Crypto-Ransomware : Your Crippling Information Technology Disaster
Crypto-Ransomware Remediation ConsultantsCrypto-Ransomware has become a too-frequent cyberplague that presents an extinction-level danger for businesses unprepared for an assault. Different versions of crypto-ransomware like the Dharma, CryptoWall, Bad Rabbit, SamSam and MongoLock cryptoworms have been around for years and still inflict destruction. More recent versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, plus additional unnamed newcomers, not only perform encryption of online data files but also infect most accessible system restores and backups. Information replicated to off-premises disaster recovery sites can also be encrypted. In a poorly designed environment, this can make automated restoration useless and basically knocks the datacenter back to zero.

Getting back on-line programs and data after a ransomware outage becomes a sprint against time as the targeted organization fights to stop the spread, eradicate the ransomware, and resume enterprise-critical activity. Because ransomware needs time to spread throughout a targeted network, penetrations are often launched on weekends and holidays, when successful penetrations typically take longer to identify. This compounds the difficulty of rapidly assembling and organizing a knowledgeable mitigation team.

Progent offers a range of services for securing Midland organizations from crypto-ransomware events. These include team training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based cyberthreat protection to discover and disable day-zero modern malware assaults. Progent also can provide the services of veteran crypto-ransomware recovery consultants with the track record and commitment to reconstruct a breached system as soon as possible.

Progent's Crypto-Ransomware Restoration Help
Soon after a crypto-ransomware invasion, even paying the ransom demands in cryptocurrency does not provide any assurance that cyber criminals will return the needed codes to unencrypt all your information. Kaspersky Labs ascertained that 17% of crypto-ransomware victims never recovered their files even after having sent off the ransom, resulting in more losses. The gamble is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The other path is to setup from scratch the critical elements of your Information Technology environment. Without access to essential system backups, this requires a wide range of skill sets, professional team management, and the willingness to work 24x7 until the task is done.

For twenty years, Progent has provided professional IT services for companies across the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have attained top industry certifications in key technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial management and ERP software solutions. This breadth of experience gives Progent the skills to knowledgably ascertain important systems and consolidate the surviving pieces of your Information Technology system following a crypto-ransomware event and configure them into an operational system.

Progent's security team of experts uses top notch project management tools to orchestrate the sophisticated restoration process. Progent appreciates the urgency of acting quickly and in unison with a customer's management and IT resources to assign priority to tasks and to get key services back on line as fast as possible.

Client Story: A Successful Crypto-Ransomware Penetration Response
A business sought out Progent after their company was taken over by Ryuk ransomware. Ryuk is thought to have been developed by North Korean state hackers, possibly adopting algorithms exposed from the U.S. NSA organization. Ryuk targets specific organizations with limited tolerance for disruption and is one of the most profitable iterations of ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in the Chicago metro area with about 500 staff members. The Ryuk event had brought down all essential operations and manufacturing capabilities. The majority of the client's data backups had been on-line at the start of the attack and were eventually encrypted. The client considered paying the ransom (exceeding two hundred thousand dollars) and wishfully thinking for good luck, but in the end reached out to Progent.

"I can't speak enough in regards to the help Progent gave us during the most fearful time of (our) businesses survival. We most likely would have paid the cybercriminals except for the confidence the Progent group afforded us. The fact that you were able to get our messaging and important applications back into operation sooner than one week was beyond my wildest dreams. Each expert I worked with or communicated with at Progent was absolutely committed on getting us back online and was working all day and night to bail us out."

Progent worked hand in hand the client to rapidly assess and prioritize the critical elements that needed to be addressed to make it possible to restart company operations:

  • Microsoft Active Directory
  • Microsoft Exchange Server
  • Financials/MRP
To start, Progent followed Anti-virus penetration response industry best practices by halting lateral movement and removing active viruses. Progent then began the work of rebuilding Active Directory, the key technology of enterprise networks built upon Microsoft Windows Server technology. Microsoft Exchange Server messaging will not function without Active Directory, and the client's financials and MRP software used Microsoft SQL, which requires Windows AD for security authorization to the database.

In less than two days, Progent was able to re-build Windows Active Directory to its pre-penetration state. Progent then helped perform setup and hard drive recovery on needed applications. All Microsoft Exchange Server data and attributes were usable, which greatly helped the restore of Exchange. Progent was also able to find local OST files (Microsoft Outlook Off-Line Data Files) on team PCs in order to recover mail information. A not too old offline backup of the customer's manufacturing systems made them able to recover these essential applications back servicing users. Although a lot of work needed to be completed to recover completely from the Ryuk damage, essential services were restored quickly:

"For the most part, the production line operation showed little impact and we produced all customer deliverables."

Throughout the following few weeks important milestones in the recovery process were accomplished in close collaboration between Progent team members and the customer:

  • In-house web sites were returned to operation with no loss of information.
  • The MailStore Exchange Server exceeding four million historical emails was spun up and available for users.
  • CRM/Product Ordering/Invoicing/AP/Accounts Receivables (AR)/Inventory Control capabilities were completely recovered.
  • A new Palo Alto 850 security appliance was deployed.
  • Ninety percent of the user PCs were being used by staff.
"A huge amount of what happened that first week is mostly a haze for me, but I will not forget the care all of you accomplished to give us our business back. I've been working with Progent for the past ten years, possibly more, and every time I needed help Progent has impressed me and delivered as promised. This time was the most impressive ever."

Conclusion
A potential business disaster was dodged due to results-oriented experts, a broad array of subject matter expertise, and tight teamwork. Although in retrospect the ransomware penetration described here could have been identified and blocked with up-to-date cyber security technology and security best practices, user and IT administrator education, and well thought out security procedures for information protection and proper patching controls, the fact is that government-sponsored hackers from China, Russia, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a crypto-ransomware penetration, feel confident that Progent's roster of professionals has extensive experience in crypto-ransomware virus defense, cleanup, and file recovery.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen and Chris (and any others that were involved), thank you for making it so I could get rested after we got through the initial fire. All of you did an impressive job, and if any of your team is visiting the Chicago area, a great meal is the least I can do!"

Download the Ransomware Recovery Case Study Datasheet
To review or download a PDF version of this customer case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Midland
For ransomware recovery consulting in the Midland metro area, phone Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.