Ransomware : Your Worst Information Technology Nightmare
Crypto-Ransomware Remediation ExpertsCrypto-Ransomware has become a modern cyberplague that poses an existential danger for businesses of all sizes poorly prepared for an assault. Different versions of crypto-ransomware such as CryptoLocker, Fusob, Locky, SamSam and MongoLock cryptoworms have been running rampant for years and continue to inflict destruction. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, as well as more unnamed viruses, not only perform encryption of online data but also infiltrate most accessible system restores and backups. Information synchronized to off-premises disaster recovery sites can also be rendered useless. In a vulnerable data protection solution, this can render automated restore operations hopeless and effectively sets the entire system back to square one.

Getting back online programs and information after a ransomware event becomes a sprint against the clock as the targeted organization struggles to stop the spread, cleanup the ransomware, and restore business-critical activity. Due to the fact that crypto-ransomware needs time to move laterally across a targeted network, attacks are often launched on weekends and holidays, when attacks typically take longer to uncover. This multiplies the difficulty of promptly marshalling and coordinating a capable mitigation team.

Progent provides a variety of help services for securing Ontario businesses from ransomware events. These include team member education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based threat defense to detect and extinguish day-zero malware assaults. Progent also can provide the services of experienced ransomware recovery consultants with the talent and commitment to re-deploy a compromised system as soon as possible.

Progent's Ransomware Recovery Services
Subsequent to a crypto-ransomware invasion, sending the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will return the needed keys to decrypt any or all of your information. Kaspersky determined that 17% of ransomware victims never restored their data even after having paid the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The fallback is to piece back together the critical elements of your IT environment. Absent access to essential system backups, this requires a broad complement of IT skills, professional team management, and the willingness to work 24x7 until the recovery project is done.

For two decades, Progent has provided expert Information Technology services for businesses across the US and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned high-level certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security engineers have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has expertise with financial systems and ERP software solutions. This breadth of expertise provides Progent the capability to efficiently ascertain necessary systems and re-organize the surviving components of your IT system after a ransomware attack and assemble them into a functioning network.

Progent's ransomware team uses top notch project management applications to orchestrate the complicated recovery process. Progent knows the importance of working quickly and together with a customer's management and IT staff to assign priority to tasks and to get critical services back on line as fast as possible.

Client Case Study: A Successful Ransomware Virus Recovery
A client sought out Progent after their network was penetrated by Ryuk ransomware. Ryuk is thought to have been deployed by North Korean state sponsored criminal gangs, suspected of using techniques exposed from the United States National Security Agency. Ryuk goes after specific organizations with little or no tolerance for disruption and is among the most profitable versions of ransomware. Major targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business based in Chicago and has about 500 staff members. The Ryuk intrusion had disabled all business operations and manufacturing capabilities. The majority of the client's data backups had been on-line at the start of the intrusion and were encrypted. The client was pursuing financing for paying the ransom demand (more than $200K) and hoping for good luck, but in the end brought in Progent.

"I can't speak enough in regards to the help Progent gave us during the most stressful period of (our) businesses life. We may have had to pay the cyber criminals if not for the confidence the Progent experts provided us. The fact that you were able to get our e-mail and important applications back on-line quicker than seven days was beyond my wildest dreams. Every single staff member I interacted with or messaged at Progent was amazingly focused on getting us working again and was working all day and night on our behalf."

Progent worked with the client to rapidly get our arms around and prioritize the key systems that needed to be restored to make it possible to restart departmental functions:

  • Windows Active Directory
  • Microsoft Exchange
  • Financials/MRP
To start, Progent adhered to AV/Malware Processes event mitigation industry best practices by halting the spread and cleaning systems of viruses. Progent then initiated the steps of rebuilding Microsoft Active Directory, the key technology of enterprise environments built upon Microsoft Windows Server technology. Microsoft Exchange messaging will not operate without Active Directory, and the businesses' MRP applications used Microsoft SQL Server, which depends on Active Directory services for security authorization to the databases.

In less than two days, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then charged ahead with setup and hard drive recovery on mission critical systems. All Exchange schema and configuration information were intact, which facilitated the rebuild of Exchange. Progent was also able to collect non-encrypted OST data files (Outlook Email Off-Line Data Files) on user PCs and laptops to recover mail messages. A not too old offline backup of the customer's manufacturing systems made them able to return these essential programs back available to users. Although major work needed to be completed to recover totally from the Ryuk damage, core services were recovered quickly:

"For the most part, the manufacturing operation ran fairly normal throughout and we delivered all customer orders."

Over the following couple of weeks key milestones in the restoration process were accomplished in tight collaboration between Progent team members and the customer:

  • In-house web sites were restored with no loss of information.
  • The MailStore Server with over 4 million historical messages was spun up and accessible to users.
  • CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were fully operational.
  • A new Palo Alto 850 firewall was set up and programmed.
  • Most of the user PCs were being used by staff.
"So much of what occurred during the initial response is mostly a fog for me, but my management will not forget the urgency all of your team accomplished to give us our company back. I have utilized Progent for at least 10 years, possibly more, and every time Progent has come through and delivered. This situation was the most impressive ever."

Conclusion
A potential company-ending catastrophe was avoided with hard-working experts, a wide spectrum of IT skills, and tight collaboration. Although in retrospect the ransomware penetration detailed here should have been identified and disabled with modern cyber security solutions and ISO/IEC 27001 best practices, user education, and well designed incident response procedures for information backup and proper patching controls, the reality is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware attack, feel confident that Progent's roster of experts has a proven track record in crypto-ransomware virus blocking, remediation, and data recovery.

"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (and any others who were contributing), thank you for allowing me to get rested after we got past the initial fire. Everyone did an incredible job, and if anyone that helped is in the Chicago area, a great meal is the least I can do!"

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this customer case study, please click:
Progent's Ryuk Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in Ontario
For ransomware recovery consulting in the Ontario metro area, call Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.