Ransomware : Your Crippling Information Technology Disaster
Crypto-Ransomware Recovery ProfessionalsCrypto-Ransomware has become a too-frequent cyber pandemic that represents an extinction-level threat for businesses of all sizes vulnerable to an assault. Different iterations of ransomware such as Reveton, Fusob, Bad Rabbit, NotPetya and MongoLock cryptoworms have been around for years and continue to cause destruction. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, plus frequent unnamed malware, not only perform encryption of on-line data but also infect most available system protection. Files replicated to off-premises disaster recovery sites can also be rendered useless. In a vulnerable environment, this can render automatic recovery impossible and basically knocks the network back to square one.

Getting back on-line applications and information following a ransomware attack becomes a sprint against time as the victim struggles to contain the damage, eradicate the virus, and restore enterprise-critical operations. Due to the fact that crypto-ransomware takes time to move laterally across a targeted network, attacks are often launched on weekends and holidays, when successful attacks in many cases take more time to recognize. This multiplies the difficulty of quickly marshalling and organizing an experienced mitigation team.

Progent makes available an assortment of support services for securing São José dos Campos organizations from ransomware penetrations. These include user education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's behavior-based cyberthreat protection to discover and disable zero-day malware assaults. Progent also provides the services of expert ransomware recovery consultants with the talent and commitment to reconstruct a breached environment as soon as possible.

Progent's Crypto-Ransomware Recovery Help
Soon after a crypto-ransomware attack, sending the ransom in cryptocurrency does not guarantee that merciless criminals will return the needed codes to unencrypt all your files. Kaspersky Labs estimated that 17% of crypto-ransomware victims never recovered their data even after having paid the ransom, resulting in increased losses. The risk is also very costly. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to re-install the critical elements of your Information Technology environment. Absent access to essential data backups, this calls for a wide range of IT skills, well-coordinated team management, and the ability to work 24x7 until the job is finished.

For decades, Progent has provided professional Information Technology services for businesses across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have been awarded advanced certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with financial systems and ERP software solutions. This breadth of expertise affords Progent the capability to quickly ascertain important systems and integrate the remaining pieces of your IT environment following a ransomware attack and rebuild them into a functioning network.

Progent's ransomware team uses state-of-the-art project management applications to coordinate the complex restoration process. Progent knows the importance of working swiftly and together with a customer's management and Information Technology resources to prioritize tasks and to put the most important applications back on line as fast as possible.

Client Story: A Successful Ransomware Intrusion Recovery
A business engaged Progent after their network system was crashed by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state sponsored hackers, suspected of adopting algorithms leaked from America's NSA organization. Ryuk targets specific businesses with limited room for operational disruption and is one of the most lucrative versions of crypto-ransomware. Well Known organizations include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturer located in the Chicago metro area with around 500 staff members. The Ryuk intrusion had paralyzed all essential operations and manufacturing capabilities. Most of the client's information backups had been online at the beginning of the intrusion and were damaged. The client was pursuing financing for paying the ransom demand (more than $200,000) and hoping for the best, but ultimately reached out to Progent.

"I can't tell you enough in regards to the support Progent provided us throughout the most stressful period of (our) company's existence. We may have had to pay the cyber criminals behind the attack if it wasn't for the confidence the Progent team provided us. The fact that you were able to get our messaging and key servers back online in less than seven days was beyond my wildest dreams. Each consultant I talked with or e-mailed at Progent was urgently focused on getting us operational and was working at all hours on our behalf."

Progent worked hand in hand the customer to rapidly identify and prioritize the mission critical applications that had to be addressed in order to restart departmental functions:

  • Active Directory (AD)
  • Microsoft Exchange Server
  • Financials/MRP
To get going, Progent followed AV/Malware Processes penetration mitigation best practices by stopping lateral movement and disinfecting systems. Progent then began the process of rebuilding Microsoft Active Directory, the core of enterprise environments built upon Microsoft technology. Microsoft Exchange Server email will not work without Active Directory, and the customer's MRP software used Microsoft SQL Server, which depends on Active Directory services for authentication to the information.

In less than 2 days, Progent was able to rebuild Windows Active Directory to its pre-virus state. Progent then completed setup and storage recovery of needed applications. All Exchange schema and configuration information were usable, which facilitated the rebuild of Exchange. Progent was able to assemble local OST files (Outlook Off-Line Data Files) on user desktop computers and laptops to recover email messages. A recent offline backup of the customer's accounting software made it possible to return these essential applications back online for users. Although a lot of work was left to recover fully from the Ryuk virus, the most important systems were returned to operations rapidly:

"For the most part, the production line operation ran fairly normal throughout and we did not miss any customer sales."

During the next month important milestones in the restoration process were achieved through tight collaboration between Progent team members and the customer:

  • Internal web applications were returned to operation with no loss of data.
  • The MailStore Microsoft Exchange Server with over 4 million historical messages was brought online and accessible to users.
  • CRM/Orders/Invoices/AP/AR/Inventory capabilities were 100 percent operational.
  • A new Palo Alto 850 security appliance was deployed.
  • Most of the user desktops and notebooks were fully operational.
"So much of what occurred during the initial response is nearly entirely a blur for me, but our team will not forget the commitment each and every one of you put in to help get our company back. I've been working with Progent for the past ten years, maybe more, and every time I needed help Progent has come through and delivered as promised. This time was a Herculean accomplishment."

Conclusion
A possible enterprise-killing catastrophe was averted with top-tier professionals, a broad array of IT skills, and tight collaboration. Although in analyzing the event afterwards the ransomware incident detailed here would have been stopped with modern cyber security technology and NIST Cybersecurity Framework best practices, staff education, and well thought out security procedures for information protection and applying software patches, the fact is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware virus, remember that Progent's team of professionals has proven experience in ransomware virus blocking, removal, and data recovery.

"So, to Darrin, Matt, Aaron, Claude, Jesse, Arnaud, Allen, Tony and Chris (along with others that were contributing), I'm grateful for allowing me to get rested after we got through the initial fire. Everyone did an fabulous effort, and if anyone is visiting the Chicago area, dinner is my treat!"

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, please click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Expertise in São José dos Campos
For ransomware cleanup consulting services in the São José dos Campos metro area, call Progent at 800-462-8800 or visit Contact Progent.

© 2002-2026 Progent Corporation. All rights reserved.