Ransomware : Your Crippling Information Technology Disaster
Crypto-Ransomware Recovery ConsultantsRansomware has become an escalating cyberplague that presents an enterprise-level danger for businesses unprepared for an attack. Different versions of ransomware such as CryptoLocker, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for years and still cause damage. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus more as yet unnamed newcomers, not only encrypt online critical data but also infiltrate any accessible system backup. Data synched to off-premises disaster recovery sites can also be encrypted. In a vulnerable system, it can make automatic recovery hopeless and basically knocks the network back to square one.

Recovering applications and data after a ransomware event becomes a race against time as the targeted organization struggles to contain, clear the crypto-ransomware, and restore business-critical activity. Because crypto-ransomware takes time to replicate across a network, assaults are usually launched at night, when attacks in many cases take longer to detect. This compounds the difficulty of rapidly marshalling and organizing an experienced response team.

Progent offers a variety of solutions for protecting Fort Collins organizations from crypto-ransomware events. Among these are staff training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to discover and quarantine day-zero modern malware assaults. Progent also can provide the assistance of experienced ransomware recovery engineers with the track record and commitment to restore a breached environment as rapidly as possible.

Progent's Ransomware Recovery Help
After a crypto-ransomware invasion, sending the ransom in cryptocurrency does not ensure that distant criminals will return the needed codes to decipher all your data. Kaspersky estimated that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The fallback is to setup from scratch the key components of your Information Technology environment. Absent access to full data backups, this requires a wide complement of skills, well-coordinated team management, and the ability to work non-stop until the task is done.

For twenty years, Progent has made available expert Information Technology services for companies across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes professionals who have been awarded advanced industry certifications in key technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with financial management and ERP software solutions. This breadth of expertise affords Progent the ability to efficiently identify important systems and consolidate the surviving components of your computer network system following a crypto-ransomware penetration and configure them into a functioning system.

Progent's recovery group utilizes best of breed project management tools to orchestrate the sophisticated restoration process. Progent appreciates the importance of acting swiftly and in unison with a client's management and Information Technology resources to assign priority to tasks and to get critical services back online as soon as humanly possible.

Case Study: A Successful Ransomware Penetration Response
A small business hired Progent after their network was taken over by the Ryuk ransomware virus. Ryuk is generally considered to have been created by North Korean state sponsored cybercriminals, suspected of adopting strategies leaked from the United States NSA organization. Ryuk attacks specific companies with little ability to sustain operational disruption and is among the most profitable versions of ransomware. Headline victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturer headquartered in the Chicago metro area with around 500 staff members. The Ryuk attack had frozen all business operations and manufacturing processes. Most of the client's information backups had been online at the start of the attack and were encrypted. The client was pursuing financing for paying the ransom (exceeding $200K) and wishfully thinking for the best, but ultimately called Progent.

"I cannot tell you enough about the support Progent gave us during the most critical time of (our) businesses survival. We most likely would have paid the hackers behind this attack if it wasn't for the confidence the Progent experts afforded us. That you could get our e-mail and important applications back into operation quicker than 1 week was something I thought impossible. Every single expert I talked with or communicated with at Progent was totally committed on getting our system up and was working day and night to bail us out."

Progent worked with the client to rapidly determine and assign priority to the critical elements that had to be restored to make it possible to continue departmental operations:

  • Microsoft Active Directory
  • Electronic Messaging
  • Accounting/MRP
To begin, Progent adhered to ransomware penetration mitigation industry best practices by isolating and cleaning systems of viruses. Progent then initiated the process of rebuilding Windows Active Directory, the heart of enterprise environments built on Microsoft technology. Exchange email will not function without Active Directory, and the client's MRP software used Microsoft SQL, which depends on Active Directory services for access to the data.

Within two days, Progent was able to re-build Windows Active Directory to its pre-penetration state. Progent then charged ahead with setup and storage recovery on essential systems. All Microsoft Exchange Server data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to assemble intact OST files (Outlook Off-Line Folder Files) on various PCs and laptops to recover email data. A not too old offline backup of the customer's financials/MRP systems made them able to recover these essential applications back online. Although significant work remained to recover completely from the Ryuk event, core services were recovered quickly:

"For the most part, the production line operation survived unscathed and we produced all customer orders."

Over the following few weeks critical milestones in the restoration project were made through tight cooperation between Progent consultants and the client:

  • Internal web applications were brought back up with no loss of information.
  • The MailStore Microsoft Exchange Server exceeding four million historical messages was brought online and available for users.
  • CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables (AR)/Inventory functions were 100 percent functional.
  • A new Palo Alto 850 firewall was installed.
  • Nearly all of the desktop computers were fully operational.
"A huge amount of what transpired in the initial days is mostly a blur for me, but my management will not soon forget the care all of you put in to give us our business back. I have been working together with Progent for the past ten years, possibly more, and each time I needed help Progent has outperformed my expectations and delivered. This event was a Herculean accomplishment."

Conclusion
A possible business-killing catastrophe was avoided by dedicated experts, a wide spectrum of technical expertise, and tight teamwork. Although in retrospect the ransomware virus penetration described here could have been stopped with modern cyber security systems and ISO/IEC 27001 best practices, team training, and properly executed security procedures for backup and proper patching controls, the reality remains that government-sponsored hackers from Russia, China and elsewhere are tireless and are an ongoing threat. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's roster of experts has a proven track record in crypto-ransomware virus defense, cleanup, and file recovery.

"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (and any others that were contributing), I'm grateful for allowing me to get rested after we got over the initial fire. All of you did an incredible effort, and if anyone that helped is visiting the Chicago area, dinner is on me!"

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Fort Collins
For ransomware system restoration consulting services in the Fort Collins area, phone Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.