Ransomware : Your Worst IT Nightmare
Ransomware Remediation ProfessionalsRansomware has become an escalating cyber pandemic that poses an existential danger for businesses poorly prepared for an attack. Multiple generations of ransomware such as Reveton, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been running rampant for years and continue to cause damage. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, plus daily unnamed viruses, not only encrypt online information but also infiltrate any available system protection. Information synchronized to cloud environments can also be encrypted. In a vulnerable data protection solution, this can make automated recovery useless and basically sets the network back to zero.

Restoring services and information following a crypto-ransomware attack becomes a race against the clock as the targeted organization struggles to stop lateral movement, remove the virus, and resume business-critical operations. Because crypto-ransomware needs time to spread throughout a targeted network, penetrations are frequently launched on weekends, when successful penetrations may take longer to uncover. This compounds the difficulty of quickly marshalling and coordinating an experienced response team.

Progent has a variety of support services for securing Perth organizations from ransomware attacks. Among these are staff training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat defense to identify and disable zero-day modern malware assaults. Progent also can provide the assistance of veteran crypto-ransomware recovery engineers with the talent and perseverance to restore a compromised network as rapidly as possible.

Progent's Ransomware Restoration Support Services
Soon after a ransomware penetration, paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will respond with the codes to decipher any or all of your data. Kaspersky ascertained that 17% of crypto-ransomware victims never restored their data after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are typically a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The alternative is to setup from scratch the vital parts of your Information Technology environment. Without access to full data backups, this requires a broad complement of IT skills, well-coordinated project management, and the capability to work continuously until the recovery project is over.

For twenty years, Progent has provided certified expert IT services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained high-level certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have earned internationally-renowned industry certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience in financial systems and ERP applications. This breadth of experience affords Progent the ability to knowledgably determine critical systems and integrate the remaining pieces of your IT system after a ransomware event and assemble them into a functioning network.

Progent's ransomware group has powerful project management systems to coordinate the complicated recovery process. Progent understands the urgency of acting quickly and together with a client's management and Information Technology resources to prioritize tasks and to put key systems back on line as soon as possible.

Business Case Study: A Successful Crypto-Ransomware Attack Recovery
A client hired Progent after their organization was crashed by Ryuk crypto-ransomware. Ryuk is thought to have been developed by North Korean state cybercriminals, possibly using strategies exposed from the U.S. NSA organization. Ryuk targets specific companies with little ability to sustain operational disruption and is one of the most lucrative versions of ransomware. Major victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturing business based in the Chicago metro area with around 500 employees. The Ryuk intrusion had paralyzed all business operations and manufacturing processes. Most of the client's information backups had been on-line at the time of the intrusion and were destroyed. The client was pursuing financing for paying the ransom demand (in excess of $200,000) and hoping for the best, but in the end utilized Progent.

"I cannot speak enough in regards to the care Progent provided us during the most critical time of (our) businesses existence. We may have had to pay the cybercriminals if not for the confidence the Progent experts afforded us. That you could get our e-mail system and important applications back online in less than one week was earth shattering. Every single consultant I got help from or messaged at Progent was totally committed on getting us operational and was working day and night to bail us out."

Progent worked together with the client to rapidly assess and prioritize the key areas that needed to be restored in order to restart departmental functions:

  • Microsoft Active Directory
  • Electronic Mail
  • Accounting/MRP
To begin, Progent followed Anti-virus penetration mitigation best practices by stopping lateral movement and clearing up compromised systems. Progent then started the process of recovering Active Directory, the heart of enterprise systems built upon Microsoft Windows technology. Microsoft Exchange Server email will not operate without Active Directory, and the customer's MRP applications used Microsoft SQL Server, which requires Windows AD for security authorization to the data.

Within 48 hours, Progent was able to restore Active Directory to its pre-intrusion state. Progent then performed rebuilding and storage recovery on key applications. All Exchange Server data and configuration information were usable, which accelerated the rebuild of Exchange. Progent was able to collect intact OST data files (Microsoft Outlook Offline Data Files) on user desktop computers and laptops in order to recover mail information. A not too old offline backup of the businesses financials/ERP software made it possible to return these vital applications back online. Although a large amount of work remained to recover fully from the Ryuk virus, essential systems were returned to operations rapidly:

"For the most part, the production manufacturing operation showed little impact and we delivered all customer deliverables."

During the next couple of weeks key milestones in the recovery project were accomplished through tight collaboration between Progent team members and the client:

  • In-house web sites were brought back up without losing any data.
  • The MailStore Server exceeding four million archived messages was brought online and available for users.
  • CRM/Customer Orders/Invoices/AP/Accounts Receivables (AR)/Inventory Control capabilities were 100% operational.
  • A new Palo Alto 850 firewall was brought on-line.
  • Nearly all of the user PCs were being used by staff.
"So much of what happened that first week is mostly a haze for me, but we will not soon forget the countless hours each of the team put in to give us our business back. I've entrusted Progent for at least 10 years, maybe more, and every time I needed help Progent has outperformed my expectations and delivered. This time was a Herculean accomplishment."

Conclusion
A possible business-ending disaster was evaded through the efforts of hard-working experts, a broad range of subject matter expertise, and close teamwork. Although in hindsight the ransomware virus penetration detailed here would have been identified and stopped with advanced cyber security systems and ISO/IEC 27001 best practices, user and IT administrator training, and well thought out incident response procedures for backup and proper patching controls, the reality remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a ransomware incursion, feel confident that Progent's team of experts has extensive experience in ransomware virus blocking, removal, and data disaster recovery.

"So, to Darrin, Matt, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others who were helping), thanks very much for allowing me to get rested after we got through the initial fire. Everyone did an impressive effort, and if anyone that helped is in the Chicago area, dinner is the least I can do!"

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Perth
For ransomware recovery services in the Perth area, call Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.