Ransomware : Your Worst IT Catastrophe
Ransomware Remediation ProfessionalsRansomware has become an escalating cyberplague that presents an existential threat for businesses of all sizes unprepared for an assault. Different versions of crypto-ransomware like the Dharma, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been replicating for a long time and still inflict havoc. Newer versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, along with daily as yet unnamed malware, not only encrypt online files but also infect all accessible system protection. Information replicated to the cloud can also be corrupted. In a poorly designed data protection solution, this can make automatic restoration hopeless and effectively knocks the network back to zero.

Recovering programs and data after a crypto-ransomware attack becomes a race against time as the targeted organization fights to contain the damage, remove the ransomware, and resume business-critical activity. Due to the fact that ransomware takes time to spread throughout a targeted network, penetrations are frequently launched during nights and weekends, when successful penetrations in many cases take more time to detect. This compounds the difficulty of quickly marshalling and coordinating a capable mitigation team.

Progent offers an assortment of help services for securing Lima enterprises from crypto-ransomware penetrations. Among these are team member training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to identify and suppress day-zero malware attacks. Progent also can provide the assistance of veteran crypto-ransomware recovery engineers with the track record and perseverance to re-deploy a breached system as urgently as possible.

Progent's Ransomware Recovery Support Services
Following a ransomware penetration, even paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will provide the needed codes to unencrypt any of your data. Kaspersky determined that seventeen percent of crypto-ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The alternative is to piece back together the vital parts of your IT environment. Without the availability of complete system backups, this requires a wide range of skills, well-coordinated team management, and the capability to work continuously until the recovery project is complete.

For decades, Progent has offered expert IT services for businesses throughout the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes professionals who have earned top certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have garnered internationally-recognized certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of experience gives Progent the ability to knowledgably ascertain critical systems and consolidate the surviving pieces of your computer network system following a crypto-ransomware penetration and assemble them into a functioning network.

Progent's ransomware team has best of breed project management tools to orchestrate the complex restoration process. Progent appreciates the importance of acting rapidly and in unison with a customer's management and Information Technology resources to assign priority to tasks and to put critical systems back online as fast as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Intrusion Restoration
A small business engaged Progent after their network system was crashed by Ryuk ransomware virus. Ryuk is generally considered to have been launched by North Korean state sponsored criminal gangs, possibly using approaches leaked from America's NSA organization. Ryuk attacks specific businesses with little tolerance for disruption and is among the most lucrative versions of ransomware. Major organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a small manufacturing company located in the Chicago metro area and has about 500 employees. The Ryuk event had disabled all company operations and manufacturing processes. Most of the client's data protection had been directly accessible at the start of the attack and were damaged. The client was pursuing financing for paying the ransom (in excess of $200K) and wishfully thinking for the best, but ultimately utilized Progent.

"I can't thank you enough about the expertise Progent provided us during the most stressful period of (our) company's survival. We had little choice but to pay the cybercriminals except for the confidence the Progent team provided us. The fact that you could get our e-mail and key applications back faster than 1 week was beyond my wildest dreams. Each expert I worked with or communicated with at Progent was totally committed on getting my company operational and was working all day and night to bail us out."

Progent worked with the client to quickly get our arms around and assign priority to the critical systems that needed to be recovered in order to restart departmental functions:

  • Active Directory (AD)
  • Electronic Messaging
  • Accounting/MRP
To get going, Progent adhered to Anti-virus incident response best practices by stopping the spread and clearing infected systems. Progent then initiated the steps of bringing back online Windows Active Directory, the key technology of enterprise environments built upon Microsoft Windows Server technology. Microsoft Exchange email will not operate without Active Directory, and the businesses' MRP software utilized Microsoft SQL Server, which requires Windows AD for access to the database.

Within 2 days, Progent was able to recover Active Directory services to its pre-virus state. Progent then performed setup and storage recovery on mission critical systems. All Exchange schema and configuration information were intact, which accelerated the restore of Exchange. Progent was able to find intact OST files (Microsoft Outlook Off-Line Folder Files) on team desktop computers to recover mail messages. A not too old off-line backup of the businesses financials/ERP systems made it possible to recover these essential applications back on-line. Although significant work was left to recover fully from the Ryuk event, essential systems were returned to operations rapidly:

"For the most part, the manufacturing operation showed little impact and we did not miss any customer shipments."

During the next couple of weeks key milestones in the recovery project were accomplished through tight collaboration between Progent engineers and the customer:

  • In-house web applications were brought back up without losing any data.
  • The MailStore Server containing more than four million historical messages was restored to operations and accessible to users.
  • CRM/Product Ordering/Invoicing/Accounts Payable/AR/Inventory functions were completely functional.
  • A new Palo Alto 850 firewall was brought on-line.
  • Ninety percent of the user PCs were back into operation.
"A huge amount of what occurred in the initial days is mostly a fog for me, but our team will not forget the urgency all of you put in to help get our business back. I have trusted Progent for at least 10 years, possibly more, and every time Progent has outperformed my expectations and delivered as promised. This event was no exception but maybe more Herculean."

Conclusion
A probable business disaster was evaded with results-oriented experts, a broad range of technical expertise, and close teamwork. Although in post mortem the ransomware virus attack detailed here should have been shut down with current cyber security technology solutions and security best practices, staff education, and well designed security procedures for information protection and proper patching controls, the reality remains that government-sponsored hackers from Russia, China and elsewhere are relentless and are not going away. If you do fall victim to a ransomware attack, remember that Progent's team of experts has a proven track record in crypto-ransomware virus defense, remediation, and file disaster recovery.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Arnaud, Allen, Tony and Chris (and any others who were involved), I'm grateful for making it so I could get some sleep after we got through the initial push. All of you did an incredible job, and if any of your team is around the Chicago area, a great meal is the least I can do!"

Download the Crypto-Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Lima
For ransomware cleanup expertise in the Lima metro area, phone Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.