Crypto-Ransomware : Your Feared Information Technology Nightmare
Ransomware Recovery ConsultantsCrypto-Ransomware has become a too-frequent cyberplague that represents an enterprise-level danger for businesses of all sizes unprepared for an assault. Different iterations of crypto-ransomware like the Dharma, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for years and continue to cause havoc. More recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, plus frequent unnamed malware, not only perform encryption of on-line information but also infiltrate most available system backup. Information synched to cloud environments can also be encrypted. In a poorly architected data protection solution, this can render automatic recovery impossible and effectively sets the datacenter back to square one.

Restoring applications and information following a ransomware attack becomes a sprint against time as the targeted business fights to contain, eradicate the virus, and restore business-critical operations. Since ransomware takes time to move laterally throughout a targeted network, attacks are frequently sprung during nights and weekends, when successful penetrations in many cases take more time to detect. This compounds the difficulty of quickly mobilizing and organizing a knowledgeable response team.

Progent has a variety of services for securing Modesto organizations from ransomware events. These include user training to become familiar with and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based threat protection to identify and extinguish day-zero modern malware assaults. Progent also can provide the assistance of seasoned ransomware recovery consultants with the talent and commitment to rebuild a compromised system as quickly as possible.

Progent's Ransomware Recovery Support Services
After a ransomware invasion, sending the ransom in cryptocurrency does not provide any assurance that distant criminals will respond with the codes to decipher all your files. Kaspersky ascertained that seventeen percent of ransomware victims never restored their files after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The fallback is to piece back together the critical elements of your IT environment. Absent the availability of complete information backups, this requires a broad range of IT skills, well-coordinated project management, and the ability to work 24x7 until the task is finished.

For twenty years, Progent has offered professional Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned top industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity experts have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of expertise gives Progent the skills to knowledgably determine necessary systems and consolidate the remaining pieces of your Information Technology system following a ransomware attack and rebuild them into a functioning network.

Progent's ransomware group utilizes top notch project management tools to orchestrate the sophisticated recovery process. Progent knows the importance of acting swiftly and together with a customer's management and Information Technology staff to prioritize tasks and to get essential applications back online as fast as possible.

Case Study: A Successful Ransomware Virus Response
A customer sought out Progent after their company was brought down by Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean state sponsored hackers, suspected of adopting approaches exposed from the United States NSA organization. Ryuk attacks specific companies with little or no ability to sustain operational disruption and is one of the most profitable versions of ransomware. Major targets include Data Resolution, a California-based info warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a single-location manufacturing business located in Chicago with about 500 workers. The Ryuk intrusion had disabled all essential operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the beginning of the intrusion and were eventually encrypted. The client considered paying the ransom demand (more than $200K) and wishfully thinking for the best, but in the end called Progent.

"I can't thank you enough about the support Progent gave us during the most fearful time of (our) businesses existence. We would have paid the criminal gangs if not for the confidence the Progent team afforded us. The fact that you could get our messaging and critical servers back quicker than one week was something I thought impossible. Each staff member I got help from or communicated with at Progent was hell bent on getting us restored and was working 24 by 7 on our behalf."

Progent worked together with the customer to rapidly identify and assign priority to the key elements that needed to be restored in order to continue departmental operations:

  • Microsoft Active Directory
  • Microsoft Exchange Server
  • Accounting and Manufacturing Software
To start, Progent adhered to AV/Malware Processes event response best practices by halting lateral movement and clearing infected systems. Progent then began the steps of recovering Active Directory, the foundation of enterprise networks built upon Microsoft Windows technology. Microsoft Exchange Server email will not function without Windows AD, and the customer's accounting and MRP applications used Microsoft SQL, which depends on Active Directory services for authentication to the database.

In less than two days, Progent was able to re-build Active Directory to its pre-virus state. Progent then performed reinstallations and hard drive recovery of essential applications. All Exchange Server schema and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to collect local OST files (Outlook Offline Folder Files) on team PCs and laptops in order to recover email data. A not too old offline backup of the customer's manufacturing systems made them able to recover these required applications back on-line. Although major work remained to recover completely from the Ryuk attack, the most important systems were recovered quickly:

"For the most part, the assembly line operation survived unscathed and we made all customer shipments."

Throughout the following couple of weeks important milestones in the restoration process were made in close cooperation between Progent engineers and the client:

  • Self-hosted web applications were brought back up with no loss of information.
  • The MailStore Microsoft Exchange Server containing more than four million archived messages was spun up and available for users.
  • CRM/Orders/Invoices/AP/Accounts Receivables (AR)/Inventory capabilities were 100% restored.
  • A new Palo Alto 850 firewall was deployed.
  • Nearly all of the user PCs were functioning as before the incident.
"So much of what transpired in the initial days is mostly a haze for me, but I will not soon forget the dedication each of you put in to give us our company back. I have been working with Progent for at least 10 years, maybe more, and each time I needed help Progent has shined and delivered. This situation was a Herculean accomplishment."

Conclusion
A likely business-ending disaster was evaded with hard-working experts, a wide range of subject matter expertise, and close collaboration. Although in hindsight the ransomware virus penetration detailed here could have been stopped with advanced security systems and security best practices, user and IT administrator training, and well designed incident response procedures for information backup and applying software patches, the fact is that state-sponsored cyber criminals from China, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware penetration, feel confident that Progent's team of professionals has a proven track record in ransomware virus defense, remediation, and file recovery.

"So, to Darrin, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were contributing), thanks very much for allowing me to get rested after we made it past the initial fire. All of you did an impressive effort, and if any of your guys is visiting the Chicago area, dinner is on me!"

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Modesto
For ransomware recovery services in the Modesto metro area, call Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.