Ransomware : Your Worst IT Nightmare
Ransomware Remediation ProfessionalsRansomware has become a modern cyberplague that poses an extinction-level threat for organizations poorly prepared for an assault. Different iterations of ransomware such as Reveton, CryptoWall, Bad Rabbit, NotPetya and MongoLock cryptoworms have been running rampant for a long time and still cause destruction. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, plus more unnamed viruses, not only encrypt online critical data but also infect any configured system protection. Files synchronized to off-premises disaster recovery sites can also be encrypted. In a poorly designed environment, it can make automated recovery useless and basically sets the entire system back to zero.

Getting back on-line applications and information following a ransomware attack becomes a race against the clock as the targeted business tries its best to contain, eradicate the virus, and resume enterprise-critical activity. Because crypto-ransomware takes time to move laterally across a network, assaults are often launched during nights and weekends, when attacks are likely to take longer to uncover. This multiplies the difficulty of quickly mobilizing and organizing an experienced mitigation team.

Progent offers an assortment of services for securing Milwaukee enterprises from ransomware penetrations. These include staff training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based cyberthreat protection to discover and extinguish day-zero modern malware attacks. Progent in addition provides the assistance of expert ransomware recovery consultants with the talent and commitment to re-deploy a compromised system as quickly as possible.

Progent's Ransomware Restoration Services
After a ransomware event, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will respond with the needed codes to decrypt all your files. Kaspersky Labs determined that seventeen percent of ransomware victims never restored their files after having paid the ransom, resulting in increased losses. The gamble is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions of dollars. The fallback is to re-install the vital elements of your IT environment. Absent the availability of complete data backups, this requires a wide complement of skills, professional project management, and the ability to work non-stop until the task is complete.

For twenty years, Progent has made available professional Information Technology services for businesses throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes consultants who have attained advanced industry certifications in key technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security engineers have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience in accounting and ERP application software. This breadth of expertise provides Progent the ability to quickly understand critical systems and consolidate the surviving pieces of your Information Technology system following a crypto-ransomware event and rebuild them into an operational system.

Progent's security team of experts uses top notch project management systems to orchestrate the sophisticated recovery process. Progent knows the urgency of acting rapidly and in unison with a client's management and Information Technology team members to prioritize tasks and to put key applications back on line as fast as humanly possible.

Case Study: A Successful Ransomware Attack Restoration
A client sought out Progent after their company was penetrated by the Ryuk ransomware. Ryuk is thought to have been launched by North Korean state sponsored criminal gangs, suspected of adopting techniques leaked from the United States NSA organization. Ryuk seeks specific companies with little or no ability to sustain operational disruption and is among the most profitable iterations of ransomware. High publicized organizations include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in the Chicago metro area with around 500 employees. The Ryuk attack had brought down all company operations and manufacturing capabilities. Most of the client's data backups had been on-line at the beginning of the intrusion and were eventually encrypted. The client was evaluating paying the ransom demand (exceeding $200,000) and wishfully thinking for the best, but in the end made the decision to use Progent.

"I cannot tell you enough about the help Progent provided us throughout the most fearful time of (our) company's survival. We would have paid the criminal gangs except for the confidence the Progent group afforded us. That you were able to get our e-mail and critical applications back in less than one week was earth shattering. Each person I talked with or e-mailed at Progent was totally committed on getting our company operational and was working at all hours on our behalf."

Progent worked together with the customer to rapidly get our arms around and prioritize the key applications that had to be addressed to make it possible to continue business functions:

  • Windows Active Directory
  • Exchange Server
  • MRP System
To start, Progent adhered to ransomware incident mitigation best practices by stopping the spread and removing active viruses. Progent then began the steps of restoring Windows Active Directory, the key technology of enterprise environments built upon Microsoft Windows Server technology. Exchange email will not function without Active Directory, and the customer's accounting and MRP software used Microsoft SQL, which requires Active Directory services for authentication to the data.

Within 2 days, Progent was able to restore Active Directory to its pre-virus state. Progent then completed reinstallations and storage recovery on key applications. All Microsoft Exchange Server ties and configuration information were intact, which greatly helped the restore of Exchange. Progent was able to assemble non-encrypted OST files (Microsoft Outlook Offline Folder Files) on staff desktop computers in order to recover mail data. A not too old offline backup of the businesses financials/ERP systems made it possible to recover these essential applications back servicing users. Although a large amount of work was left to recover completely from the Ryuk event, essential systems were recovered quickly:

"For the most part, the production line operation showed little impact and we delivered all customer deliverables."

During the next few weeks key milestones in the recovery process were completed through close collaboration between Progent team members and the client:

  • Self-hosted web sites were brought back up without losing any information.
  • The MailStore Microsoft Exchange Server with over 4 million archived emails was brought online and available for users.
  • CRM/Product Ordering/Invoices/AP/AR/Inventory capabilities were 100% restored.
  • A new Palo Alto 850 security appliance was installed and configured.
  • 90% of the desktop computers were operational.
"Much of what was accomplished those first few days is nearly entirely a blur for me, but my team will not soon forget the commitment each of you put in to help get our business back. I have been working together with Progent for at least 10 years, maybe more, and every time I needed help Progent has shined and delivered as promised. This event was a testament to your capabilities."

Conclusion
A likely enterprise-killing catastrophe was evaded by dedicated professionals, a broad spectrum of technical expertise, and close teamwork. Although in hindsight the ransomware virus penetration described here would have been stopped with current security technology and ISO/IEC 27001 best practices, staff training, and well designed security procedures for data backup and proper patching controls, the reality remains that government-sponsored cybercriminals from Russia, China and elsewhere are tireless and are not going away. If you do fall victim to a ransomware attack, remember that Progent's roster of professionals has substantial experience in ransomware virus blocking, cleanup, and data recovery.

"So, to Darrin, Matt, Aaron, Dan, Jesse, Arnaud, Allen, Tony and Chris (and any others that were involved), thanks very much for letting me get rested after we made it past the initial push. Everyone did an amazing job, and if anyone that helped is in the Chicago area, dinner is my treat!"

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Milwaukee
For ransomware system recovery consulting in the Milwaukee metro area, phone Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.