Crypto-Ransomware : Your Crippling IT Nightmare
Ransomware Recovery ConsultantsCrypto-Ransomware has become a too-frequent cyber pandemic that poses an enterprise-level threat for organizations vulnerable to an attack. Different iterations of ransomware like the Dharma, CryptoWall, Bad Rabbit, Syskey and MongoLock cryptoworms have been replicating for years and continue to inflict harm. More recent strains of crypto-ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, as well as more unnamed viruses, not only perform encryption of online files but also infiltrate all accessible system backup. Information synched to off-premises disaster recovery sites can also be encrypted. In a vulnerable system, this can render automatic restoration hopeless and effectively sets the datacenter back to zero.

Getting back services and information following a crypto-ransomware event becomes a sprint against time as the targeted business tries its best to contain the damage, cleanup the ransomware, and resume business-critical activity. Because ransomware needs time to replicate throughout a network, assaults are usually sprung on weekends, when successful penetrations in many cases take longer to discover. This multiplies the difficulty of promptly marshalling and coordinating a qualified mitigation team.

Progent offers an assortment of help services for protecting Savannah enterprises from ransomware attacks. These include team member training to help recognize and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to detect and suppress zero-day malware attacks. Progent also provides the services of veteran ransomware recovery consultants with the skills and commitment to reconstruct a compromised system as urgently as possible.

Progent's Ransomware Recovery Services
Soon after a crypto-ransomware attack, paying the ransom demands in cryptocurrency does not ensure that cyber criminals will provide the codes to decipher all your data. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom can be in the millions of dollars. The alternative is to re-install the critical elements of your IT environment. Without the availability of essential information backups, this calls for a wide range of skill sets, well-coordinated team management, and the capability to work 24x7 until the recovery project is over.

For decades, Progent has offered certified expert IT services for businesses throughout the U.S. and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned advanced industry certifications in key technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security experts have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of experience provides Progent the capability to quickly determine critical systems and consolidate the surviving components of your Information Technology system following a ransomware attack and rebuild them into an operational network.

Progent's recovery group has top notch project management applications to coordinate the sophisticated recovery process. Progent appreciates the urgency of working quickly and together with a customer's management and IT staff to assign priority to tasks and to put key services back on-line as soon as possible.

Client Case Study: A Successful Ransomware Attack Restoration
A client sought out Progent after their company was taken over by Ryuk ransomware virus. Ryuk is believed to have been created by North Korean government sponsored cybercriminals, possibly adopting algorithms leaked from the United States National Security Agency. Ryuk attacks specific companies with little or no tolerance for operational disruption and is among the most profitable versions of ransomware. Major targets include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer headquartered in Chicago with about 500 employees. The Ryuk intrusion had frozen all company operations and manufacturing processes. The majority of the client's data backups had been directly accessible at the beginning of the attack and were damaged. The client was pursuing financing for paying the ransom (exceeding $200K) and praying for the best, but ultimately engaged Progent.

"I cannot thank you enough about the support Progent provided us during the most stressful time of (our) businesses existence. We may have had to pay the cyber criminals behind the attack except for the confidence the Progent group gave us. The fact that you were able to get our e-mail and critical applications back faster than five days was something I thought impossible. Each person I spoke to or messaged at Progent was laser focused on getting us back online and was working 24/7 on our behalf."

Progent worked with the client to quickly understand and prioritize the essential elements that had to be recovered in order to resume company functions:

  • Active Directory (AD)
  • Electronic Mail
  • Financials/MRP
To start, Progent followed AV/Malware Processes incident mitigation best practices by isolating and cleaning up infected systems. Progent then initiated the task of restoring Active Directory, the heart of enterprise networks built upon Microsoft technology. Microsoft Exchange email will not work without Active Directory, and the client's financials and MRP system leveraged Microsoft SQL Server, which needs Windows AD for access to the information.

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then performed setup and storage recovery on key applications. All Exchange ties and attributes were usable, which greatly helped the rebuild of Exchange. Progent was able to assemble intact OST files (Outlook Offline Data Files) on staff PCs and laptops to recover email data. A not too old off-line backup of the customer's financials/MRP software made it possible to restore these essential applications back available to users. Although major work still had to be done to recover completely from the Ryuk damage, essential services were returned to operations quickly:

"For the most part, the production manufacturing operation was never shut down and we made all customer deliverables."

Throughout the following couple of weeks important milestones in the recovery project were achieved in close cooperation between Progent consultants and the customer:

  • Self-hosted web applications were brought back up without losing any information.
  • The MailStore Exchange Server containing more than 4 million historical emails was restored to operations and accessible to users.
  • CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables/Inventory Control functions were completely restored.
  • A new Palo Alto Networks 850 security appliance was brought online.
  • 90% of the user desktops were functioning as before the incident.
"Much of what happened those first few days is mostly a fog for me, but my management will not soon forget the dedication all of you accomplished to give us our business back. I've entrusted Progent for the past ten years, possibly more, and each time Progent has shined and delivered. This time was a Herculean accomplishment."

Conclusion
A probable business-ending disaster was dodged by dedicated professionals, a broad array of technical expertise, and close collaboration. Although in hindsight the ransomware virus attack detailed here should have been identified and disabled with modern cyber security technology and recognized best practices, user and IT administrator training, and well thought out incident response procedures for backup and proper patching controls, the reality is that government-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and are an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's roster of experts has extensive experience in crypto-ransomware virus defense, removal, and file restoration.

"So, to Darrin, Matt, Aaron, Dan, Jesse, Arnaud, Allen, Tony and Chris (along with others that were involved), I'm grateful for making it so I could get rested after we got over the first week. All of you did an impressive effort, and if any of your guys is visiting the Chicago area, a great meal is on me!"

Download the Crypto-Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer story, please click:
Progent's Crypto-Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Savannah
For ransomware recovery services in the Savannah metro area, call Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.