Crypto-Ransomware : Your Worst Information Technology Nightmare
Ransomware Recovery ExpertsCrypto-Ransomware has become a too-frequent cyberplague that presents an existential danger for organizations poorly prepared for an attack. Versions of crypto-ransomware like the CryptoLocker, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been out in the wild for a long time and continue to cause damage. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as daily as yet unnamed newcomers, not only perform encryption of on-line data files but also infect many configured system backup. Data replicated to the cloud can also be rendered useless. In a poorly designed environment, it can render any recovery hopeless and effectively knocks the entire system back to square one.

Getting back applications and data following a crypto-ransomware outage becomes a sprint against the clock as the targeted business tries its best to stop the spread, remove the ransomware, and restore business-critical operations. Since ransomware requires time to move laterally throughout a targeted network, attacks are often sprung on weekends and holidays, when penetrations are likely to take longer to identify. This multiplies the difficulty of rapidly assembling and coordinating a capable response team.

Progent has an assortment of help services for protecting Monterey organizations from crypto-ransomware attacks. Among these are user training to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to discover and quarantine day-zero modern malware assaults. Progent in addition provides the services of seasoned ransomware recovery consultants with the track record and commitment to re-deploy a breached system as quickly as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a crypto-ransomware event, sending the ransom demands in cryptocurrency does not ensure that merciless criminals will return the needed keys to decipher all your information. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never restored their files after having paid the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can reach millions. The alternative is to setup from scratch the essential elements of your Information Technology environment. Without the availability of essential system backups, this calls for a wide range of IT skills, professional team management, and the capability to work 24x7 until the task is completed.

For decades, Progent has provided professional IT services for businesses throughout the United States and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned advanced industry certifications in important technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-renowned certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise in financial management and ERP software solutions. This breadth of experience affords Progent the capability to efficiently identify critical systems and consolidate the remaining pieces of your network environment after a ransomware attack and assemble them into an operational network.

Progent's recovery group has powerful project management systems to coordinate the complex restoration process. Progent understands the urgency of acting quickly and in unison with a client's management and Information Technology staff to assign priority to tasks and to get critical systems back on line as fast as possible.

Business Case Study: A Successful Ransomware Attack Restoration
A business hired Progent after their company was brought down by Ryuk ransomware. Ryuk is believed to have been launched by North Korean government sponsored hackers, possibly adopting strategies exposed from the U.S. National Security Agency. Ryuk targets specific organizations with little or no room for disruption and is one of the most profitable instances of ransomware viruses. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturer located in the Chicago metro area and has around 500 workers. The Ryuk attack had paralyzed all business operations and manufacturing processes. Most of the client's data protection had been on-line at the time of the attack and were eventually encrypted. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and praying for the best, but in the end engaged Progent.

"I cannot thank you enough in regards to the help Progent provided us during the most fearful time of (our) company's existence. We had little choice but to pay the cyber criminals except for the confidence the Progent experts afforded us. That you could get our e-mail system and production servers back into operation in less than one week was something I thought impossible. Every single consultant I talked with or communicated with at Progent was amazingly focused on getting us back online and was working 24 by 7 to bail us out."

Progent worked with the client to rapidly identify and assign priority to the essential elements that needed to be addressed in order to continue business operations:

  • Active Directory
  • Electronic Mail
  • Financials/MRP
To start, Progent followed AV/Malware Processes incident response industry best practices by isolating and disinfecting systems. Progent then started the work of rebuilding Microsoft Active Directory, the key technology of enterprise networks built upon Microsoft Windows technology. Microsoft Exchange messaging will not operate without Active Directory, and the customer's MRP applications leveraged Microsoft SQL, which needs Active Directory services for security authorization to the database.

Within 48 hours, Progent was able to recover Active Directory to its pre-attack state. Progent then assisted with reinstallations and storage recovery on mission critical systems. All Exchange data and attributes were usable, which accelerated the restore of Exchange. Progent was also able to collect intact OST files (Microsoft Outlook Offline Folder Files) on various workstations in order to recover mail messages. A recent offline backup of the client's manufacturing software made it possible to restore these essential applications back servicing users. Although a large amount of work was left to recover fully from the Ryuk event, the most important services were returned to operations rapidly:

"For the most part, the manufacturing operation survived unscathed and we produced all customer deliverables."

During the next few weeks key milestones in the restoration project were achieved through tight cooperation between Progent engineers and the customer:

  • Self-hosted web applications were brought back up without losing any data.
  • The MailStore Exchange Server with over four million historical emails was brought on-line and accessible to users.
  • CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory Control capabilities were 100% restored.
  • A new Palo Alto Networks 850 firewall was brought on-line.
  • Nearly all of the desktop computers were back into operation.
"Much of what was accomplished during the initial response is nearly entirely a blur for me, but we will not soon forget the commitment each of the team put in to give us our business back. I have been working with Progent for at least 10 years, maybe more, and every time Progent has come through and delivered. This time was a stunning achievement."

Conclusion
A likely business catastrophe was avoided with top-tier experts, a wide range of subject matter expertise, and close collaboration. Although in post mortem the ransomware virus attack described here would have been blocked with modern security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and well designed security procedures for data backup and proper patching controls, the reality is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a crypto-ransomware attack, remember that Progent's team of experts has extensive experience in ransomware virus defense, cleanup, and data restoration.

"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others that were involved), thank you for allowing me to get some sleep after we made it past the initial push. Everyone did an amazing job, and if any of your team is in the Chicago area, dinner is on me!"

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Services in Monterey
For ransomware recovery consulting in the Monterey metro area, phone Progent at 800-462-8800 or go to Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.