Crypto-Ransomware : Your Feared IT Nightmare
Ransomware Remediation ConsultantsCrypto-Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level threat for businesses poorly prepared for an attack. Different iterations of ransomware such as Reveton, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been circulating for a long time and still inflict havoc. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, along with daily unnamed viruses, not only perform encryption of online data files but also infect all configured system protection mechanisms. Data synched to off-premises disaster recovery sites can also be rendered useless. In a poorly designed data protection solution, it can make automated recovery impossible and effectively knocks the entire system back to square one.

Restoring programs and data following a crypto-ransomware intrusion becomes a sprint against time as the targeted organization tries its best to stop the spread, clear the ransomware, and restore enterprise-critical activity. Since ransomware requires time to replicate across a targeted network, attacks are often sprung during nights and weekends, when penetrations are likely to take more time to detect. This multiplies the difficulty of rapidly marshalling and organizing a qualified mitigation team.

Progent offers a variety of services for securing Londrina businesses from crypto-ransomware penetrations. Among these are staff education to help identify and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to discover and disable day-zero malware attacks. Progent in addition can provide the assistance of expert ransomware recovery professionals with the talent and perseverance to re-deploy a compromised network as urgently as possible.

Progent's Ransomware Recovery Help
Soon after a crypto-ransomware attack, even paying the ransom demands in cryptocurrency does not ensure that cyber hackers will return the needed codes to decrypt all your data. Kaspersky ascertained that seventeen percent of ransomware victims never restored their data after having paid the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom demand can be in the millions of dollars. The fallback is to piece back together the critical elements of your Information Technology environment. Without the availability of essential data backups, this requires a broad range of skill sets, professional project management, and the capability to work non-stop until the recovery project is over.

For decades, Progent has made available certified expert Information Technology services for businesses throughout the United States and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned advanced industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise in accounting and ERP applications. This breadth of experience provides Progent the skills to efficiently identify important systems and re-organize the remaining parts of your IT environment following a ransomware attack and assemble them into an operational system.

Progent's security group uses top notch project management tools to orchestrate the complex recovery process. Progent appreciates the urgency of working quickly and together with a client's management and IT resources to prioritize tasks and to put the most important systems back on line as soon as possible.

Client Story: A Successful Ransomware Incident Response
A client engaged Progent after their company was taken over by the Ryuk crypto-ransomware. Ryuk is thought to have been launched by North Korean state cybercriminals, suspected of adopting approaches leaked from the United States NSA organization. Ryuk targets specific organizations with little ability to sustain operational disruption and is among the most profitable examples of ransomware. Well Known organizations include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in Chicago with about 500 workers. The Ryuk event had brought down all essential operations and manufacturing capabilities. Most of the client's information backups had been on-line at the beginning of the intrusion and were encrypted. The client was actively seeking loans for paying the ransom demand (in excess of $200K) and wishfully thinking for the best, but in the end reached out to Progent.

"I can't say enough about the expertise Progent gave us during the most stressful period of (our) company's existence. We most likely would have paid the cybercriminals except for the confidence the Progent group provided us. The fact that you could get our e-mail system and important applications back into operation sooner than seven days was incredible. Each person I interacted with or communicated with at Progent was hell bent on getting us back online and was working non-stop on our behalf."

Progent worked together with the customer to rapidly assess and prioritize the essential areas that had to be restored in order to resume company functions:

  • Windows Active Directory
  • Email
  • Accounting and Manufacturing Software
To get going, Progent adhered to AV/Malware Processes event response best practices by stopping the spread and clearing up compromised systems. Progent then started the task of bringing back online Active Directory, the core of enterprise environments built on Microsoft Windows Server technology. Microsoft Exchange Server messaging will not function without AD, and the customer's accounting and MRP software leveraged Microsoft SQL, which needs Active Directory services for security authorization to the databases.

In less than 2 days, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then performed rebuilding and storage recovery of the most important servers. All Exchange Server data and configuration information were intact, which facilitated the rebuild of Exchange. Progent was able to find non-encrypted OST files (Microsoft Outlook Offline Data Files) on team workstations in order to recover email information. A not too old off-line backup of the customer's financials/ERP software made them able to restore these essential services back online. Although significant work needed to be completed to recover completely from the Ryuk virus, the most important services were returned to operations quickly:

"For the most part, the assembly line operation showed little impact and we delivered all customer sales."

Over the next month key milestones in the restoration process were made in close cooperation between Progent engineers and the customer:

  • In-house web applications were brought back up without losing any information.
  • The MailStore Exchange Server exceeding 4 million historical emails was restored to operations and available for users.
  • CRM/Orders/Invoicing/AP/AR/Inventory capabilities were completely operational.
  • A new Palo Alto Networks 850 security appliance was deployed.
  • Nearly all of the desktops and laptops were being used by staff.
"So much of what happened during the initial response is nearly entirely a fog for me, but my team will not forget the urgency each of you accomplished to help get our company back. I've entrusted Progent for the past ten years, maybe more, and each time I needed help Progent has outperformed my expectations and delivered as promised. This event was the most impressive ever."

Conclusion
A probable company-ending disaster was averted by results-oriented professionals, a wide range of technical expertise, and close collaboration. Although in post mortem the crypto-ransomware penetration detailed here could have been identified and blocked with advanced cyber security solutions and ISO/IEC 27001 best practices, staff training, and properly executed incident response procedures for information protection and proper patching controls, the reality is that state-sponsored cyber criminals from Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a crypto-ransomware incursion, remember that Progent's team of professionals has proven experience in ransomware virus defense, remediation, and information systems restoration.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen and Chris (and any others who were helping), I'm grateful for making it so I could get some sleep after we got over the initial fire. Everyone did an impressive job, and if any of your team is visiting the Chicago area, dinner is the least I can do!"

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Londrina
For ransomware cleanup expertise in the Londrina area, call Progent at 800-462-8800 or go to Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.