Crypto-Ransomware : Your Worst IT Catastrophe
Crypto-Ransomware Remediation ProfessionalsRansomware has become a modern cyberplague that represents an extinction-level danger for businesses poorly prepared for an assault. Versions of crypto-ransomware like the CryptoLocker, WannaCry, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for years and still cause damage. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Egregor, along with additional unnamed newcomers, not only encrypt on-line data files but also infiltrate most available system backups. Files synched to cloud environments can also be rendered useless. In a vulnerable data protection solution, this can make any restoration impossible and basically sets the datacenter back to zero.

Getting back services and data following a crypto-ransomware attack becomes a sprint against time as the victim fights to stop lateral movement, eradicate the ransomware, and restore business-critical activity. Due to the fact that ransomware requires time to move laterally across a network, penetrations are frequently launched during weekends and nights, when successful penetrations are likely to take longer to identify. This compounds the difficulty of quickly marshalling and orchestrating a knowledgeable mitigation team.

Progent makes available a variety of services for protecting San Jose organizations from crypto-ransomware penetrations. Among these are team member training to help identify and not fall victim to phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's behavior-based threat defense to detect and disable zero-day modern malware assaults. Progent in addition offers the assistance of expert crypto-ransomware recovery consultants with the skills and perseverance to rebuild a compromised environment as soon as possible.

Progent's Ransomware Recovery Help
Following a ransomware penetration, sending the ransom demands in cryptocurrency does not ensure that merciless criminals will provide the needed keys to unencrypt all your files. Kaspersky Labs ascertained that 17% of ransomware victims never restored their data after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom can reach millions. The alternative is to piece back together the critical components of your Information Technology environment. Without access to complete data backups, this requires a wide complement of skills, top notch project management, and the willingness to work non-stop until the recovery project is finished.

For decades, Progent has offered professional IT services for companies across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained top industry certifications in important technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security experts have garnered internationally-recognized certifications including CISM, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent also has experience with financial management and ERP software solutions. This breadth of expertise affords Progent the capability to quickly understand necessary systems and organize the remaining parts of your IT environment following a crypto-ransomware penetration and configure them into an operational system.

Progent's security group has state-of-the-art project management tools to orchestrate the complicated restoration process. Progent knows the urgency of working swiftly and together with a client's management and Information Technology team members to assign priority to tasks and to put critical services back on line as soon as possible.

Customer Case Study: A Successful Ransomware Intrusion Restoration
A business sought out Progent after their organization was crashed by the Ryuk ransomware. Ryuk is thought to have been developed by North Korean government sponsored hackers, possibly adopting approaches exposed from America's NSA organization. Ryuk goes after specific organizations with little room for disruption and is one of the most profitable incarnations of ransomware viruses. High publicized organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a regional manufacturing company headquartered in Chicago with about 500 workers. The Ryuk intrusion had shut down all essential operations and manufacturing capabilities. Most of the client's data backups had been on-line at the time of the attack and were eventually encrypted. The client was evaluating paying the ransom demand (more than $200K) and praying for good luck, but ultimately brought in Progent.

"I can't speak enough in regards to the expertise Progent gave us throughout the most fearful period of (our) businesses life. We had little choice but to pay the cyber criminals behind the attack if it wasn't for the confidence the Progent team afforded us. That you could get our e-mail system and critical applications back into operation sooner than a week was earth shattering. Every single expert I interacted with or messaged at Progent was laser focused on getting our company operational and was working breakneck pace on our behalf."

Progent worked together with the client to quickly assess and prioritize the key services that needed to be addressed in order to continue company operations:

  • Microsoft Active Directory
  • Electronic Messaging
  • MRP System
To begin, Progent adhered to ransomware penetration response best practices by stopping lateral movement and disinfecting systems. Progent then started the process of rebuilding Windows Active Directory, the core of enterprise networks built upon Microsoft technology. Microsoft Exchange messaging will not work without Windows AD, and the customer's MRP software utilized SQL Server, which needs Active Directory for access to the information.

In less than 48 hours, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then completed rebuilding and hard drive recovery on key applications. All Exchange schema and attributes were usable, which accelerated the rebuild of Exchange. Progent was also able to find local OST data files (Outlook Offline Data Files) on user desktop computers to recover mail data. A recent off-line backup of the businesses manufacturing systems made them able to restore these required applications back available to users. Although a lot of work needed to be completed to recover fully from the Ryuk event, essential services were restored quickly:

"For the most part, the production line operation survived unscathed and we produced all customer shipments."

Throughout the following few weeks key milestones in the recovery process were achieved through tight cooperation between Progent consultants and the customer:

  • Internal web applications were brought back up without losing any information.
  • The MailStore Microsoft Exchange Server exceeding four million historical messages was restored to operations and accessible to users.
  • CRM/Orders/Invoicing/Accounts Payable (AP)/AR/Inventory functions were completely restored.
  • A new Palo Alto 850 firewall was brought on-line.
  • Nearly all of the user desktops were fully operational.
"Much of what transpired during the initial response is nearly entirely a blur for me, but my management will not soon forget the dedication each of you accomplished to give us our business back. I've been working together with Progent for the past ten years, possibly more, and every time Progent has come through and delivered. This event was a Herculean accomplishment."

Conclusion
A possible business catastrophe was evaded due to dedicated professionals, a wide spectrum of knowledge, and tight collaboration. Although in retrospect the ransomware virus penetration detailed here could have been prevented with advanced cyber security technology solutions and recognized best practices, user and IT administrator training, and well thought out incident response procedures for data protection and keeping systems up to date with security patches, the fact is that state-sponsored cyber criminals from China, North Korea and elsewhere are tireless and are an ongoing threat. If you do fall victim to a ransomware virus, remember that Progent's team of experts has a proven track record in ransomware virus defense, mitigation, and information systems disaster recovery.

"So, to Darrin, Matt, Aaron, Dan, Claude, Jesse, Tony and Chris (and any others that were helping), I'm grateful for allowing me to get some sleep after we made it over the initial fire. All of you did an incredible effort, and if anyone that helped is around the Chicago area, a great meal is the least I can do!"

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in San Jose
For ransomware recovery consulting services in the San Jose area, call Progent at 800-462-8800 or see Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.