Ransomware : Your Worst Information Technology Catastrophe
Crypto-Ransomware Remediation ExpertsRansomware has become a too-frequent cyber pandemic that presents an existential danger for organizations unprepared for an attack. Multiple generations of crypto-ransomware like the Dharma, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for years and still cause harm. Modern variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, plus frequent unnamed malware, not only perform encryption of on-line data but also infect many accessible system backup. Data replicated to the cloud can also be rendered useless. In a poorly architected data protection solution, this can make any recovery hopeless and basically knocks the network back to zero.

Getting back on-line applications and data after a crypto-ransomware attack becomes a race against the clock as the targeted business fights to stop the spread, cleanup the crypto-ransomware, and restore business-critical operations. Because ransomware takes time to spread across a targeted network, assaults are usually launched at night, when successful attacks are likely to take longer to detect. This compounds the difficulty of rapidly marshalling and organizing a knowledgeable mitigation team.

Progent provides a range of services for securing Indianapolis businesses from ransomware attacks. These include staff education to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based cyberthreat defense to identify and suppress day-zero malware attacks. Progent in addition can provide the assistance of expert ransomware recovery professionals with the talent and perseverance to rebuild a breached environment as soon as possible.

Progent's Ransomware Recovery Help
Soon after a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not provide any assurance that distant criminals will return the needed keys to decrypt any or all of your information. Kaspersky determined that 17% of ransomware victims never recovered their data after having paid the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to re-install the mission-critical components of your IT environment. Without the availability of complete information backups, this calls for a wide complement of skill sets, professional project management, and the capability to work continuously until the recovery project is done.

For twenty years, Progent has offered professional IT services for companies throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned certifications including CISA, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with accounting and ERP application software. This breadth of experience affords Progent the ability to quickly understand important systems and re-organize the surviving pieces of your network system after a crypto-ransomware penetration and rebuild them into a functioning network.

Progent's ransomware team has state-of-the-art project management systems to orchestrate the complicated restoration process. Progent knows the urgency of working swiftly and in concert with a customer's management and IT staff to assign priority to tasks and to get the most important systems back online as soon as possible.

Client Story: A Successful Ransomware Virus Response
A customer escalated to Progent after their organization was penetrated by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state criminal gangs, possibly adopting algorithms leaked from the United States National Security Agency. Ryuk targets specific companies with little or no tolerance for disruption and is among the most lucrative versions of crypto-ransomware. Well Known targets include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing company based in Chicago with around 500 staff members. The Ryuk intrusion had paralyzed all essential operations and manufacturing capabilities. Most of the client's system backups had been directly accessible at the time of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (exceeding $200K) and hoping for the best, but in the end made the decision to use Progent.

"I cannot thank you enough in regards to the support Progent gave us during the most critical period of (our) company's existence. We would have paid the cyber criminals behind the attack if it wasn't for the confidence the Progent team afforded us. The fact that you were able to get our e-mail system and critical servers back online quicker than five days was earth shattering. Every single expert I talked with or communicated with at Progent was hell bent on getting my company operational and was working all day and night on our behalf."

Progent worked hand in hand the customer to quickly understand and prioritize the essential services that had to be recovered to make it possible to continue business functions:

  • Microsoft Active Directory
  • Exchange Server
  • Accounting/MRP
To get going, Progent adhered to ransomware penetration mitigation industry best practices by stopping the spread and clearing up compromised systems. Progent then started the process of recovering Microsoft AD, the core of enterprise networks built upon Microsoft technology. Exchange messaging will not work without AD, and the businesses' financials and MRP system leveraged Microsoft SQL, which needs Active Directory for authentication to the database.

In less than two days, Progent was able to re-build Windows Active Directory to its pre-intrusion state. Progent then completed reinstallations and hard drive recovery on mission critical applications. All Exchange Server ties and attributes were intact, which greatly helped the restore of Exchange. Progent was able to assemble local OST files (Outlook Email Off-Line Data Files) on team desktop computers and laptops in order to recover email information. A not too old off-line backup of the businesses accounting/MRP software made them able to return these required services back online. Although significant work still had to be done to recover totally from the Ryuk damage, core systems were returned to operations rapidly:

"For the most part, the production line operation did not miss a beat and we made all customer deliverables."

Over the following month key milestones in the restoration project were accomplished through close cooperation between Progent team members and the customer:

  • In-house web sites were brought back up with no loss of data.
  • The MailStore Microsoft Exchange Server containing more than 4 million archived emails was spun up and accessible to users.
  • CRM/Customer Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory Control modules were 100 percent recovered.
  • A new Palo Alto 850 security appliance was set up and programmed.
  • Most of the user PCs were functioning as before the incident.
"So much of what was accomplished that first week is nearly entirely a fog for me, but we will not soon forget the countless hours all of your team accomplished to give us our business back. I've trusted Progent for the past ten years, possibly more, and every time I needed help Progent has outperformed my expectations and delivered as promised. This time was a life saver."

Conclusion
A likely business-ending catastrophe was avoided with dedicated experts, a wide range of knowledge, and close teamwork. Although upon completion of forensics the ransomware virus penetration detailed here would have been prevented with current cyber security technology and recognized best practices, staff training, and well thought out security procedures for information protection and keeping systems up to date with security patches, the fact remains that state-sponsored hackers from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's roster of experts has extensive experience in ransomware virus blocking, mitigation, and information systems recovery.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Tony and Chris (and any others who were involved), thank you for letting me get rested after we got over the first week. All of you did an fabulous job, and if anyone that helped is visiting the Chicago area, dinner is my treat!"

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Crypto-Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Indianapolis
For ransomware cleanup consulting in the Indianapolis metro area, call Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.