Ransomware : Your Feared Information Technology Nightmare
Ransomware Remediation ProfessionalsCrypto-Ransomware has become a modern cyberplague that poses an extinction-level danger for organizations poorly prepared for an attack. Multiple generations of ransomware like the CrySIS, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for years and continue to inflict destruction. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, plus frequent as yet unnamed viruses, not only perform encryption of on-line data files but also infect all configured system backup. Information synchronized to cloud environments can also be rendered useless. In a vulnerable environment, this can make automatic recovery hopeless and basically knocks the datacenter back to square one.

Getting back online programs and information after a ransomware intrusion becomes a race against the clock as the victim tries its best to contain, eradicate the crypto-ransomware, and resume enterprise-critical activity. Because ransomware requires time to spread across a network, assaults are frequently launched on weekends and holidays, when successful penetrations are likely to take longer to discover. This multiplies the difficulty of promptly marshalling and orchestrating a capable response team.

Progent has a variety of solutions for protecting The Woodlands organizations from crypto-ransomware attacks. Among these are user training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat defense to discover and quarantine zero-day modern malware assaults. Progent in addition offers the services of experienced ransomware recovery professionals with the skills and perseverance to reconstruct a breached network as quickly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a ransomware event, sending the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will return the keys to unencrypt all your information. Kaspersky estimated that 17% of ransomware victims never recovered their files after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions. The fallback is to re-install the key parts of your Information Technology environment. Absent access to complete information backups, this calls for a wide complement of skills, professional project management, and the ability to work continuously until the recovery project is done.

For two decades, Progent has offered expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes engineers who have attained advanced industry certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have garnered internationally-renowned certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in accounting and ERP software solutions. This breadth of expertise gives Progent the capability to rapidly identify critical systems and integrate the remaining parts of your network system following a crypto-ransomware event and configure them into a functioning system.

Progent's recovery team of experts uses best of breed project management tools to coordinate the sophisticated restoration process. Progent appreciates the urgency of working rapidly and in unison with a client's management and Information Technology team members to assign priority to tasks and to get critical services back on-line as soon as humanly possible.

Client Case Study: A Successful Ransomware Incident Response
A small business contacted Progent after their network was taken over by the Ryuk ransomware virus. Ryuk is thought to have been deployed by North Korean state sponsored cybercriminals, possibly using approaches exposed from the U.S. NSA organization. Ryuk attacks specific companies with little room for operational disruption and is one of the most profitable examples of ransomware malware. Headline organizations include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in Chicago and has around 500 employees. The Ryuk event had brought down all business operations and manufacturing capabilities. The majority of the client's data backups had been directly accessible at the start of the attack and were eventually encrypted. The client was pursuing financing for paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but in the end engaged Progent.

"I cannot tell you enough about the expertise Progent gave us throughout the most fearful time of (our) company's existence. We most likely would have paid the cyber criminals behind the attack if not for the confidence the Progent group gave us. The fact that you were able to get our e-mail system and important servers back online faster than a week was beyond my wildest dreams. Every single consultant I worked with or communicated with at Progent was amazingly focused on getting our company operational and was working all day and night on our behalf."

Progent worked hand in hand the client to quickly get our arms around and prioritize the critical elements that needed to be restored in order to resume company functions:

  • Windows Active Directory
  • Microsoft Exchange Server
  • Accounting and Manufacturing Software
To start, Progent adhered to Anti-virus incident mitigation best practices by isolating and cleaning systems of viruses. Progent then began the steps of rebuilding Active Directory, the key technology of enterprise environments built upon Microsoft Windows technology. Exchange email will not work without AD, and the businesses' financials and MRP applications leveraged SQL Server, which depends on Active Directory for authentication to the data.

In less than two days, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then assisted with rebuilding and storage recovery of essential systems. All Microsoft Exchange Server data and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to assemble local OST files (Microsoft Outlook Off-Line Folder Files) on team workstations and laptops in order to recover mail messages. A recent off-line backup of the customer's financials/ERP software made it possible to return these essential services back online. Although a lot of work needed to be completed to recover completely from the Ryuk attack, critical systems were returned to operations rapidly:

"For the most part, the production operation survived unscathed and we delivered all customer sales."

During the following month key milestones in the recovery process were made in close cooperation between Progent team members and the client:

  • Internal web applications were brought back up without losing any data.
  • The MailStore Exchange Server containing more than 4 million archived emails was restored to operations and available for users.
  • CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control capabilities were 100% recovered.
  • A new Palo Alto 850 firewall was brought on-line.
  • Nearly all of the desktop computers were being used by staff.
"A huge amount of what was accomplished those first few days is mostly a blur for me, but my management will not soon forget the urgency all of your team accomplished to help get our business back. I have entrusted Progent for the past ten years, maybe more, and every time I needed help Progent has shined and delivered. This event was the most impressive ever."

Conclusion
A probable business catastrophe was averted with results-oriented professionals, a broad array of knowledge, and tight teamwork. Although in hindsight the ransomware penetration detailed here should have been identified and blocked with advanced cyber security solutions and NIST Cybersecurity Framework best practices, user and IT administrator training, and well thought out incident response procedures for information backup and proper patching controls, the fact remains that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and are an ongoing threat. If you do get hit by a crypto-ransomware penetration, remember that Progent's roster of professionals has a proven track record in crypto-ransomware virus blocking, cleanup, and information systems restoration.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (and any others who were helping), thank you for letting me get rested after we made it over the initial push. All of you did an impressive effort, and if anyone is visiting the Chicago area, a great meal is on me!"

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in The Woodlands
For ransomware cleanup consulting in the The Woodlands area, call Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.