backup of the client's accounting/MRP software made it possible to recover these essential applications back available to users. Although major work was left to recover totally from the Ryuk damage, the most important services were returned to operations quickly:

"For the most part, the assembly line operation did not miss a beat and we delivered all customer shipments."

Over the following month important milestones in the restoration process were completed through tight collaboration between Progent consultants and the customer:

  • In-house web applications were brought back up with no loss of information.
  • The MailStore Server with over four million archived emails was spun up and accessible to users.
  • CRM/Orders/Invoicing/AP/AR/Inventory Control functions were 100 percent recovered.
  • A new Palo Alto 850 firewall was installed.
  • Ninety percent of the user desktops were back into operation.
"Much of what went on that first week is nearly entirely a fog for me, but I will not soon forget the urgency each and every one of you accomplished to give us our company back. I've entrusted Progent for the past 10 years, maybe more, and each time Progent has impressed me and delivered. This situation was a Herculean accomplishment."

Conclusion
A likely business catastrophe was averted due to dedicated professionals, a wide array of knowledge, and tight collaboration. Although in hindsight the ransomware attack detailed here would have been identified and blocked with modern security systems and recognized best practices, user education, and well thought out incident response procedures for data protection and proper patching controls, the fact is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's team of experts has extensive experience in ransomware virus defense, removal, and file recovery.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (and any others who were helping), I'm grateful for allowing me to get rested after we made it through the initial fire. Everyone did an amazing job, and if any of your team is around the Chicago area, a great meal is the least I can do!"

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Oklahoma CIty
For ransomware system recovery consulting in the Oklahoma CIty area, phone Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.