Crypto-Ransomware : Your Worst IT Catastrophe
Crypto-Ransomware Recovery ProfessionalsRansomware has become a too-frequent cyber pandemic that represents an existential threat for businesses vulnerable to an assault. Different iterations of ransomware such as Dharma, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for a long time and continue to cause harm. Modern strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with frequent unnamed newcomers, not only perform encryption of on-line information but also infect all configured system protection mechanisms. Data synchronized to off-premises disaster recovery sites can also be ransomed. In a poorly architected system, this can render any restoration useless and effectively knocks the datacenter back to zero.

Getting back on-line applications and information following a ransomware intrusion becomes a race against time as the targeted business tries its best to contain the damage, cleanup the ransomware, and resume enterprise-critical operations. Since crypto-ransomware takes time to move laterally throughout a targeted network, assaults are frequently launched during weekends and nights, when successful penetrations tend to take more time to uncover. This compounds the difficulty of quickly marshalling and orchestrating a qualified response team.

Progent has an assortment of solutions for protecting Eugene businesses from crypto-ransomware penetrations. These include team training to help identify and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to identify and extinguish day-zero malware assaults. Progent also can provide the services of veteran crypto-ransomware recovery professionals with the track record and commitment to reconstruct a compromised system as quickly as possible.

Progent's Ransomware Restoration Help
After a ransomware invasion, even paying the ransom demands in cryptocurrency does not guarantee that cyber hackers will provide the needed keys to decrypt any of your data. Kaspersky Labs determined that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The fallback is to setup from scratch the critical components of your Information Technology environment. Without access to essential system backups, this calls for a wide complement of skill sets, well-coordinated project management, and the ability to work non-stop until the job is complete.

For two decades, Progent has made available certified expert IT services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have attained advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP application software. This breadth of experience affords Progent the ability to rapidly understand critical systems and re-organize the remaining components of your computer network environment following a crypto-ransomware penetration and assemble them into a functioning system.

Progent's recovery team of experts utilizes state-of-the-art project management applications to coordinate the sophisticated restoration process. Progent knows the importance of acting swiftly and together with a customer's management and Information Technology staff to assign priority to tasks and to put critical applications back on-line as fast as possible.

Customer Case Study: A Successful Ransomware Intrusion Response
A client hired Progent after their company was taken over by the Ryuk ransomware. Ryuk is believed to have been launched by North Korean state criminal gangs, suspected of using techniques exposed from America's National Security Agency. Ryuk seeks specific organizations with little room for operational disruption and is among the most lucrative instances of crypto-ransomware. High publicized victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a regional manufacturer based in the Chicago metro area with about 500 workers. The Ryuk intrusion had shut down all essential operations and manufacturing processes. Most of the client's data backups had been directly accessible at the beginning of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom (more than $200K) and wishfully thinking for the best, but in the end utilized Progent.

"I can't thank you enough about the care Progent provided us throughout the most stressful time of (our) businesses existence. We had little choice but to pay the cyber criminals behind the attack if it wasn't for the confidence the Progent team afforded us. The fact that you could get our e-mail system and essential applications back on-line faster than seven days was earth shattering. Every single consultant I worked with or texted at Progent was hell bent on getting us restored and was working breakneck pace on our behalf."

Progent worked together with the customer to quickly identify and assign priority to the essential systems that had to be recovered to make it possible to continue departmental functions:

  • Active Directory (AD)
  • Microsoft Exchange Server
  • Accounting/MRP
To start, Progent followed Anti-virus incident response best practices by halting the spread and performing virus removal steps. Progent then started the steps of bringing back online Active Directory, the core of enterprise networks built on Microsoft Windows Server technology. Microsoft Exchange messaging will not operate without Active Directory, and the client's financials and MRP software utilized Microsoft SQL Server, which requires Active Directory services for security authorization to the information.

Within 48 hours, Progent was able to recover Active Directory to its pre-attack state. Progent then initiated rebuilding and storage recovery on key servers. All Exchange Server ties and attributes were intact, which accelerated the rebuild of Exchange. Progent was able to assemble intact OST data files (Outlook Email Off-Line Data Files) on various PCs to recover email data. A recent offline backup of the customer's accounting/MRP software made it possible to restore these essential applications back servicing users. Although a large amount of work still had to be done to recover fully from the Ryuk attack, critical services were restored rapidly:

"For the most part, the production operation survived unscathed and we delivered all customer sales."

During the following month key milestones in the recovery project were made in tight collaboration between Progent team members and the customer:

  • Internal web sites were returned to operation without losing any data.
  • The MailStore Microsoft Exchange Server containing more than four million historical emails was spun up and accessible to users.
  • CRM/Customer Orders/Invoicing/Accounts Payable (AP)/AR/Inventory Control capabilities were 100 percent recovered.
  • A new Palo Alto 850 firewall was deployed.
  • Most of the user desktops were being used by staff.
"A lot of what was accomplished those first few days is nearly entirely a blur for me, but my management will not soon forget the commitment all of the team accomplished to give us our company back. I've utilized Progent for at least 10 years, possibly more, and each time Progent has come through and delivered as promised. This time was no exception but maybe more Herculean."

Conclusion
A potential business-killing disaster was avoided through the efforts of dedicated experts, a wide array of knowledge, and close teamwork. Although in analyzing the event afterwards the crypto-ransomware penetration described here would have been stopped with current cyber security systems and recognized best practices, team training, and appropriate security procedures for data backup and applying software patches, the fact remains that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware incident, feel confident that Progent's roster of experts has a proven track record in ransomware virus defense, removal, and information systems restoration.

"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were helping), thanks very much for making it so I could get some sleep after we got over the initial fire. All of you did an fabulous effort, and if anyone is around the Chicago area, a great meal is on me!"

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Eugene
For ransomware system restoration expertise in the Eugene metro area, call Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.