Ransomware : Your Worst Information Technology Disaster
Ransomware Remediation ExpertsCrypto-Ransomware has become a modern cyber pandemic that presents an enterprise-level threat for businesses unprepared for an attack. Different versions of ransomware such as CryptoLocker, WannaCry, Bad Rabbit, Syskey and MongoLock cryptoworms have been circulating for a long time and still inflict destruction. Modern variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Nephilim, as well as frequent unnamed viruses, not only perform encryption of online critical data but also infiltrate any available system protection. Data synchronized to cloud environments can also be corrupted. In a vulnerable environment, this can make any restoration hopeless and effectively sets the datacenter back to square one.

Restoring services and information following a ransomware event becomes a sprint against time as the targeted organization struggles to stop lateral movement, eradicate the crypto-ransomware, and restore enterprise-critical operations. Because ransomware needs time to move laterally throughout a network, attacks are often sprung during weekends and nights, when successful penetrations tend to take longer to discover. This multiplies the difficulty of rapidly assembling and organizing a knowledgeable mitigation team.

Progent provides an assortment of services for protecting Palo Alto organizations from ransomware attacks. These include user training to become familiar with and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat protection to detect and disable zero-day modern malware attacks. Progent also can provide the assistance of experienced crypto-ransomware recovery professionals with the skills and perseverance to re-deploy a breached system as quickly as possible.

Progent's Ransomware Restoration Support Services
Subsequent to a ransomware penetration, sending the ransom demands in cryptocurrency does not provide any assurance that cyber hackers will respond with the needed codes to decrypt all your information. Kaspersky Labs ascertained that 17% of ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The fallback is to re-install the essential components of your IT environment. Absent access to complete information backups, this calls for a broad range of skills, top notch team management, and the willingness to work continuously until the job is over.

For twenty years, Progent has offered professional IT services for businesses across the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes professionals who have earned top certifications in foundation technologies including Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cybersecurity specialists have earned internationally-recognized industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience with financial systems and ERP application software. This breadth of experience gives Progent the skills to rapidly understand critical systems and organize the surviving components of your network environment after a ransomware penetration and configure them into a functioning network.

Progent's recovery group utilizes best of breed project management applications to coordinate the complex restoration process. Progent knows the urgency of working quickly and in unison with a customer's management and Information Technology staff to prioritize tasks and to put essential applications back on line as fast as humanly possible.

Business Case Study: A Successful Ransomware Penetration Response
A business engaged Progent after their network was penetrated by Ryuk ransomware virus. Ryuk is believed to have been developed by North Korean government sponsored criminal gangs, possibly adopting strategies exposed from the United States National Security Agency. Ryuk targets specific organizations with little or no tolerance for operational disruption and is one of the most lucrative examples of ransomware. Well Known victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer headquartered in Chicago and has around 500 staff members. The Ryuk event had disabled all essential operations and manufacturing capabilities. The majority of the client's information backups had been online at the beginning of the attack and were destroyed. The client was taking steps for paying the ransom demand (more than two hundred thousand dollars) and praying for the best, but in the end reached out to Progent.

"I cannot tell you enough about the help Progent provided us during the most critical period of (our) businesses survival. We would have paid the cyber criminals if not for the confidence the Progent group afforded us. That you could get our e-mail and critical applications back online quicker than five days was amazing. Every single person I talked with or texted at Progent was absolutely committed on getting us working again and was working 24/7 on our behalf."

Progent worked hand in hand the customer to rapidly assess and assign priority to the key services that had to be restored in order to continue company operations:

  • Active Directory
  • Exchange Server
  • MRP System
To start, Progent adhered to ransomware incident mitigation industry best practices by stopping lateral movement and clearing infected systems. Progent then started the steps of recovering Microsoft AD, the key technology of enterprise systems built upon Microsoft technology. Microsoft Exchange Server messaging will not operate without AD, and the client's MRP system leveraged Microsoft SQL, which needs Windows AD for security authorization to the database.

In less than 2 days, Progent was able to recover Active Directory services to its pre-penetration state. Progent then accomplished setup and storage recovery of the most important applications. All Microsoft Exchange Server schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to assemble intact OST files (Outlook Offline Folder Files) on various desktop computers in order to recover email information. A not too old off-line backup of the customer's accounting/MRP systems made it possible to return these essential services back on-line. Although a large amount of work was left to recover completely from the Ryuk damage, core services were returned to operations quickly:

"For the most part, the assembly line operation did not miss a beat and we did not miss any customer sales."

Throughout the following couple of weeks important milestones in the restoration project were made in close collaboration between Progent engineers and the customer:

  • In-house web sites were brought back up without losing any data.
  • The MailStore Microsoft Exchange Server containing more than 4 million historical messages was restored to operations and accessible to users.
  • CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control functions were fully functional.
  • A new Palo Alto Networks 850 firewall was installed.
  • Ninety percent of the desktops and laptops were being used by staff.
"So much of what occurred in the initial days is mostly a haze for me, but we will not soon forget the urgency all of your team put in to give us our business back. I've utilized Progent for the past ten years, possibly more, and every time I needed help Progent has impressed me and delivered as promised. This situation was a life saver."

Conclusion
A possible enterprise-killing catastrophe was evaded by dedicated professionals, a broad array of knowledge, and tight teamwork. Although in post mortem the crypto-ransomware virus penetration described here would have been identified and stopped with advanced cyber security technology solutions and best practices, staff education, and well designed incident response procedures for information backup and keeping systems up to date with security patches, the fact remains that state-sponsored criminal cyber gangs from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware penetration, feel confident that Progent's roster of professionals has substantial experience in ransomware virus defense, mitigation, and data restoration.

"So, to Darrin, Matt, Aaron, Dan, Jesse, Arnaud, Allen, Tony and Chris (along with others who were contributing), I'm grateful for allowing me to get rested after we got over the most critical parts. Everyone did an amazing job, and if anyone that helped is in the Chicago area, a great meal is the least I can do!"

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Palo Alto
For ransomware recovery consulting services in the Palo Alto area, phone Progent at 800-462-8800 or go to Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.